Edit IAM policies (Amazon CLI)
A policy is an entity that, when attached to an identity or resource, defines their permissions. You can use the Amazon Command Line Interface (Amazon CLI) to edit customer managed policies and inline policies in IAM. Amazon managed policies cannot be edited. The number and size of IAM resources in an Amazon account are limited. For more information, see IAM and Amazon STS quotas.
For more information about policy structure and syntax, see Policies and permissions in Amazon Identity and Access Management and the IAM JSON policy element reference.
Prerequisites
Before you change the permissions for a policy, you should review its recent service-level activity. This is important because you don't want to remove access from a principal (person or application) who is using it. For more information about viewing last accessed information, see Refine permissions in Amazon using last accessed information.
Editing customer managed policies (Amazon CLI)
You can edit a customer managed policy from the Amazon CLI.
Note
A managed policy can have up to five versions. If you need to make changes to a customer managed policy beyond five versions, you must first delete one or more existing versions.
To edit a customer managed policy (Amazon CLI)
-
(Optional) To view information about a policy, run the following commands:
-
To list managed policies: list-policies
-
To retrieve detailed information about a managed policy: get-policy
-
-
(Optional) To find out about the relationships between the policies and identities, run the following commands:
-
To list the identities (IAM users, IAM groups, and IAM roles) to which a managed policy is attached:
-
To list the managed policies attached to an identity (a user, user group, or role):
-
-
To edit a customer managed policy, run the following command:
-
(Optional) To validate a customer managed policy, run the following IAM Access Analyzer command:
Setting the default version of a customer managed policy (Amazon CLI)
You can set a default version of a customer managed policy from the Amazon CLI.
To set the default version of a customer managed policy (Amazon CLI)
-
(Optional) To list managed policies, run the following command:
-
To set the default version of a customer managed policy, run the following command:
Deleting a version of a customer managed policy (Amazon CLI)
You can delete a version of a customer managed policy from the Amazon CLI.
To delete a version of a customer managed policy (Amazon CLI)
-
(Optional) To list managed policies, run the following command:
-
To delete a customer managed policy, run the following command:
Editing inline policies (Amazon CLI)
You can edit an inline policy from the Amazon CLI.
To edit an inline policy (Amazon CLI)
-
(Optional) To view information about a policy, run the following commands:
-
To list inline policies associated to an identity (a user, user group, or role):
-
To retrieve detailed information about a inline policy:
-
-
To edit an inline policy, run the following command:
-
(Optional) To validate an inline policy, run the following IAM Access Analyzer command: