IAM

aws iam create-user --user-name alice
aws iam list-users --query 'Users[*].[UserName,UserId,CreateDate]' --output table
aws iam delete-user --user-name alice

# Console password
aws iam create-login-profile --user-name alice --password 'Temp!Pass1' --password-reset-required

# Access keys
aws iam create-access-key --user-name alice
aws iam list-access-keys --user-name alice
aws iam update-access-key --user-name alice --access-key-id AKIA... --status Inactive
aws iam delete-access-key --user-name alice --access-key-id AKIA...

aws iam create-group --group-name developers
aws iam add-user-to-group    --group-name developers --user-name alice
aws iam remove-user-from-group --group-name developers --user-name alice
aws iam list-groups-for-user --user-name alice
aws iam delete-group --group-name developers

# Create role with trust policy (who can assume it)
aws iam create-role \
  --role-name lambda-exec \
  --assume-role-policy-document file://trust.json

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "lambda.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Service": "ec2.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }]
}

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "AWS": "arn:aws:iam::987654321098:root" },
    "Action": "sts:AssumeRole",
    "Condition": { "StringEquals": { "sts:ExternalId": "uniquetoken" } }
  }]
}

aws iam list-roles --query 'Roles[*].[RoleName,RoleId,CreateDate]' --output table
aws iam get-role --role-name lambda-exec
aws iam delete-role --role-name lambda-exec          # must detach policies first

# Attach AWS managed policy to user/role/group
aws iam attach-user-policy  --user-name alice  --policy-arn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
aws iam attach-role-policy  --role-name my-role --policy-arn arn:aws:iam::aws:policy/AWSLambdaBasicExecutionRole
aws iam attach-group-policy --group-name devs  --policy-arn arn:aws:iam::aws:policy/PowerUserAccess

# Detach
aws iam detach-role-policy  --role-name my-role --policy-arn arn:aws:iam::aws:policy/AWSLambdaBasicExecutionRole

# List policies on a role
aws iam list-attached-role-policies --role-name my-role

# Search managed policies
aws iam list-policies --scope AWS --query 'Policies[?contains(PolicyName,`S3`)].[PolicyName,Arn]' --output table

# Create
aws iam create-policy \
  --policy-name s3-read-my-bucket \
  --policy-document file://policy.json

# Update (new version)
aws iam create-policy-version \
  --policy-arn arn:aws:iam::123:policy/s3-read-my-bucket \
  --policy-document file://policy-v2.json \
  --set-as-default

aws iam list-policy-versions --policy-arn arn:aws:iam::123:policy/s3-read-my-bucket
aws iam delete-policy --policy-arn arn:aws:iam::123:policy/s3-read-my-bucket

# Embed directly on a role (not reusable)
aws iam put-role-policy \
  --role-name my-role \
  --policy-name inline-s3 \
  --policy-document file://policy.json

aws iam list-role-policies --role-name my-role
aws iam get-role-policy    --role-name my-role --policy-name inline-s3
aws iam delete-role-policy --role-name my-role --policy-name inline-s3

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowS3Read",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    },
    {
      "Sid": "DenyDelete",
      "Effect": "Deny",
      "Action": "s3:DeleteObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

# Assume a role
aws sts assume-role \
  --role-arn arn:aws:iam::123456789012:role/MyRole \
  --role-session-name cli-session \
  --duration-seconds 3600

# Check current identity
aws sts get-caller-identity

# Get session token (for MFA-required operations)
aws sts get-session-token \
  --serial-number arn:aws:iam::123:mfa/alice \
  --token-code 123456 \
  --duration-seconds 43200

# Create instance profile and add role to it
aws iam create-instance-profile --instance-profile-name web-profile
aws iam add-role-to-instance-profile \
  --instance-profile-name web-profile \
  --role-name web-role

# Attach to existing instance
aws ec2 associate-iam-instance-profile \
  --instance-id i-0abc123 \
  --iam-instance-profile Name=web-profile

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::123:user/alice \
  --action-names s3:GetObject s3:DeleteObject \
  --resource-arns arn:aws:s3:::my-bucket/*

# Generate credentials report (all users, key ages, MFA status)
aws iam generate-credential-report
aws iam get-credential-report --query 'Content' --output text | base64 -d

# Access Advisor — which services were last accessed
aws iam generate-service-last-accessed-details \
  --arn arn:aws:iam::123:role/my-role
# Use the job-id from above:
aws iam get-service-last-accessed-details --job-id abc-123

# List all roles and their last activity
aws iam get-account-summary