AWS PowerUserAccess权限创建VM时无法列出角色问题排查

Let’s walk through the most likely reasons your iam:ListRoles request is failing, even though your PowerUserAccess policy explicitly allows it, along with steps to diagnose each issue:

1. Verify the Policy is Applied to the Correct Identity #

First, double-check that the identity making the iam:ListRoles call actually has the policy attached:

• If you’re using an EC2 instance role to access IAM from your VM: User group policies only apply to IAM users, not EC2 instance roles. You’ll need to attach the PowerUserAccess policy (or a custom policy with iam:ListRoles) directly to the instance role assigned to your VM.
• If you’re using an IAM user (e.g., via AWS credentials on the VM): Confirm the user is still in the group with the PowerUserAccess policy. Run these CLI commands to verify:

  # Check policies attached to the group
  aws iam list-attached-group-policies --group-name YOUR_GROUP_NAME
  # Check if the user is in the group
  aws iam list-groups-for-user --user-name YOUR_USER_NAME
  

2. Look for Explicit Deny Policies #

IAM evaluates explicit Deny statements first, which override any Allow permissions. Check these areas:

• Service Control Policies (SCPs): If your AWS account is part of an Organization, an SCP might restrict iam:ListRoles across the account. Use this command to inspect your SCPs:

  aws organizations describe-policy --policy-id YOUR_SCP_POLICY_ID
  

• Permission Boundaries: If the IAM user/role has a permission boundary, ensure the boundary explicitly allows iam:ListRoles—permission boundaries define the maximum permissions an identity can use, even if other policies grant more access.
• User/Role-Level Deny Policies: Check if there’s a direct Deny statement on the user, role, or any other attached policies that blocks iam:ListRoles.

3. Validate the Caller Identity and Context #

Make sure you’re using the right credentials when making the request:

• Run this command on your VM to confirm the identity making the API call:

  aws sts get-caller-identity
  

  Compare the returned ARN to the identity you expect to have the PowerUserAccess policy. If it’s an instance role, go back to step 1 to fix the policy attachment.
• If using the AWS Console from the VM, clear your browser cache and confirm you’re logged in with the correct IAM user. Even though iam:ListRoles is a global operation, sometimes console caching can cause permission issues.

4. Check for Policy Syntax/Logic Conflicts #

While your policy looks correct at a glance, double-check the interaction between the two statements:

• The first statement uses NotAction: ["iam:*", "organizations:*"] to allow all actions except IAM/Organizations operations. The second statement explicitly allows specific IAM/Organizations actions (including iam:ListRoles), which should override the first statement’s restriction. However, ensure there are no typos in the action name (e.g., iam:ListRole instead of iam:ListRoles) or JSON syntax errors that might be causing the policy to be interpreted incorrectly.

内容的提问来源于stack exchange，提问作者Nikhil