Repository: cloud-custodian/cloud-custodian

Issue:
Add support for AWS Permissions Boundaries for IAM Identities
Hi,

Is there a way to use AWS IAM Boundaries with c7n polies?

https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_boundaries.html



Discussion:
afaics this would be parsing policies for permission boundary designators? what would a useful syntax for a policy be that uses this?
It would be great if we can filter on iam users or roles that (don't) have an iam boundary. Something like:
```
policies:
  - name: dont_allow_iam_users_without_iam_boundary
    resource: iam-user
    filters:
      - type: iam-boundary
        key: Arn
        op: not-equal
        value: arn:aws:iam:123456789012:policy/user-boundary
    actions:
      - delete
```
This should remove all users that don't have that policy as a IAM boundary.

Why can't the latest version of Custodian (boto3==1.9.31, botocore==1.12.31) not filter on the boundary property?
```
policies:
  - name: check_boundary
    description: |
       Verify that iam-boundary is set
    resource: iam-role
    filters:
      - type: value
        key: PermissionsBoundary.PermissionsBoundaryArn
        value: "arn:aws:iam::123456789012:policy/role-boundary"
```
With the same boto3 and botocore versions, this simple call will return the boundary:
```
import boto3

client = boto3.client('iam')
response = client.get_role(
    RoleName='Engineer'
)
print(response)
```
@kapilt can you provide some direction on this?
permission boundary via value filters should work ootb, assuming you have a recent enough sdk.
so permission boundaries weren't returned in list roles, they are returned in get-role. as part of addressing tag retrieval for roles, we switched to using get-role for role retrieval, so this should  work out of the box now for users. there's an upcoming change that does the same for roles.
Thanks for the reply! 

Resolving patch:
diff --git a/c7n/resources/iam.py b/c7n/resources/iam.py
--- a/c7n/resources/iam.py
+++ b/c7n/resources/iam.py
@@ -82,7 +82,7 @@ class resource_type(object):
         service = 'iam'
         type = 'role'
         enum_spec = ('list_roles', 'Roles', None)
-        detail_spec = None
+        detail_spec = ('get_role', 'RoleName', 'RoleName', 'Role')
         filter_name = None
         id = name = 'RoleName'
         date = 'CreateDate'
@@ -92,17 +92,6 @@ class resource_type(object):
         global_resource = True
         arn = 'Arn'
 
-    def get_resources(self, resource_ids, cache=True):
-        """For IAM Roles on events, resource ids are role names."""
-        resources = []
-        client = local_session(self.session_factory).client('iam')
-        for rid in resource_ids:
-            try:
-                resources.append(client.get_role(RoleName=rid)['Role'])
-            except client.exceptions.NoSuchEntityException:
-                continue
-        return resources
-
 
 @resources.register('iam-user')
 class User(QueryResourceManager):
@@ -121,24 +110,6 @@ class resource_type(object):
         global_resource = True
         arn = 'Arn'
 
-    def get_source(self, source_type):
-        if source_type == 'describe':
-            return DescribeUser(self)
-        return super(User, self).get_source(source_type)
-
-
-class DescribeUser(DescribeSource):
-
-    def get_resources(self, resource_ids, cache=True):
-        client = local_session(self.manager.session_factory).client('iam')
-        resources = []
-        for rid in resource_ids:
-            try:
-                resources.append(client.get_user(UserName=rid).get('User'))
-            except client.exceptions.NoSuchEntityException:
-                continue
-        return resources
-
 
 @User.action_registry.register('tag')
 class UserTag(Tag):
@@ -168,11 +139,7 @@ def process_resource_set(self, client, users, tags):
                 continue
 
 
-@User.action_registry.register('mark-for-op')
-class UserTagDelayedAction(TagDelayedAction):
-    pass
-
-
+User.action_registry.register('mark-for-op', TagDelayedAction)
 User.filter_registry.register('marked-for-op', TagActionFilter)
 
 


