Skip to content
AWS for Query.Farm

aws.iam.list_policies_granting_service_access

Example SQL Queries

SELECT * FROM
aws.iam.list_policies_granting_service_access
WHERE
"arn" = 'VALUE'
AND "service_namespaces" = 'VALUE';

Description

Retrieves a list of policies that the IAM identity (user, group, or role) can use to access each specified service.

This operation does not use other policy types when determining whether a resource could access a service. These other policy types include resource-based policies, access control lists, Organizations policies, IAM permissions boundaries, and STS assume role policies. It only applies permissions policy logic. For more about the evaluation of policy types, see Evaluating policies in the IAM User Guide.

The list of policies returned by the operation depends on the ARN of the identity that you provide.

  • User – The list of policies includes the managed and inline policies that are attached to the user directly. The list also includes any additional managed and inline policies that are attached to the group to which the user belongs.

  • Group – The list of policies includes only the managed and inline policies that are attached to the group directly. Policies that are attached to the group’s user are not included.

  • Role – The list of policies includes only the managed and inline policies that are attached to the role.

For each managed policy, this operation returns the ARN and policy name. For each inline policy, it returns the policy name and the entity to which it is attached. Inline policies do not have an ARN. For more information about these policy types, see Managed policies and inline policies in the IAM User Guide.

Policies that are attached to users and roles as permissions boundaries are not returned. To view which managed policy is currently used to set the permissions boundary for a user or role, use the GetUser or GetRole operations.

Table Definition

Column NameColumn Data Type
arn Required Input Column

The ARN of the IAM identity (user, group, or role) whose policies you want to list.

VARCHAR
service_namespaces Required Input Column

The service namespace for the Amazon Web Services services whose policies you want to list.

To learn the service namespace for a service, see Actions, resources, and condition keys for Amazon Web Services services in the IAM User Guide. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services service namespaces in the Amazon Web Services General Reference.

VARCHAR[]
Show child fields
service_namespaces[]
marker Input Column

When IsTruncated is true, this element is present and contains the value to use for the Marker parameter in a subsequent pagination request.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

is_truncated

A flag that indicates whether there are more items to return. If your results were truncated, you can make a subsequent pagination request using the Marker request parameter to retrieve more items. We recommend that you check IsTruncated after every call to ensure that you receive all your results.

BOOLEAN
policies_granting_service_access

A ListPoliciesGrantingServiceAccess object that contains details about the permissions policies attached to the specified identity (user, group, or role).

STRUCT(
    "service_namespace" VARCHAR,
    "policies" STRUCT(
        "policy_name" VARCHAR,
        "policy_type" VARCHAR,
        "policy_arn" VARCHAR,
        "entity_type" VARCHAR,
        "entity_name" VARCHAR
    )[]
)[]
Show child fields
policies_granting_service_access[]
Show child fields
policies_granting_service_access[].policies[]
Show child fields
policies_granting_service_access[].policies[].entity_name

The name of the entity (user or role) to which the inline policy is attached.

This field is null for managed policies. For more information about these policy types, see Managed policies and inline policies in the IAM User Guide.

policies_granting_service_access[].policies[].entity_type

The type of entity (user or role) that used the policy to access the service to which the inline policy is attached.

This field is null for managed policies. For more information about these policy types, see Managed policies and inline policies in the IAM User Guide.

policies_granting_service_access[].policies[].policy_arn

The Amazon Resource Name (ARN). ARNs are unique identifiers for Amazon Web Services resources.

For more information about ARNs, go to Amazon Resource Names (ARNs) in the Amazon Web Services General Reference.

policies_granting_service_access[].policies[].policy_name

The policy name.

policies_granting_service_access[].policies[].policy_type

The policy type. For more information about these policy types, see Managed policies and inline policies in the IAM User Guide.

policies_granting_service_access[].service_namespace

The namespace of the service that was accessed.

To learn the service namespace of a service, see Actions, resources, and condition keys for Amazon Web Services services in the Service Authorization Reference. Choose the name of the service to view details for that service. In the first paragraph, find the service prefix. For example, (service prefix: a4b). For more information about service namespaces, see Amazon Web Services service namespaces in the Amazon Web Services General Reference.