IAM controls who (or what) can do what, on which resources. Almost every AWS incident that isn't capacity-related traces back to an IAM policy — either too permissive, or one blocking something legitimate.
Identity
aws sts get-caller-identityShows the account, ARN and user ID for the currently active credentials.
Users
aws iam list-usersLists IAM users in the account.
aws iam create-user --user-name deploy-botCreates a new IAM user.
aws iam list-access-keys --user-name deploy-botLists access keys for a user, including their creation date and last-used status.
aws iam create-access-key --user-name deploy-botCreates a new access key pair. The secret key is shown only once — store it in a secrets manager immediately.
aws iam delete-access-key --user-name deploy-bot --access-key-id AKIAEXAMPLEPermanently revokes an access key. Anything still using it starts failing auth immediately.
Roles
aws iam list-rolesLists IAM roles in the account.
aws iam get-role --role-name my-roleShows a role's trust policy — who or what is allowed to assume it.
aws sts assume-role --role-arn arn:aws:iam::123456789012:role/my-role --role-session-name debug-sessionAssumes a role, returning temporary credentials scoped to it — the standard way to act as a role from the CLI without permanently switching identity.
Prefer roles over long-lived keys
An EC2 instance profile, an EKS IAM Role for Service Accounts (IRSA), or a Lambda execution role all grant temporary, auto-rotating credentials with no key to leak. Reach for a static access key only when nothing else is available (a script running outside AWS entirely).
Policies
aws iam list-policies --scope LocalLists customer-managed policies in the account (excludes AWS-managed ones).
aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/my-policy --version-id v1Shows the actual JSON document for a specific policy version.
aws iam attach-user-policy --user-name deploy-bot --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccessAttaches an existing policy to a user, granting the permissions it defines.
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::123456789012:user/deploy-bot --action-names s3:PutObject --resource-arns arn:aws:s3:::my-bucket/*Tests whether a principal's current policies would allow a specific action, without actually attempting it — the fastest way to debug an AccessDenied error.
Least privilege, always
Start from a policy scoped to exactly the actions and resources a role needs, not Action: "*". Broad policies
are the single most common root cause of a small mistake becoming a major incident.