Test patch:
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.GetRole_1.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.GetRole_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_role_has_inline_policy/iam.GetRole_1.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "AmazonSageMaker-ExecutionRole-20180108T122369",
+            "Path": "/service-role/", 
+            "Arn": "arn:aws:iam::644160558196:role/service-role/AmazonSageMaker-ExecutionRole-20180108T122369"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.GetRole_2.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.GetRole_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_role_has_inline_policy/iam.GetRole_2.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "custodian-mu",
+            "Path": "/",
+            "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_1.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_1.json
--- a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_1.json
+++ b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_1.json
@@ -1,16 +1,18 @@
 {
     "status_code": 200, 
     "data": {
-        "PolicyNames": [], 
+        "PolicyNames": [
+            "oneClick_lambda_basic_execution_1466943062384"
+        ], 
         "IsTruncated": false, 
         "ResponseMetadata": {
             "RetryAttempts": 0, 
             "HTTPStatusCode": 200, 
-            "RequestId": "4811612a-872f-11e6-acfe-07a6295c8f0a", 
+            "RequestId": "4872bb33-872f-11e6-acfe-07a6295c8f0a", 
             "HTTPHeaders": {
-                "x-amzn-requestid": "4811612a-872f-11e6-acfe-07a6295c8f0a", 
+                "x-amzn-requestid": "4872bb33-872f-11e6-acfe-07a6295c8f0a", 
                 "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "323", 
+                "content-length": "410", 
                 "content-type": "text/xml"
             }
         }
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_3.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_3.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_3.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "4841e71f-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "4841e71f-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_4.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_4.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_4.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "485b89a9-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "485b89a9-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_5.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_5.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_5.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [
-            "oneClick_lambda_basic_execution_1466943062384"
-        ], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "4872bb33-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "4872bb33-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "410", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_6.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_6.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_6.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "488a88ff-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "488a88ff-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_7.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_7.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRolePolicies_7.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "48a16c6a-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "48a16c6a-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:43 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRoles_1.json b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRoles_1.json
--- a/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRoles_1.json
+++ b/tests/data/placebo/test_iam_role_has_inline_policy/iam.ListRoles_1.json
@@ -14,74 +14,6 @@
         }, 
         "IsTruncated": false, 
         "Roles": [
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJUQKESVQ5AAKMZYH4", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 12, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 38
-                }, 
-                "RoleName": "config-role-us-east-1", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-east-1"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIA6IINYISYTIWLA2S", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 6, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 39
-                }, 
-                "RoleName": "config-role-us-west-1", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-west-1"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIF4EPYR5G232FVL52", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 6, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 41
-                }, 
-                "RoleName": "config-role-us-west-2", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-west-2"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJQ7B35GGHTQXLQCNY", 
-                "CreateDate": {
-                    "hour": 12, 
-                    "__class__": "datetime", 
-                    "month": 8, 
-                    "second": 50, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 27, 
-                    "minute": 2
-                }, 
-                "RoleName": "custodian-mu", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
-            }, 
             {
                 "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
                 "RoleId": "AROAIDZBE5CMRCNENDQD2", 
@@ -115,24 +47,7 @@
                 "RoleName": "mandeep", 
                 "Path": "/", 
                 "Arn": "arn:aws:iam::644160558196:role/mandeep"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIYSSSIEWDYBRVPH2A", 
-                "CreateDate": {
-                    "hour": 18, 
-                    "__class__": "datetime", 
-                    "month": 9, 
-                    "second": 46, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 26, 
-                    "minute": 25
-                }, 
-                "RoleName": "root_joshua", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/root_joshua"
             }
