<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Identity Permissions — API Reference

## AWS IAM CLI

```bash
# Full authorization details
aws iam get-account-authorization-details --output json

# List users
aws iam list-users --output json

# List roles
aws iam list-roles --output json

# Get role policy
aws iam get-role-policy --role-name ROLE --policy-name POLICY

# List attached policies
aws iam list-attached-role-policies --role-name ROLE

# Simulate permissions
aws iam simulate-principal-policy --policy-source-arn ARN \
  --action-names ACTION1 ACTION2

# Credential report
aws iam generate-credential-report
aws iam get-credential-report --output json

# Access Analyzer
aws accessanalyzer list-findings --analyzer-arn ARN
aws accessanalyzer list-analyzers
```

## AWS IAM Key Fields

| Field | Description |
|-------|-------------|
| `Policies[].PolicyName` | Policy name |
| `Policies[].PolicyVersionList[].Document` | Policy JSON document |
| `Roles[].AssumeRolePolicyDocument` | Trust policy |
| `Users[].UserName` | IAM user name |
| `Users[].PasswordLastUsed` | Last console login |

## GCP IAM CLI

```bash
# Project IAM policy
gcloud projects get-iam-policy PROJECT_ID --format=json

# Service accounts
gcloud iam service-accounts list --format=json

# Service account keys
gcloud iam service-accounts keys list --iam-account=SA@PROJECT.iam.gserviceaccount.com

# IAM Policy Analyzer
gcloud asset analyze-iam-policy --organization=ORG_ID \
  --identity="user:admin@example.com"

# Recommender (unused permissions)
gcloud recommender recommendations list \
  --project=PROJECT_ID --location=global \
  --recommender=google.iam.policy.Recommender --format=json
```

## Kubernetes RBAC

```bash
# Cluster role bindings
kubectl get clusterrolebindings -o json

# Role bindings in namespace
kubectl get rolebindings -n NAMESPACE -o json

# Check permissions
kubectl auth can-i --list --as=system:serviceaccount:NS:SA

# Describe cluster role
kubectl describe clusterrole ROLE_NAME
```
