AWS code-library documentation change
Summary
Added PowerShell V5 example showing how to retrieve IAM role details including trust policy decoding
Security assessment
Documents how to inspect role trust policies which is security-related, but does not address a specific vulnerability
Diff
diff --git a/code-library/latest/ug/iam_example_iam_GetRole_section.md b/code-library/latest/ug/iam_example_iam_GetRole_section.md index 5a5260983..fb06b005b 100644 --- a//code-library/latest/ug/iam_example_iam_GetRole_section.md +++ b//code-library/latest/ug/iam_example_iam_GetRole_section.md @@ -245,0 +246,38 @@ PowerShell +**Tools for PowerShell V5** + + +**Example 1: This example returns the details of the`lamda_exec_role`. It includes the trust policy document that specifies who can assume this role. The policy document is URL encoded and can be decoded using the .NET `UrlDecode` method. In this example, the original policy had all white space removed before it was uploaded to the policy. To see the permissions policy documents that determine what someone who assumes the role can do, use the `Get-IAMRolePolicy` for inline policies, and `Get-IAMPolicyVersion` for attached managed policies.** + + + $results = Get-IamRole -RoleName lambda_exec_role + $results | Format-List + + +**Output:** + + + Arn : arn:aws:iam::123456789012:role/lambda_exec_role + AssumeRolePolicyDocument : %7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22 + %3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service + %22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole + %22%7D%5D%7D + CreateDate : 4/2/2015 9:16:11 AM + Path : / + RoleId : 2YBIKAIBHNKB4EXAMPLE1 + RoleName : lambda_exec_role + + + $policy = [System.Web.HttpUtility]::UrlDecode($results.AssumeRolePolicyDocument) + $policy + + +**Output:** + + + {"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]} + + * For API details, see [GetRole](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. + + + +