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/tests/data/placebo/test_iam_role_has_specific_managed_policy/iam.ListRoles_1.json b/tests/data/placebo/test_iam_role_has_specific_managed_policy/iam.ListRoles_1.json
--- a/tests/data/placebo/test_iam_role_has_specific_managed_policy/iam.ListRoles_1.json
+++ b/tests/data/placebo/test_iam_role_has_specific_managed_policy/iam.ListRoles_1.json
@@ -14,74 +14,6 @@
         }, 
         "IsTruncated": false, 
         "Roles": [
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJUQKESVQ5AAKMZYH4", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 12, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 38
-                }, 
-                "RoleName": "config-role-us-east-1", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-east-1"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIA6IINYISYTIWLA2S", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 6, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 39
-                }, 
-                "RoleName": "config-role-us-west-1", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-west-1"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIF4EPYR5G232FVL52", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 6, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 41
-                }, 
-                "RoleName": "config-role-us-west-2", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-west-2"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJQ7B35GGHTQXLQCNY", 
-                "CreateDate": {
-                    "hour": 12, 
-                    "__class__": "datetime", 
-                    "month": 8, 
-                    "second": 50, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 27, 
-                    "minute": 2
-                }, 
-                "RoleName": "custodian-mu", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
-            }, 
             {
                 "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
                 "RoleId": "AROAIDZBE5CMRCNENDQD2", 
@@ -99,23 +31,6 @@
                 "Path": "/", 
                 "Arn": "arn:aws:iam::644160558196:role/lambda_basic_execution"
             }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJ4VMUPRSWMMW6EQIY", 
-                "CreateDate": {
-                    "hour": 1, 
-                    "__class__": "datetime", 
-                    "month": 9, 
-                    "second": 56, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 23, 
-                    "minute": 56
-                }, 
-                "RoleName": "mandeep", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/mandeep"
-            }, 
             {
                 "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
                 "RoleId": "AROAIYSSSIEWDYBRVPH2A", 
@@ -135,4 +50,4 @@
             }
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/tests/data/placebo/test_iam_role_inuse/iam.GetRole_1.json b/tests/data/placebo/test_iam_role_inuse/iam.GetRole_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_role_inuse/iam.GetRole_1.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "AmazonSageMaker-ExecutionRole-20180108T122369",
+            "Path": "/service-role/", 
+            "Arn": "arn:aws:iam::644160558196:role/service-role/AmazonSageMaker-ExecutionRole-20180108T122369"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_role_inuse/iam.GetRole_2.json b/tests/data/placebo/test_iam_role_inuse/iam.GetRole_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_role_inuse/iam.GetRole_2.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "custodian-mu",
+            "Path": "/",
+            "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_role_inuse/iam.ListRoles_1.json b/tests/data/placebo/test_iam_role_inuse/iam.ListRoles_1.json
--- a/tests/data/placebo/test_iam_role_inuse/iam.ListRoles_1.json
+++ b/tests/data/placebo/test_iam_role_inuse/iam.ListRoles_1.json
@@ -49,41 +49,7 @@
                 "RoleName": "custodian-mu",
                 "Path": "/",
                 "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
-            },
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D",
-                "RoleId": "AROAJVFVDALUIEJPNG236",
-                "CreateDate": {
-                    "hour": 14,
-                    "__class__": "datetime",
-                    "month": 12,
-                    "second": 2,
-                    "microsecond": 0,
-                    "year": 2016,
-                    "day": 19,
-                    "minute": 46
-                },
-                "RoleName": "ecsInstanceRole",
-                "Path": "/",
-                "Arn": "arn:aws:iam::644160558196:role/ecsInstanceRole"
-            },
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D",
-                "RoleId": "AROAIYSSSIEWDYBRVPH2A",
-                "CreateDate": {
-                    "hour": 18,
-                    "__class__": "datetime",
-                    "month": 9,
-                    "second": 46,
-                    "microsecond": 0,
-                    "year": 2016,
-                    "day": 26,
-                    "minute": 25
-                },
-                "RoleName": "root_joshua",
-                "Path": "/",
-                "Arn": "arn:aws:iam::644160558196:role/root_joshua"
             }
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_1.json b/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_1.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_1.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "4994cd9a-872f-11e6-9a3a-bf7b1425e59f", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "4994cd9a-872f-11e6-9a3a-bf7b1425e59f", 
-                "date": "Fri, 30 Sep 2016 16:59:44 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_2.json b/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_2.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_2.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "49add3f4-872f-11e6-9a3a-bf7b1425e59f", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "49add3f4-872f-11e6-9a3a-bf7b1425e59f", 
-                "date": "Fri, 30 Sep 2016 16:59:44 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_3.json b/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_3.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_3.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "49c6d953-872f-11e6-9a3a-bf7b1425e59f", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "49c6d953-872f-11e6-9a3a-bf7b1425e59f", 
