List IAM managed policy versions

Part 101 of AWS from Zero. This lesson changes or inspects one IAM concept so the permission model stays understandable.

What we are learning

Policy versions preserve previous documents for controlled rollback, but only one version is the default.

Before you run it

POLICY_ARN="arn:aws:iam::123456789012:policy/AwsZeroListBuckets"

Use the customer managed policy ARN.

The command

aws iam list-policy-versions \
  --policy-arn "$POLICY_ARN"

IAM writes can take a short time to propagate. Inspect the resource after every change.

Inspect the result

aws iam list-policy-versions \
  --policy-arn "$POLICY_ARN" \
  --query "sort_by(Versions, &CreateDate)[].{ID:VersionId,Default:IsDefaultVersion,Created:CreateDate}" \
  --output table

Read the returned ARN, path, IDs, and attachment state instead of checking only the command exit code.

One tiny variation

aws iam list-policy-versions \
  --policy-arn "$POLICY_ARN" \
  --query "Versions[?IsDefaultVersion==`false`].VersionId" \
  --output text

Return candidate non-default IDs for a reviewed cleanup step.

Common mistake

Version IDs are not simple revision numbers for permission strength. Read each document before selecting or deleting it.

Cleanup

# This lesson is read-only or reuses a named demo identity.
aws sts get-caller-identity

Keep shared demo identities only while following the IAM sequence. Part 125 removes them in dependency order.

Next, we will learn Delete an old IAM policy version.

Official AWS CLI reference