Search code examples
amazon-web-servicesaws-lambdacredentialsaws-secrets-managercredential-manager

How to know if my AWS role has IAMFullAccess?


I'm currently working on a task to configure credential rotation in AWS Secret Manager, I did some reading, from my understanding, the best practice is to use the feature on Secret Manager Console 'enable the rotation', then SM will create a Lambda function and perform the rotation on a schedule that we defined (e.g. rotate every 30 days etc), but it seems like it requires IAMFullAccess role to configure this, my question is how can I check if my current AWS account has the full access or does it mean I must use root account to configure this? Many thanks.


Solution

  • No, you don't need root access to configure Secrets Manager key rotation. As a general rule, you should disable root access once you've set up appropriate IAM users. There are very few tasks that actually require root access.

    To check your IAM policies, go to the IAM Console and list the policies attached to you (if you are an IAM user and/or in an IAM group) or to the IAM role that you assumed (if you are a federated/SSO user). If you can't access these IAM resources then you don't have full IAM access.

    Note that you don't necessarily need to have the managed policy named IAMFullAccess, though that's commonly a way used to give you the relevant IAM permissions. You essentially need the permissions that that managed policy gives you (which is iam:* on all resources).