Add to Docker Desktop
Version 4.43 or later needs to be installed to add the server automatically
Tools
| Name | Description |
|---|---|
add_inline_policy | Add a new inline policy to an IAM role. This tool creates a new inline policy with the specified permissions and adds it to an IAM role. Inline policies are embedded within the role and cannot be attached to multiple roles. Commonly used for granting data processing services access to AWS resources, enabling Glue jobs to access data sources, and configuring permissions for CloudWatch logging and S3 access. ## Requirements - The server must be run with the `--allow-write` flag - The role must exist in your AWS account - The policy name must be unique within the role - You cannot modify existing policies with this tool ## Permission Format The permissions parameter can be either a single policy statement or a list of statements. ### Single Statement Example ```json { "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject"], "Resource": "arn:aws:s3:::example-bucket/*" } ``` ## Common Data Processing Permission Examples ### Glue Job Permissions ```json { "Effect": "Allow", "Action": [ "glue:*", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucket", "iam:PassRole" ], "Resource": "*" } ``` ### EMR Cluster Permissions ```json { "Effect": "Allow", "Action": [ "elasticmapreduce:*", "ec2:DescribeInstances", "ec2:DescribeSecurityGroups", "s3:ListBucket", "s3:GetObject", "s3:PutObject" ], "Resource": "*" } ``` ### Athena Query Permissions ```json { "Effect": "Allow", "Action": [ "athena:*", "glue:GetDatabase", "glue:GetTable", "glue:GetPartition", "s3:GetObject", "s3:ListBucket", "s3:PutObject" ], "Resource": "*" } ``` ## Usage Tips - Follow the principle of least privilege by granting only necessary permissions - Use specific resources rather than "*" whenever possible - Consider using conditions to further restrict permissions - Group related permissions into logical policies with descriptive names |
get_policies_for_role | Get all policies attached to an IAM role. This tool retrieves all policies associated with an IAM role, providing a comprehensive view of the role's permissions and trust relationships. It helps you understand the current permissions, identify missing or excessive permissions, troubleshoot data processing issues, and verify trust relationships for service roles. ## Requirements - The role must exist in your AWS account - Valid AWS credentials with permissions to read IAM role information ## Response Information The response includes role ARN, assume role policy document (trust relationships), role description, managed policies with their documents, and inline policies with their documents. ## Usage Tips - Use this tool before adding new permissions to understand existing access - Check the assume role policy to verify which services or roles can assume this role - Look for overly permissive policies that might pose security risks - Use with add_inline_policy to implement least-privilege permissions - For Glue jobs, ensure the role has access to required data sources and targets - For EMR clusters, verify EC2 instance profile permissions - For Athena queries, check S3 bucket access permissions |