-                "date": "Fri, 30 Sep 2016 16:59:44 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_4.json b/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_4.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_4.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "49def54d-872f-11e6-9a3a-bf7b1425e59f", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "49def54d-872f-11e6-9a3a-bf7b1425e59f", 
-                "date": "Fri, 30 Sep 2016 16:59:44 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_5.json b/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_5.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_5.json
+++ /dev/null
@@ -1,20 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [
-            "oneClick_lambda_basic_execution_1466943062384"
-        ], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "49f7ad8c-872f-11e6-9a3a-bf7b1425e59f", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "49f7ad8c-872f-11e6-9a3a-bf7b1425e59f", 
-                "date": "Fri, 30 Sep 2016 16:59:44 GMT", 
-                "content-length": "410", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_6.json b/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_6.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_6.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "4a119e4b-872f-11e6-9a3a-bf7b1425e59f", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "4a119e4b-872f-11e6-9a3a-bf7b1425e59f", 
-                "date": "Fri, 30 Sep 2016 16:59:45 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_7.json b/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_7.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRolePolicies_7.json
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "PolicyNames": [], 
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "4a2b67fc-872f-11e6-9a3a-bf7b1425e59f", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "4a2b67fc-872f-11e6-9a3a-bf7b1425e59f", 
-                "date": "Fri, 30 Sep 2016 16:59:45 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRoles_1.json b/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRoles_1.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_inline_policy/iam.ListRoles_1.json
+++ /dev/null
@@ -1,138 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "491d7a04-872f-11e6-a898-cf1ede838a3b", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "491d7a04-872f-11e6-a898-cf1ede838a3b", 
-                "date": "Fri, 30 Sep 2016 16:59:44 GMT", 
-                "content-length": "4194", 
-                "content-type": "text/xml"
-            }
-        }, 
-        "IsTruncated": false, 
-        "Roles": [
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJUQKESVQ5AAKMZYH4", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 12, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 38
-                }, 
-                "RoleName": "config-role-us-east-1", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-east-1"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIA6IINYISYTIWLA2S", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 6, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 39
-                }, 
-                "RoleName": "config-role-us-west-1", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-west-1"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIF4EPYR5G232FVL52", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 6, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 41
-                }, 
-                "RoleName": "config-role-us-west-2", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-west-2"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJQ7B35GGHTQXLQCNY", 
-                "CreateDate": {
-                    "hour": 12, 
-                    "__class__": "datetime", 
-                    "month": 8, 
-                    "second": 50, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 27, 
-                    "minute": 2
-                }, 
-                "RoleName": "custodian-mu", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIDZBE5CMRCNENDQD2", 
-                "CreateDate": {
-                    "hour": 12, 
-                    "__class__": "datetime", 
-                    "month": 6, 
-                    "second": 5, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 26, 
-                    "minute": 11
-                }, 
-                "RoleName": "lambda_basic_execution", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/lambda_basic_execution"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJ4VMUPRSWMMW6EQIY", 
-                "CreateDate": {
-                    "hour": 1, 
-                    "__class__": "datetime", 
-                    "month": 9, 
-                    "second": 56, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 23, 
-                    "minute": 56
-                }, 
-                "RoleName": "mandeep", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/mandeep"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIYSSSIEWDYBRVPH2A", 
-                "CreateDate": {
-                    "hour": 18, 
-                    "__class__": "datetime", 
-                    "month": 9, 
-                    "second": 46, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 26, 
-                    "minute": 25
-                }, 
-                "RoleName": "root_joshua", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/root_joshua"
-            }
-        ]
-    }
-}
\ No newline at end of file
diff --git a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.GetRole_1.json b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.GetRole_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.GetRole_1.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "AmazonSageMaker-ExecutionRole-20180108T122369",
+            "Path": "/service-role/", 
+            "Arn": "arn:aws:iam::644160558196:role/service-role/AmazonSageMaker-ExecutionRole-20180108T122369"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.GetRole_2.json b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.GetRole_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.GetRole_2.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "custodian-mu",
