Skip to content
AWS for Query.Farm

aws.iam.list_entities_for_policy

Example SQL Queries

SELECT * FROM
aws.iam.list_entities_for_policy
WHERE
"policy_arn" = 'VALUE';

Description

Lists all IAM users, groups, and roles that the specified managed policy is attached to.

You can use the optional EntityFilter parameter to limit the results to a particular type of entity (users, groups, or roles). For example, to list only the roles that are attached to the specified policy, set EntityFilter to Role.

You can paginate the results using the MaxItems and Marker parameters.

Table Definition

Column NameColumn Data Type
policy_arn Required Input Column

The Amazon Resource Name (ARN) of the IAM policy for which you want the versions.

For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.

VARCHAR
entity_filter Input Column

The entity type to use for filtering the results.

For example, when EntityFilter is Role, only the roles that are attached to the specified policy are returned. This parameter is optional. If it is not included, all attached entities (users, groups, and roles) are returned. The argument for this parameter must be one of the valid values listed below.

VARCHAR
path_prefix Input Column

The path prefix for filtering the results. This parameter is optional. If it is not included, it defaults to a slash (/), listing all entities.

This parameter allows (through its regex pattern) a string of characters consisting of either a forward slash (/) by itself or a string that must begin and end with forward slashes. In addition, it can contain any ASCII character from the ! (\u0021) through the DEL character (\u007F), including most punctuation characters, digits, and upper and lowercased letters.

VARCHAR
policy_usage_filter Input Column

The policy usage method to use for filtering the results.

To list only permissions policies, set PolicyUsageFilter to PermissionsPolicy. To list only the policies used to set permissions boundaries, set the value to PermissionsBoundary.

This parameter is optional. If it is not included, all policies are returned. 

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

policy_groups

A list of IAM groups that the policy is attached to.

STRUCT(
    "group_name" VARCHAR,
    "group_id" VARCHAR
)[]
Show child fields
policy_groups[]
Show child fields
policy_groups[].group_id

The stable and unique string identifying the group. For more information about IDs, see IAM identifiers in the IAM User Guide.

policy_groups[].group_name

The name (friendly name, not ARN) identifying the group.

policy_roles

A list of IAM roles that the policy is attached to.

STRUCT(
    "role_name" VARCHAR,
    "role_id" VARCHAR
)[]
Show child fields
policy_roles[]
Show child fields
policy_roles[].role_id

The stable and unique string identifying the role. For more information about IDs, see IAM identifiers in the IAM User Guide.

policy_roles[].role_name

The name (friendly name, not ARN) identifying the role.

policy_users

A list of IAM users that the policy is attached to.

STRUCT(
    "user_name" VARCHAR,
    "user_id" VARCHAR
)[]
Show child fields
policy_users[]
Show child fields
policy_users[].user_id

The stable and unique string identifying the user. For more information about IDs, see IAM identifiers in the IAM User Guide.

policy_users[].user_name

The name (friendly name, not ARN) identifying the user.