> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kubox.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# kubox admin aws diff

Compare what a role is allowed today against the document that describes it

### Synopsis

Reads every inline and attached policy on a role, merges them, and compares
the result with the rendered document.

Two questions at once. Replacing a policy that worked with one derived from
reading the source loses whatever the source does not mention -- calls a
library makes on your behalf appear nowhere in your code, and the policy you
are replacing is the only record that they were ever needed. And a role that
has drifted from its document, because somebody attached a grant by hand to
unblock a build, looks exactly like one that has not.

Actions are compared with their conditions, not alone: an action present in
both can still have been narrowed, and a narrowing denies cases the old
policy served.

```
kubox admin aws diff [flags]
```

### Options

```
      --allow-region stringArray   a region these identities may act in; repeatable (default: --region alone)
      --artifact-key string        KMS key ARN protecting sealed artifacts; the runner writes it, the unsealer reads it
      --ci-role string             GitHub OIDC role that builds the plane's own cluster on day zero (trust policy only)
      --external-id string         binds a target-account role to one tenant (trust policy only)
  -h, --help                       help for diff
      --hosted-zone string         Route53 zone the build may publish records in
      --identity string            which identity's document to compare
      --operator stringArray       ARN of a user or role that may assume the build role directly, for a laptop build; repeatable (trust policy only)
      --plane-account string       AWS account the management plane runs in
      --region string              primary region, substituted into resource ARNs
      --role-name string           the role to read (default: the identity's own role name)
      --stack-key string           KMS key ARN protecting the Pulumi checkpoint; the build both writes and reads it
      --state-backend string       Pulumi state backend, e.g. s3://bucket/prefix
      --target-account string      AWS account a cluster is built into (default: the plane's own)
      --tenant stringArray         a tenant the artifact roles seal for: the cloud connection's namespace (kubox-system for Kubox's own account); repeatable, and required for the tenant artifact identities
      --workload-issuer string     the identity plane's issuer, e.g. https://oidc-exp.kubox.cloud; required
```

### Global options

See [global options](/cli-reference/kubox#global-options).

### SEE ALSO

* [kubox admin aws](/cli-reference/kubox_admin_aws)	 - Render and verify the IAM policies a Kubox deployment needs