Get inline policies that are embedded in the specified IAM group are return Empty (For Roles too)

[Fanch44step]

Describe the bug

Hello,

I have a Group in my account, I would list the policy attached on the group, but the list of policy is empty. I tested on the roles object, it's same.

Test:
Get-IAMGroup -GroupName myGroup -Credential $Creds
Return object:
Group IsTruncated Marker Users

---

Amazon.IdentityManagement.Model.Group False {}

I register a policy on the group "myGroup"
Register-IAMGroupPolicy -GroupName myGroup-PolicyArn arn:aws:iam::XXXXXXXXXXX:policy/MyPolicy Credential $Creds
DEBUG: Credentials obtained from supplied credentials object
DEBUG: Region obtained from shell variable $StoredAWSRegion with value 'eu-central-1'
VERBOSE: Invoking AWS Identity and Access Management operation 'AttachGroupPolicy' in region 'eu-central-1'

The policy is applys, I see in the console

Get-IAMGroupPolicyList -GroupName myGroup-Credential $Creds -Debug -Verbose
DEBUG: Credentials obtained from supplied credentials object
DEBUG: Region obtained from shell variable $StoredAWSRegion with value 'eu-central-1'
VERBOSE: Invoking AWS Identity and Access Management operation 'ListGroupPolicies' in region 'eu-central-1'

The return is empty:

Regards

Expected Behavior

I would like the list of policy attached on the group

Current Behavior

The return is empty

Reproduction Steps

New-IAMGroup -GroupName myGroup -Credential $Creds
Get-IAMGroup -GroupName myGroup -Credential $Creds
Register-IAMGroupPolicy -GroupName myGroup -PolicyArn arn:aws:iam::aws:policy/AdministratorAccess -Credential $Creds
Get-IAMGroupPolicyList -GroupName myGroup -Credential $Creds

Possible Solution

No response

Additional Information/Context

No response

AWS Tools for PowerShell version used

Cmdlet Get-IAMGroupPolicyList 4.1.491 AWSPowerShell.NetCore

PowerShell version used

Version 5.1

Operating System and version

Windows 10

[ashishdhingra]

@Fanch44step Good morning. Thanks for opening the issue. Get-IAMGroupPolicyList invokes the service API operation ListGroupPolicies which lists the names of the inline policies that are embedded in the specified IAM group. However, per details shared in the issue, you attached the IAM policy with specified ARN using Register-IAMGroupPolicy; in other words, you did not embed an inline policy.

To list attached policy, you should use Get-IAMAttachedGroupPolicyList CmdLet instead. I tested this at my end after created an IAM group named testgroup via AWS Console. The results are shown below:

PS> Get-IAMGroup -GroupName testgroup

Group                                 IsTruncated Marker Users
-----                                 ----------- ------ -----
Amazon.IdentityManagement.Model.Group False              {}

PS> Register-IAMGroupPolicy -GroupName testgroup -PolicyArn arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess -Debug
DEBUG: Credentials obtained from stored profile named 'default'
DEBUG: Region obtained from stored region with value 'us-east-2'

Confirm
Are you sure you want to perform this action?
Performing the operation "Register-IAMGroupPolicy (AttachGroupPolicy)" on target "testgroup".
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "Y"): 
VERBOSE: Invoking AWS Identity and Access Management operation 'AttachGroupPolicy' in region 'us-east-2'

Confirm
Continue with this operation?
[Y] Yes  [A] Yes to All  [H] Halt Command  [S] Suspend  [?] Help (default is "Y"): 

PS> Get-IAMAttachedGroupPolicyList -GroupName testgroup -Debug -Verbose
DEBUG: Credentials obtained from stored profile named 'default'
DEBUG: Region obtained from stored region with value 'us-east-2'
VERBOSE: Invoking AWS Identity and Access Management operation 'ListAttachedGroupPolicies' in region 'us-east-2'

PolicyArn                                      PolicyName
---------                                      ----------
arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess AmazonS3ReadOnlyAccess

Converting this issue into Q&A discussion since this is not a bug.

Thanks,
Ashish

[Fanch44step]

Hello,

Thank you very much for your feedback. I hadn't seen this subtlety of shared policies integrated into powershell commands.

King regards
Fanch

[github-actions[bot]]

Hello! Reopening this discussion to make it searchable.