Identity and Access Management (IAM) | Update Entity or Policy (Review Required)

To check the change type version, use this command:

aws amscm list-change-type-version-summaries --filter Attribute=ChangeTypeId,Value=CT_ID

INLINE CREATE:

Issue the create RFC command with execution parameters provided inline (escape quotes when providing execution parameters inline), and then submit the returned RFC ID. For example, you can replace the contents with something like this:

aws amscm create-rfc --change-type-id "ct-27tuth19k52b4" --change-type-version "1.0" --title "TestIamUpdate" --execution-parameters "{\"UseCase\":\"IAM_RESOURCE_DETAILS\",\"IAM Role\":[{\"RoleName\":\"ROLE_NAME\",\"TrustPolicy\":\"TRUST_POLICY\",\"RolePermissions\":\"ROLE_PERMISSIONS\"}],\"Operation\":\"Update\"}"

TEMPLATE CREATE:

1. Output the execution parameters JSON schema for this change type to a file; this example names it UpdateIamResourceParams.json:

   aws amscm get-change-type-version --change-type-id "ct-27tuth19k52b4" --query "ChangeTypeVersion.ExecutionInputSchema" --output text > UpdateIamResourceParams.json

2. Modify and save the UpdateIamResourceParams file. For example, you can replace the contents with something like this:

   {
     "UseCase": "IAM_RESOURCE_DETAILS",
     "IAM Role": [
       {
         "RoleName": "codebuild_ec2_test_role",
         "TrustPolicy": {
           "Version": "2008-10-17",
           "Statement": [
             {
               "Effect": "Allow",
               "Principal": {
                 "Service": "codebuild.amazonaws.com"
               },
               "Action": "sts:AssumeRole"
             }
           ]
         },
         "RolePermissions": {
           "Version": "2012-10-17",
           "Statement": [
             {
               "Effect": "Allow",
               "Action": [
                 "ec2:DescribeInstanceStatus"
               ],
               "Resource": "*"
             }
           ]
         }
       }
     ],
     "Operation": "Update"
   }

3. Output the RFC template JSON file to a file; this example names it UpdateIamResourceRfc.json:

   aws amscm create-rfc --generate-cli-skeleton > UpdateIamResourceRfc.json

4. Modify and save the UpdateIamResourceRfc.json file. For example, you can replace the contents with something like this:

   {
   "ChangeTypeVersion": "1.0",
   "ChangeTypeId": "ct-27tuth19k52b4",
   "Title": "Update IAM Roles"
   }

5. Create the RFC, specifying the UpdateIamResourceRfc file and the UpdateIamResourceParams file:

   aws amscm create-rfc --cli-input-json file://UpdateIamResourceRfc.json  --execution-parameters file://UpdateIamResourceParams.json

   You receive the ID of the new RFC in the response and can use it to submit and monitor the RFC. Until you submit it, the RFC remains in the editing state and does not start.