Skip to main content
emisar

AWS IAM operations

v0.1.10

IAM introspection — users, roles, policies, attached policies, access keys — plus incident-response mutators: deactivate access key, delete access key, detach user policy. Auth via AWS_PROFILE. Routine IAM changes belong in IaC; these actions are for emergency lockout.

8 allowed by default 1 need approval by default 2 denied by default
Pack ID
aws-iam
Vendor
emisar
OS
linux
Actions
11
Required binaries. Install these on the host before relying on the pack — an action that calls a missing one fails at run time.
aws

Install

emisar pack install fetches this pack, re-validates it, and verifies its content hash against the --hash below — the exact bytes this page was rendered against, so a tampered copy is rejected — before copying it into the runner's packs dir. The command reloads a running daemon itself; no manual restart.

on the runner host 
sudo emisar pack install aws-iam --hash sha256:553d4a93d4d49aca82555121f574a3dfb16068c9c61c694d8c4740a741affd10

Setup

Drives the aws CLI on the runner host. It resolves credentials from its own environment or ~/.aws config — the runner only forwards the variables you allowlist in inherit_env .

Environment

Set these on the runner host, then add each name to execution.inherit_env so the value reaches the action.

  • AWS_PROFILE

    Named profile in ~/.aws/config and ~/.aws/credentials . Omit to use the default profile or static-key/instance-role auth.

  • AWS_ACCESS_KEY_ID

    Static access key. Use instead of a profile; pair with AWS_SECRET_ACCESS_KEY .

  • AWS_SECRET_ACCESS_KEY

    Secret for AWS_ACCESS_KEY_ID .

  • AWS_SESSION_TOKEN

    Session token for temporary (STS) credentials.

Notes

  • An EC2 instance role or ECS task role needs no key at all and is the shape to prefer; a static pair is minted from the IAM users console → the user → Security credentials → Create access key.
  • IAM is a global service, so no region is required (AWS_REGION is harmless if set).
  • Read actions need iam:Get*/List*. The mutators deactivate_access_key / delete_access_key / detach_user_policy additionally need iam:UpdateAccessKey / DeleteAccessKey / DetachUserPolicy.
  • Alternative to env keys: an ~/.aws/credentials profile (read from disk, no inherit_env entry) or, on EC2/ECS, the instance/task role from instance metadata (no credentials needed at all).

Verify it works

Runs iam.list_users, a low-risk read that confirms the pack can reach its target. Run it on the host once the pack is installed; pack install runs it for you.

on the runner host 
sudo emisar pack verify aws-iam

Install and configure a pack walks through the whole sequence on a host.

Actions 11 total

View on GitHub
  • iam.deactivate_access_key exec critical Critical — data loss or irreversible

    aws iam update-access-key --status Inactive

    Disable an IAM access key. ALL API calls using this key fail immediately. Use during an incident when a key is suspected compromised — it stops blast radius before rotation completes. Reversible by setting status back to Active.

    View source on GitHub
  • iam.delete_access_key exec critical Critical — data loss or irreversible

    aws iam delete-access-key

    Permanently delete an IAM access key. Irreversible. Use after rotation when the old key is no longer needed. Prefer deactivate_access_key for incident response (it's reversible).

    View source on GitHub
  • iam.detach_user_policy exec high High — service-affecting

    aws iam detach-user-policy

    Detach one managed policy from one user. Use to remove overly broad permissions during an incident. The policy itself is not modified; just the attachment.

    View source on GitHub
  • iam.get_role exec low Low — read-only or trivially reversible

    aws iam get-role

    Get one IAM role's details + trust policy.

    View source on GitHub
  • iam.get_user exec low Low — read-only or trivially reversible

    aws iam get-user

    Get one IAM user's details.

    View source on GitHub
  • iam.last_used_access_key exec low Low — read-only or trivially reversible

    aws iam get-access-key-last-used

    Show when one access key was last used (use to spot dormant keys).

    View source on GitHub
  • iam.list_access_keys exec low Low — read-only or trivially reversible

    aws iam list-access-keys

    List access key IDs for one user (NOT the secret).

    View source on GitHub
  • iam.list_attached_user_policies exec low Low — read-only or trivially reversible

    aws iam list-attached-user-policies

    List policies attached to one IAM user.

    View source on GitHub
  • iam.list_policies exec low Low — read-only or trivially reversible

    aws iam list-policies --scope Local

    List all customer-managed IAM policies.

    View source on GitHub
  • iam.list_roles exec low Low — read-only or trivially reversible

    aws iam list-roles

    List all IAM roles in the account.

    View source on GitHub
  • iam.list_users exec low Low — read-only or trivially reversible

    aws iam list-users

    List all IAM users in the account.

    View source on GitHub
← Back to registry
Pack reference  Publish your own