AWS iam:ListRolePolicies permissions error on all IAM service

Question

I have a problem. I'm using an AWS educate account, and when I try to follow tutorials (Lambda one in this case), I can't create/modify roles.

So, I go in the IAM dedicated page, and in this page, i can't create, edit or delete Users / roles / Groups etc..

When I create a role, this role is always as default and I can't modify it.

It's always about : iam:ListRolePolicies

Exemples :

Try to delete a Kinesis Role = User: arn:aws:sts::11111111:federated-user/myID is not authorized to perform: iam:ListRolePolicies on resource: role Kinesis-Data-Generator-Cog-UnauthenticatedUserRole-1T1HLD2QUMZ8T

Trying to modify the lambda role I just created = User: arn:aws:sts::11111111:federated-user/myID is not authorized to perform: iam:ListRolePolicies on resource: role lambda_dynamodb_execution

Is this a bug ? Can you help me ? Thanks in advance !

It doesn't sound like a bug... it sounds like you are simply lacking a permission that you need. — Michael - sqlbot
Oh.. I tried to contact AWS and I am waiting for an answer. It's quite akward, my account should look like any other educate account no? If I can't follow officials AWS educate tutorial there must be an error somewhere. If you had any informations I'll take it. — ThisIsJuke

ThisIsJuke ThisIsJuke · Accepted Answer · 2018-05-11T14:50:45

So, I have the answer from AWS, that say :

Hello,

I apologize for the trouble you've had while attempting to use these services. The IAM service is unavailable to Educate Starter Accounts which is why you're running into these issues.

If you don't believe the Starter account will meet your needs, we can convert your AWS Educate benefits to the other option - credit for a normal AWS account. In order to take advantage of this option, you will need your own AWS account, which requires phone verification and a valid credit card to activate. If you have not already done so, you can visit https://aws.amazon.com to create a normal AWS account.

Once you have an active AWS account, you can request conversion of your AWS Educate benefits by logging in to your AWS account and creating a case from the Support Center at the URL below.

So it seems normal that you can't do the educate tutorials with an educate account.. That quite strange..

Tutorial exemple :

In the Create function window, configure the following:
- Name: Create-Thumbnail
- Runtime: Python 3.6
- Existing role: lambda-execution-role

All IAM roles have :

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:*:*:*"
    }
  ]
}

Hope this will be usefull for someone else.

AWS iam:ListRolePolicies permissions error on all IAM service

1 Answers