How to list all IAM users in a multi-environment organization from a single server


I have created a role and attached it to my EC2 instance to allow the ability to access the IAM users in an environment for reporting purposes. I went this route to prevent the need for storing any AWS credentials in a credential file. Does anyone know if it is possible for the single EC2 host to read all IAM users for multiple environments? We have several environments (prod, dev, security, auditing, etc...), and my goal is to generate a report on all IAM users for all our environments from the single host.

Any information is much appreciated!

2 Antworten
Akzeptierte Antwort

If you are operating multiple accounts in an AWS Organization I'd suggest using Config for this because you can easily query Config to see many different types of resources across all account. The resources you can access are listed here and IAM Users are in that list.

That said, you can also do this by running some code. The example below iterates through all accounts in an Organization but you could also pass in a list of account ids instead. I originally wrote this to get a list of VPCs and IP address ranges in each VPC but it is not difficult to modify it to query IAM Users instead.

import boto3
import sys

crossAccountRoleName = 'NetworkRole'
org = boto3.client('organizations')
sts = boto3.client('sts')

def processAccount(ec2, credentials):
    identity = sts.get_caller_identity()

    regionList = ec2.describe_regions()['Regions']
    for region in regionList:
        if credentials:
            ec2Region = boto3.client('ec2',
            ec2Region = boto3.client('ec2')

        vpcList = ec2Region.describe_vpcs().get('Vpcs', [])
        for vpc in vpcList:

    orgDetails = org.describe_organization()
    ec2 = boto3.client('ec2')
    processAccount(ec2, None)

accountPaginator = org.get_paginator('list_accounts')
accountIterator = accountPaginator.paginate()
for object in accountIterator:
    for account in object['Accounts']:
        if account['Id'] == orgDetails['Organization']['MasterAccountId']:
            ec2 = boto3.client('ec2')
            processAccount(ec2, None)
            targetRoleArn = f'arn:aws:iam::{account["Id"]}:role/{crossAccountRoleName}'
                credentials = sts.assume_role(RoleArn=targetRoleArn,
            except Exception as e:
                print(f'STS assume_role failed: {e} for account {account["Id"]}')

            ec2 = boto3.client('ec2',

            processAccount(ec2, Credentials)
profile pictureAWS
beantwortet vor 10 Monaten

You would need to create cross account roles and then assume the role in each account and query the list of users.

However, what you should be doing is to have all users in one AWS account and manage users from here. This way your problem wouldn’t exist. Users would just assume roles in said accounts.

profile picture
beantwortet vor 10 Monaten

Du bist nicht angemeldet. Anmelden um eine Antwort zu veröffentlichen.

Eine gute Antwort beantwortet die Frage klar, gibt konstruktives Feedback und fördert die berufliche Weiterentwicklung des Fragenstellers.

Richtlinien für die Beantwortung von Fragen