+            "Path": "/",
+            "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_3.json b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_3.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_3.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-	"AttachedPolicies": [
-        {
-            "PolicyName": "IAMFullAccess",
-            "PolicyArn": "arn:aws:iam::aws:policy/IAMFullAccess"
-        },
-        {
-            "PolicyName": "AdministratorAccess",
-            "PolicyArn": "arn:aws:iam::aws:policy/AdministratorAccess"
-        }
-    ],
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "4841e71f-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "4841e71f-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
diff --git a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_4.json b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_4.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_4.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-	"AttachedPolicies": [
-    ],
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "485b89a9-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "485b89a9-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
diff --git a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_5.json b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_5.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_5.json
+++ /dev/null
@@ -1,23 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-        "AttachedPolicies": [
-        {
-            "PolicyName": "Temp1",
-            "PolicyArn": "arn:aws:iam::aws:policy/Temp1"
-        }
-    ],
-	"IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "4872bb33-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "4872bb33-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "410", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
diff --git a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_6.json b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_6.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_6.json
+++ /dev/null
@@ -1,19 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-	"AttachedPolicies": [
-    ],
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "488a88ff-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "488a88ff-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:42 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
diff --git a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_7.json b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_7.json
deleted file mode 100644
--- a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListAttachedRolePolicies_7.json
+++ /dev/null
@@ -1,27 +0,0 @@
-{
-    "status_code": 200, 
-    "data": {
-	"AttachedPolicies": [
-        {
-            "PolicyName": "IAMReadOnly",
-            "PolicyArn": "arn:aws:iam::aws:policy/IAMReadOnly"
-        },
-        {
-            "PolicyName": "Poweruser",
-            "PolicyArn": "arn:aws:iam::aws:policy/Poweruser"
-        }
-    ],
-        "IsTruncated": false, 
-        "ResponseMetadata": {
-            "RetryAttempts": 0, 
-            "HTTPStatusCode": 200, 
-            "RequestId": "48a16c6a-872f-11e6-acfe-07a6295c8f0a", 
-            "HTTPHeaders": {
-                "x-amzn-requestid": "48a16c6a-872f-11e6-acfe-07a6295c8f0a", 
-                "date": "Fri, 30 Sep 2016 16:59:43 GMT", 
-                "content-length": "323", 
-                "content-type": "text/xml"
-            }
-        }
-    }
-}
diff --git a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListRoles_1.json b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListRoles_1.json
--- a/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListRoles_1.json
+++ b/tests/data/placebo/test_iam_role_no_specific_managed_policy/iam.ListRoles_1.json
@@ -31,57 +31,6 @@
                 "Path": "/service-role/", 
                 "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-east-1"
             }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIA6IINYISYTIWLA2S", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 6, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 39
-                }, 
-                "RoleName": "config-role-us-west-1", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-west-1"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Sid%22%3A%22%22%2C%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22config.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIF4EPYR5G232FVL52", 
-                "CreateDate": {
-                    "hour": 10, 
-                    "__class__": "datetime", 
-                    "month": 7, 
-                    "second": 6, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 24, 
-                    "minute": 41
-                }, 
-                "RoleName": "config-role-us-west-2", 
-                "Path": "/service-role/", 
-                "Arn": "arn:aws:iam::644160558196:role/service-role/config-role-us-west-2"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJQ7B35GGHTQXLQCNY", 
-                "CreateDate": {
-                    "hour": 12, 
-                    "__class__": "datetime", 
-                    "month": 8, 
-                    "second": 50, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 27, 
-                    "minute": 2
-                }, 
-                "RoleName": "custodian-mu", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
-            }, 
             {
                 "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22lambda.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
                 "RoleId": "AROAIDZBE5CMRCNENDQD2", 
@@ -98,41 +47,7 @@
                 "RoleName": "lambda_basic_execution", 
                 "Path": "/", 
                 "Arn": "arn:aws:iam::644160558196:role/lambda_basic_execution"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAJ4VMUPRSWMMW6EQIY", 
-                "CreateDate": {
-                    "hour": 1, 
-                    "__class__": "datetime", 
-                    "month": 9, 
