Policy to Role listing. Given a CloudFormation in JSON that has ManagedPolicy objects connected to Roles, print a list of the policies and the roles that are attached.

policy-role.jq

def mapper(f):
  if type == "array" then map(f)
  elif type == "object" then
  . as $in
  | reduce keys[] as $key
      ({};
       [$in[$key] | f ] as $value
       | if $value | length == 0 then . else . + {($key): $value[0]}
         end)
  else .
  end;

.Resources |= mapper(select(.Type=="AWS::IAM::ManagedPolicy")) |
  .Resources |
    keys[] as $k |
    {"\(.[$k] | .Properties.Roles[]?.Ref?)":"\($k)"}

Example execution: jq -c -f policy-role.jq IAMPolicies.json

Example output:

{"AdminAccountManagementPolicy":"AccountAdminRole"}

{"AdminAccountManagementPolicy":"AccountAndBillingAdminRole"}

{"AdminBillingandCostManagementPolicy":"BillingAdminRole"}

{"AdminBillingandCostManagementPolicy":"AccountAndBillingAdminRole"}

{"BaselineDenyPolicy":"AWSReadOnlyRole"}

{"BaselineDenyPolicy":"AccountAndBillingAdminRole"}