[AWS CLI] Documentation Feedback - precise permissions required for granting access to the CLI

[MaximilianKohler]

Describe the issue

We recently received feedback from you about the following page in the AWS Command Line Interface documentation:

https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-getting-started.html

Thanks for reaching out!

I think this is the specific section you were referring to: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-prereqs.html#getting-started-prereqs-keys

For more specific information on using IAM roles with the AWS CLI, you can refer to this documentation: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-role.html. That documentation describes how you can configure profiles to use with the AWS CLI that have the permissions you require.

I hope this helps! We are unable to provide further assistance through email. If you still require assistance, please request support by opening an issue on the AWS CLI GitHub repository:

https://github.com/aws/aws-cli/issues/new/choose

Thanks for taking the time to send your feedback.

Sincerely,

My response:

That documentation describes how you can configure profiles to use with the AWS CLI that have the permissions you require

The issue is that it doesn't tell us what permissions "we require" to use the CLI.

I'm trying to grant a user (myself) access to the CLI. Nowhere does it say what permissions I need to select to do that. So I just selected full, permanent admin permissions, which (in many places) it tells me is not ideal.

Links

https://docs.aws.amazon.com/cli/latest/userguide/getting-started-prereqs.html#getting-started-prereqs-keys

[tim-finnigan]

Hi @MaximilianKohler thanks for following up here. The AWS CLI itself does not require permissions to access, but you would need certain IAM permissions in order to run most CLI commands. You can assign IAM permissions to a user, role, or group in order to run which CLI commands are necessary.

This description of identities in the IAM User Guide may be helpful. And in the CLI command reference there are many services documented that each have several commands available. Per the IAM User Guide, it is recommended to apply least-privilege permissions so that you grant only the permissions required to perform a task.

I hope that helps. Please let us know if you had any further questions or wanted to share any more information regarding your use case.

[MaximilianKohler]

None of that means much to me. It would take someone a really long time to learn all of that. I was just trying to run a simple command aws sesv2 list-suppressed-destinations. People shouldn't be expected to spend an hour reading about AWS permissions, and IAM and CLI user guides just to run a basic command like that.

Worst of all is we shouldn't even be having to run the command at all, but there's no CSV download option for the SES suppression list https://us-west-1.console.aws.amazon.com/ses/home?region=us-west-1#/suppression-list. I did use the "send feedback" on that page as well regarding the CSV download.

[tim-finnigan]

Hi @MaximilianKohler thanks for your feedback. Here is the CLI documentation for that specific command: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/sesv2/list-suppressed-destinations.html

If you tried running that command without the required permissions you would receive this error:

An error occurred (AccessDeniedException) when calling the ListSuppressedDestinations operation: User: arn:aws:iam::************** is not authorized to perform: ses:ListSuppressedDestinations on resource: * because no identity-based policy allows the ses:ListSuppressedDestinations action

So based on that error message the ses:ListSuppressedDestinations permission is required to run that command.

I hope that helps, please let us know if you had any further questions. For feedback related to particular documentation pages we do recommend continuing to use the send feedback buttons so that your comments get directed to the appropriate team. You can also consider reaching our through AWS Support for escalation of issues. Since this issue involves a general guidance question, I'm going to convert it into a GitHub discussion per our triage process.