How to get login user's IAM role info using boto3?

Question

For ex: when I login to my AWS account, federated login appears as myrole/usr1. user user1 is not an IAM user. Tried to get the identity using client.get_caller_identity() using sts module.

when ran in lambda, it was giving the role assigned to lambda rather than actual role am looking for. How to get role info myrole?

Answer 1

Here's the way to get role name from the code in general:

import boto3
s = boto3.Session(profile_name="some_profile_name")
c = s.client("sts")
c.get_caller_identity()

You will get response along the lines of {'UserId': '...', 'Account': '...', 'Arn': 'arn:aws:sts::...:assumed-role/.../federated_username_here', ...}

However this implies you have configured AWS CLI profile with name some_profile_name, and to do that you need to set up federated access via CLI or know the name of the role, which is as far as I understand you want to get. Chicken and egg problem.

Same goes for attempts to get it using AWS code environment, lambda will display its role, ec2 the same way.

So to see it from console you can try to go to page https://console.aws.amazon.com/billing/home?#/account, and given you have permissions to see that page, your assumed role will be listed as Account Name.