Configuration & IAM

Setting up profiles, switching accounts, and the IAM commands you actually reach for day to day — users, roles, policies, and assuming roles across accounts.

Configuring a profile#

Copy
aws configure --profile myprofile               # interactive: access key, secret, region, output format
aws configure set region us-east-1 --profile myprofile
aws configure set output json --profile myprofile
aws configure sso --profile myprofile            # set up an IAM Identity Center (SSO) profile instead

Listing and switching profiles#

Copy
aws configure list-profiles                      # every profile defined in ~/.aws/config and ~/.aws/credentials
aws configure list --profile myprofile            # show resolved config + where each value came from
export AWS_PROFILE=myprofile                      # switch the active profile for the current shell
aws sts get-caller-identity                        # confirm which identity/account the active profile resolves to

aws configure list's output tells you where a value is coming from (env var, config file, credential file, or IAM instance role) — invaluable when a command is silently using the wrong account and you can't tell why.

Assuming a role (cross-account access)#

Copy
aws sts assume-role \
  --role-arn arn:aws:iam::111122223333:role/DeployRole \
  --role-session-name my-session \
  --duration-seconds 3600

This prints temporary AccessKeyId/SecretAccessKey/SessionToken credentials to stdout — export them as env vars, or configure a profile block with role_arn + source_profile in ~/.aws/config so the CLI assumes the role automatically on every call for that profile.

Managing IAM users#

Copy
aws iam list-users
aws iam create-user --user-name jane
aws iam get-user --user-name jane
aws iam delete-user --user-name jane
aws iam create-access-key --user-name jane        # generates a new access key pair for that user
aws iam list-access-keys --user-name jane

Managing IAM roles#

Copy
aws iam list-roles
aws iam create-role \
  --role-name MyServiceRole \
  --assume-role-policy-document file://trust-policy.json
aws iam get-role --role-name MyServiceRole
aws iam delete-role --role-name MyServiceRole

--assume-role-policy-document is the trust policy — who is allowed to assume this role — not the permissions the role grants. Permissions come from a separate policy attached with attach-role-policy.

Attaching and inspecting policies#

Copy
aws iam attach-role-policy --role-name MyServiceRole --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
aws iam attach-user-policy --user-name jane --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
aws iam list-attached-role-policies --role-name MyServiceRole
aws iam list-attached-user-policies --user-name jane
aws iam detach-role-policy --role-name MyServiceRole --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess

Filtering output with --query and --output#

Copy
aws iam list-users --query 'Users[].UserName' --output text
aws iam list-roles --query "Roles[?contains(RoleName, 'Deploy')].RoleName" --output table

--query uses JMESPath against the JSON response — it runs client-side after the API call, so it doesn't reduce API load, only the output you see. --output controls the rendering format: json (default), text, table, or yaml.