Show allowed iam actions

[kaihendry]

Currently I do something like:

$ aws iam list-role-policies --role-name foobar
{
    "PolicyNames": [
        "custom-policy",
        "ecs-policy"
    ]
}
$ aws iam list-attached-role-policies --role-name foobar
{
    "AttachedPolicies": [
        {
            "PolicyName": "AmazonEC2ContainerRegistryPowerUser",
            "PolicyArn": "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser"
        }
    ]
}

But this doesn't actually show me the actions in one list of what the role can do.

Is there some easier way to list out what a role is capable of?

[tim-finnigan]

IAM Access Analyzer or Policy Simulator may help with what you're trying to do, but there are many nuances/variables involved in permission boundaries such as session policies, resource policies, service control policies, etc. There doesn't seem to be an API/command specifically for your use case, although you could run describe-policy on each of the attached policies to get more info on those.