如何使用 boto3 列出附加到 IAM 角色的所有资源？

Question

I wish to list down all the resources that is attached to a IAM role. I am writing a program that would clean up the IAM roles that are not associated with any resources(like ec2 resource, lambda, task definition etc.)

import boto3
client = boto3.client('iam')
iam = boto3.resource('iam')
roles = client.list_roles()
role_name = []
Role_list = roles['Roles']
for key in Role_list:
    role_name.append(key['RoleName'])
print(*role_name,sep='\n')

for name in role_name:
    role = iam.Role( name )
    print(name)   
    print(role.get_available_subresources())

Answer 1

There is no command to list all resources that are "using" an IAM Role.

Instead, you would need to retrieve a list for each type of resource and then check the IAM Role that is assigned to each of them.

Also, please note that applications can assume an IAM Role through an API call in their code. Therefore, they are "using" an IAM Role, but there is no specific assignment of the role to the application.

Answer 2

You can use get_role(RoleName="MyRoleName") to get the attached resources.

Boto3 Documentation

iam = boto3.client('iam')
role_policy = iam.get_role(RoleName="MyRoleName")
print (role_policy)

Expected Output:

{
    'Role': {
        'Arn': 'arn:aws:iam::123456789012:role/Test-Role',
        'AssumeRolePolicyDocument': '<URL-encoded-JSON>',
        'CreateDate': datetime(2013, 4, 18, 5, 1, 58, 3, 108, 0),
        'Path': '/',
        'RoleId': 'AIDIODR4TAW7CSEXAMPLE',
        'RoleName': 'Test-Role',
    },
    'ResponseMetadata': {
        '...': '...',
    },
}