Python script to discover which roles you can assume in an AWS account

discover_assumable_roles.py

import boto3
import botocore

stsc = boto3.client('sts')
iamc = boto3.client('iam')
iamr = boto3.resource('iam')
iam_paginator = iamc.get_paginator('list_roles')
iam_page_iterator = iam_paginator.paginate()

iam_user_arn = 'arn:aws:iam::369786485381:user/ameriwether' # iam_user.arn

for page in iam_page_iterator:
    roles = page['Roles']
    for role in roles:
        role_arn = role['Arn']
        try:
            resp = stsc.assume_role(
                RoleArn=role_arn,
                RoleSessionName=('test-' + role['RoleName']),
                DurationSeconds=900,
            )
            print(' IS ALLOWED: '+role['RoleName'])
        except botocore.exceptions.ClientError:
            print('not allowed '+role['RoleName'])

Will only work if your user has the ListRoles permission in the first place. Tries to assume all the roles, and tells you which ones worked. Uses your existing credentials from ~/.aws/credentials or the current-machine identity in EC2 if there is no ~/.aws/credentials file.