1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.
2. In the navigation pane, choose “Roles”. This will display a list of all the IAM roles that are currently configured within your AWS environment.
3. Click on each role to view its details. Under the “Permissions” tab, you can see the policies attached to the role. If there are any custom policies, they will be listed here.
4. To verify if the policy is custom or managed by AWS, click on the policy name. If it’s a custom policy, it will open in a new tab showing the policy document. AWS managed policies will not open in a new tab, instead, it will show the permissions summary.

1. First, you need to install and configure AWS CLI on your local machine. You can do this by following the instructions provided by AWS. Make sure you have the necessary permissions to access IAM roles and policies.
2. Once AWS CLI is set up, you can list all the IAM roles in your AWS account using the following command:
   aws iam list-roles
   
   This command will return a JSON object containing all the IAM roles in your AWS account.
3. To check if there are any custom role policies, you can use the following command for each role:
   aws iam list-role-policies --role-name {role-name}
   
   Replace {role-name} with the name of the IAM role you want to check. This command will return a list of all inline policies attached to the specified IAM role.
4. If the output of the above command is not empty, it means there are custom role policies present in IAM. You can further investigate these policies by using the following command:
   aws iam get-role-policy --role-name {role-name} --policy-name {policy-name}
   
   Replace {role-name} with the name of the IAM role and {policy-name} with the name of the policy you want to check. This command will return the policy document for the specified inline policy.

1. Install and configure AWS SDK for Python (Boto3): First, you need to install the AWS SDK for Python (Boto3) in your local environment. You can do this using pip:
   pip install boto3
   
   Then, configure your AWS credentials either by setting up environment variables or by using the AWS CLI. You can do this by running aws configure and then entering your AWS Access Key ID, Secret Access Key, Default region name, and Default output format when prompted.
2. Import necessary libraries and create an IAM client: In your Python script, you need to import the Boto3 library and create an IAM client. This client will allow you to interact with the AWS IAM service.
   import boto3
   
   # Create IAM client
   iam = boto3.client('iam')
   
3. List all IAM roles and check for custom role policies: You can use the list_roles method of the IAM client to get a list of all IAM roles in your AWS account. Then, for each role, you can use the list_role_policies method to get a list of all inline policies attached to that role. If any inline policies are found, it means that custom role policies are present.
   # List all IAM roles
   roles = iam.list_roles()
   for role in roles['Roles']:
       # List all inline policies for the current role
       inline_policies = iam.list_role_policies(RoleName=role['RoleName'])
       if inline_policies['PolicyNames']:
           print(f"Custom role policies found for role: {role['RoleName']}")
   
4. Analyze the output: Run the Python script and analyze the output. If any custom role policies are found, the script will print the name of the role. If no custom role policies are found, the script will not print anything. This way, you can easily detect if any IAM custom role policies are present in your AWS account.

1. Sign in to the AWS Management Console: Go to the AWS Management Console and sign in using your AWS account credentials.
2. Navigate to the IAM Service: Click on the “Services” dropdown in the top left corner of the console, and then select “IAM” under the Security, Identity, & Compliance section.
3. Identify Custom Role Policies: In the IAM console, click on the “Roles” option in the left-hand menu to view a list of IAM roles in your account.
4. Select the Role: Identify the IAM role that has custom policies attached to it. Click on the name of the role to view its details.
5. Remove Custom Policies: In the permissions tab of the IAM role details, you will see the list of policies attached to the role. Identify the custom policies that should not be present and click on the policy to select it.
6. Detach the Policy: Click on the “Detach Policy” button to remove the custom policy from the IAM role. Confirm the action when prompted.
7. Review and Save Changes: Review the updated permissions for the IAM role to ensure that only the necessary managed policies are attached. Click on the “Save Changes” button to apply the changes.
8. Verify Remediation: Once the custom role policies have been removed, verify that the IAM role now only has the necessary managed policies attached to it.

​

1. Identify the IAM roles with custom policies: Run the following AWS CLI command to list all IAM roles in your account along with their policies:
   aws iam list-roles
   
2. Review the policies attached to each IAM role: For each IAM role identified in the previous step, run the following AWS CLI command to list the policies attached to the role:
   aws iam list-role-policies --role-name <role-name>
   
3. Remove the custom policies attached to the IAM roles: For each IAM role that has custom policies attached, run the following AWS CLI command to detach the custom policy from the role:
   aws iam delete-role-policy --role-name <role-name> --policy-name <policy-name>
   
4. Verify the custom policies have been removed: Run the following AWS CLI command to verify that the custom policy has been successfully removed from the IAM role:
   aws iam list-role-policies --role-name <role-name>
   
5. Repeat the above steps for all IAM roles with custom policies attached to remediate the issue across all roles.

# Managed policy created from the former inline policy document
resource "aws_iam_policy" "EXISTING_INLINE_POLICY_AS_MANAGED" {
  name        = "NEW_MANAGED_POLICY_NAME" # replace with the desired managed policy name
  description = "Managed policy converted from inline policy INLINE_POLICY_NAME on role IAM_ROLE_NAME"

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      # Replace this block with the decoded JSON statements from the original inline policy
      # Example:
      # {
      #   "Effect": "Allow",
      #   "Action": ["s3:GetObject"],
      #   "Resource": ["arn:aws:s3:::EXAMPLE_BUCKET/*"]
      # }
    ]
  })
}

# Existing IAM role which previously had an inline policy
resource "aws_iam_role" "IAM_ROLE" {
  name = "IAM_ROLE_NAME" # replace with your existing role name

  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect = "Allow"
        Principal = {
          Service = "ec2.amazonaws.com"
        }
        Action = "sts:AssumeRole"
      }
    ]
  })

  # IMPORTANT: remove any aws_iam_role_policy resource blocks (inline policies)
  # that referenced this role and this policy document. Example to delete:
  #
  # resource "aws_iam_role_policy" "INLINE_POLICY" {
  #   role   = aws_iam_role.IAM_ROLE.id
  #   name   = "INLINE_POLICY_NAME"
  #   policy = <<POLICY
  #   ...
  #   POLICY
  # }
}

# Attach the new customer-managed policy to the role
resource "aws_iam_role_policy_attachment" "ROLE_MANAGED_POLICY_ATTACHMENT" {
  role       = aws_iam_role.IAM_ROLE.name
  policy_arn = aws_iam_policy.EXISTING_INLINE_POLICY_AS_MANAGED.arn
}

• + creation of aws_iam_policy.EXISTING_INLINE_POLICY_AS_MANAGED
• + creation of aws_iam_role_policy_attachment.ROLE_MANAGED_POLICY_ATTACHMENT
• - destruction of the old aws_iam_role_policy inline policy resource (no replacement of the aws_iam_role itself).