-                    "second": 56, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 23, 
-                    "minute": 56
-                }, 
-                "RoleName": "mandeep", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/mandeep"
-            }, 
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
-                "RoleId": "AROAIYSSSIEWDYBRVPH2A", 
-                "CreateDate": {
-                    "hour": 18, 
-                    "__class__": "datetime", 
-                    "month": 9, 
-                    "second": 46, 
-                    "microsecond": 0, 
-                    "year": 2016, 
-                    "day": 26, 
-                    "minute": 25
-                }, 
-                "RoleName": "root_joshua", 
-                "Path": "/", 
-                "Arn": "arn:aws:iam::644160558196:role/root_joshua"
             }
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/tests/data/placebo/test_iam_role_unused/iam.GetRole_1.json b/tests/data/placebo/test_iam_role_unused/iam.GetRole_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_role_unused/iam.GetRole_1.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "AmazonSageMaker-ExecutionRole-20180108T122369",
+            "Path": "/service-role/", 
+            "Arn": "arn:aws:iam::644160558196:role/service-role/AmazonSageMaker-ExecutionRole-20180108T122369"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_role_unused/iam.GetRole_2.json b/tests/data/placebo/test_iam_role_unused/iam.GetRole_2.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_role_unused/iam.GetRole_2.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "custodian-mu",
+            "Path": "/",
+            "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_role_unused/iam.ListRoles_1.json b/tests/data/placebo/test_iam_role_unused/iam.ListRoles_1.json
--- a/tests/data/placebo/test_iam_role_unused/iam.ListRoles_1.json
+++ b/tests/data/placebo/test_iam_role_unused/iam.ListRoles_1.json
@@ -49,41 +49,7 @@
                 "RoleName": "custodian-mu",
                 "Path": "/",
                 "Arn": "arn:aws:iam::644160558196:role/custodian-mu"
-            },
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D",
-                "RoleId": "AROAJVFVDALUIEJPNG236",
-                "CreateDate": {
-                    "hour": 14,
-                    "__class__": "datetime",
-                    "month": 12,
-                    "second": 2,
-                    "microsecond": 0,
-                    "year": 2016,
-                    "day": 19,
-                    "minute": 46
-                },
-                "RoleName": "ecsInstanceRole",
-                "Path": "/",
-                "Arn": "arn:aws:iam::644160558196:role/ecsInstanceRole"
-            },
-            {
-                "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D",
-                "RoleId": "AROAIYSSSIEWDYBRVPH2A",
-                "CreateDate": {
-                    "hour": 18,
-                    "__class__": "datetime",
-                    "month": 9,
-                    "second": 46,
-                    "microsecond": 0,
-                    "year": 2016,
-                    "day": 26,
-                    "minute": 25
-                },
-                "RoleName": "root_joshua",
-                "Path": "/",
-                "Arn": "arn:aws:iam::644160558196:role/root_joshua"
             }
         ]
     }
-}
\ No newline at end of file
+}
diff --git a/tests/data/placebo/test_iam_set_policy_attached/iam.GetRole_1.json b/tests/data/placebo/test_iam_set_policy_attached/iam.GetRole_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_set_policy_attached/iam.GetRole_1.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "test-role-us-east-1", 
+            "Path": "/", 
+            "Arn": "arn:aws:iam::redacted:role/test-role-us-east-1"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_iam_set_policy_detached/iam.GetRole_1.json b/tests/data/placebo/test_iam_set_policy_detached/iam.GetRole_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_iam_set_policy_detached/iam.GetRole_1.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "test-role-us-east-1", 
+            "Path": "/", 
+            "Arn": "arn:aws:iam::redacted:role/test-role-us-east-1"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/data/placebo/test_security_hub_iam_role/iam.GetRole_1.json b/tests/data/placebo/test_security_hub_iam_role/iam.GetRole_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_security_hub_iam_role/iam.GetRole_1.json
@@ -0,0 +1,35 @@
+{
+    "status_code": 200, 
+    "data": {
+        "Role": {
+            "Description": "Allows EC2 instances to call AWS services on your behalf.", 
+            "AssumeRolePolicyDocument": "%7B%22Version%22%3A%222012-10-17%22%2C%22Statement%22%3A%5B%7B%22Effect%22%3A%22Allow%22%2C%22Principal%22%3A%7B%22Service%22%3A%22ec2.amazonaws.com%22%7D%2C%22Action%22%3A%22sts%3AAssumeRole%22%7D%5D%7D", 
+            "MaxSessionDuration": 3600, 
+            "RoleId": "AROAIGK7B2VUDZL4I73HK", 
+            "CreateDate": {
+                "hour": 13, 
+                "__class__": "datetime", 
+                "month": 5, 
+                "second": 59, 
+                "microsecond": 0, 
+                "year": 2018, 
+                "day": 24, 
+                "minute": 34
+            }, 
+            "RoleName": "app1",
+            "Path": "/",
+            "Arn": "arn:aws:iam::101010101111:role/app1"
+        }, 
+        "ResponseMetadata": {
+            "RetryAttempts": 0, 
+            "HTTPStatusCode": 200, 
+            "RequestId": "9223200c-7419-11e8-a393-b12b425088ff", 
+            "HTTPHeaders": {
+                "x-amzn-requestid": "9223200c-7419-11e8-a393-b12b425088ff", 
+                "date": "Tue, 19 Jun 2018 23:36:20 GMT", 
+                "content-length": "893", 
+                "content-type": "text/xml"
+            }
+        }
+    }
+}
diff --git a/tests/test_iam.py b/tests/test_iam.py
--- a/tests/test_iam.py
+++ b/tests/test_iam.py
@@ -281,7 +281,7 @@ def test_iam_role_inuse(self):
             session_factory=session_factory,
         )
         resources = p.run()
-        self.assertEqual(len(resources), 3)
+        self.assertEqual(len(resources), 1)
 
