Need to make an identical copy of AWS IAM role (including policies and trust relationship it has)

Question

I have a IAM role (with many policies and a trust relationship in it). I used this in building a AWS Cognito User Pool. However, this IAM role will be deleted soon.

Making a copy manually will be a chore and also not repeatable. I would like to make a copy either via CLI or script of some other repeatable way.

So far, I have searched through stackoverflow and google, but failed to find anything relevant.

Any help is appreciated.

score 6 · Accepted Answer · edited Aug 31 '22 at 21:22

6

It looks like you will need to use:

list_role_policies() to obtain the names of inline policies attached to the role
get_role_policy() to retrieve inline policies
list_attached_role_policies() to list managed policies that are attached to the role

Then create a new role and use:

put_role_policy() to attach an inline policy
attach_role_policy() to attach a managed policy

Trust Relationship also has to be copied.

edited Aug 31 '22 at 21:22

Community

1
1

answered Apr 15 '20 at 06:45

John Rotenstein

241,921
22
380
470

18

Why does AWS make common tasks like this one so difficult to accomplish? – pdoherty926 Jan 17 '21 at 14:59
I think trust relationship is an extra needed step – earizon May 19 '22 at 10:42

score 6 · Answer 2 · answered Mar 15 '21 at 21:38

Thanks to @JohnRotenstein for pointing in the right direction. I came up with a Node.js script to automate the IAM role copy procedure.

Steps it performs along with AWS SDK APIs used:

Fetch the source role along with its trust relationship policy: getRole()
Fetch inline policies of the source role: listRolePolicies(), getRolePolicy()
Fetch managed policies of the source role (both AWS- and customer-created): listAttachedRolePolicies()
Create a new role copying over all relevant properties (including trust policy): createRole()
Add all inline policies found in the source role to the new role: putRolePolicy()
Attach all managed policies from the source role: attachRolePolicy()

The process is quite straightforward... The only interesting detail is steps 2 and 3 require recursive fetch to accommodate the fact that policies response can be paginated.

How to make a copy of AWS IAM role.