Query IAM user tags

Part 86 of AWS from Zero. This lesson changes or inspects one IAM concept so the permission model stays understandable.

What we are learning

A compact tag query can drive scripts without downloading or parsing a larger IAM inventory.

Before you run it

aws sts get-caller-identity
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
USER_NAME="aws-zero-learner"
GROUP_NAME="aws-zero-readers"
ROLE_NAME="aws-zero-demo-role"

IAM is global rather than regional. Use a sandbox account and a delegated administrator identity, never root access keys.

The command

aws iam list-user-tags \
  --user-name "$USER_NAME"

IAM writes can take a short time to propagate. Inspect the resource after every change.

Inspect the result

aws iam list-user-tags \
  --user-name "$USER_NAME" \
  --query "Tags[?Key=='Owner'].Value | [0]" \
  --output text

The query returns one owner value or None when the tag is absent.

One tiny variation

aws iam list-user-tags \
  --user-name "$USER_NAME" \
  --query "sort_by(Tags, &Key)[].{Key:Key,Value:Value}" \
  --output table

Sort tags by key for a stable human review.

Common mistake

Do not assume every user has the same required tags. Treat missing values explicitly in automation.

Cleanup

# This lesson is read-only or reuses a named demo identity.
aws sts get-caller-identity

Keep shared demo identities only while following the IAM sequence. Part 125 removes them in dependency order.

Next, we will learn Create an IAM user group.

Official AWS CLI reference