     def test_iam_role_unused(self):
         session_factory = self.replay_flight_data("test_iam_role_unused")
@@ -641,7 +641,7 @@ class IamManagedPolicyUsage(BaseTest):
 
     def test_iam_role_has_specific_managed_policy(self):
         session_factory = self.replay_flight_data(
-            "test_iam_role_has_specific_managed_policy"
+            "test_iam_role_no_specific_managed_policy"
         )
         self.patch(SpecificIamRoleManagedPolicy, "executor_factory", MainThreadExecutor)
         p = self.load_policy(
@@ -681,7 +681,7 @@ def test_iam_role_no_specific_managed_policy(self):
             session_factory=session_factory,
         )
         resources = p.run()
-        self.assertEqual(len(resources), 7)
+        self.assertEqual(len(resources), 2)
 
 
 class IamInlinePolicyUsage(BaseTest):
@@ -756,7 +756,7 @@ def test_iam_role_has_inline_policy(self):
             "oneClick_lambda_basic_execution_1466943062384")
 
     def test_iam_role_no_inline_policy(self):
-        session_factory = self.replay_flight_data("test_iam_role_no_inline_policy")
+        session_factory = self.replay_flight_data("test_iam_role_has_inline_policy")
         self.patch(IamRoleInlinePolicy, "executor_factory", MainThreadExecutor)
         p = self.load_policy(
             {
@@ -767,7 +767,7 @@ def test_iam_role_no_inline_policy(self):
             session_factory=session_factory,
         )
         resources = p.run()
-        self.assertEqual(len(resources), 6)
+        self.assertEqual(len(resources), 1)
         self.assertFalse(resources[0]["c7n:InlinePolicies"])
 
     def test_iam_group_has_inline_policy(self):