# Full snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intent

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/iam-account-authorization-details

Recipe id: `iam-account-authorization-details` · cadence quarterly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-ELP`
- KSI `KSI-IAM-AAM`
- control `ac-2`
- control `ac-3`
- control `ac-6.1`

## Collection

Kind: `cli`

```sh
# user-details
aws iam get-account-authorization-details --query 'UserDetailList[].{User:UserName,Groups:GroupList,Attached:AttachedManagedPolicies[].PolicyName,Inline:UserPolicyList[].PolicyName}'
# role-details
aws iam get-account-authorization-details --filter Role --query 'RoleDetailList[].{Role:RoleName,Trust:AssumeRolePolicyDocument,Attached:AttachedManagedPolicies[].PolicyName}'
```

## Expected output

JSON with UserDetailList, GroupDetailList, RoleDetailList, and Policies arrays; embedded policy documents are URL-encoded (RFC 3986) and must be decoded before diffing against approved baselines

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

identical API; policy ARNs and principal ARNs use partition arn:aws-us-gov

## Notes

The API fully enumerates entitlements (telemetry), but deciding whether a given permission set is 'least privilege' requires human judgement against a documented access baseline. Reviewers should diff this snapshot against the last approved baseline and justify deltas.

## References

- {"title":"AWS CLI: iam get-account-authorization-details (UserDetailList / GroupDetailList / RoleDetailList / Policies)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/get-account-authorization-details.html"}
- {"title":"Managed policies and inline policies — why an inline-policy review is a separate pass","url":"https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html"}