Find role being used on server from AWS CLI

Question

I'm on an EC2 instance that has an IAM role attached to it, and would like to be able to verify that I am indeed using this role from the AWS CLI.

I'm imagining being able to call something like this (but can't find anything like it in the CLI docs):

$ aws get-current-role-details

Does this functionality exist?

Answer 1

See the AWS STS command get-caller-identity.

Returns details about the IAM identity whose credentials are used to call the API.

$ aws sts get-caller-identity
{
    "Account": "0123456789",
    "UserId": "AROAxxx:i-abc123",
    "Arn": "arn:aws:sts::0123456789:assumed-role/EMR_EC2_DefaultRole/i-abc123"
}

You can then take the role name, and query IAM for the role details.

$ aws iam list-attached-role-policies --role-name EMR_EC2_DefaultRole
{
    "AttachedPolicies": [
        {
            "PolicyName": "AmazonElasticMapReduceforEC2Role",
            "PolicyArn": "arn:aws:iam::aws:policy/service-role/AmazonElasticMapReduceforEC2Role"
        },
        {
            "PolicyName": "AmazonEC2RoleforDataPipelineRole",
            "PolicyArn": "arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforDataPipelineRole"
        }
    ]
}