aws : A single command(aws-cli) to get the IAM user name with the what all permission he/she have , would be great if can be downloaded as an excel or csv ?

2 Answers 2


You can use the below command to get all the policy attached to an iam user. (You must be having permissions to list-users and list-user-policies before using the below commands)

aws iam list-attached-user-policies --user-name username | jq -r '.AttachedPolicies[].PolicyArn' | awk -F'policy/' {'print $NF'}

(Make sure to replace username with some actual iam username in the above command)

If you want to get the list of all users and user-policies attached to those users, you can use the below one line command. The below command will get all the iam users and then will find the user-policies attached to that user and will put in a CSV file. The first column will contain username and second column will contain `policies separated by spaces.

for u_name in $(aws iam list-users | jq -r '.Users[].UserName') ; do permissions="$(aws iam list-attached-user-policies --user-name ${u_name} | jq -r '.AttachedPolicies[].PolicyArn' | awk -F'policy/' {'print $NF'} | tr '\n' ' ')" ; echo "${u_name}, ${permissions}" >> iam_users.csv ; done
  • You saved my day ! cheers ! Nov 25, 2019 at 17:32

If you are looking to get the results for a single user then you want list-attached-user-policies. However, this will result in the value being returned as json. To get it into a csv style format check out the guide on how to control the CLI output. You should be able to get the output into a delimited format for programmatic parsing. I do not believe you'll be able to generate an .xlsx file directly from the AWS CLI.

  • Yes, generating an excel file directly from aws-cli won't be possible. He need to use different parsing program for formatting.
    – Samit
    Nov 25, 2019 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.