iam: include policy in role show output

[natalie-o-perret]

Description

Show an IAM role policy alongside the normal role details. The policy is rendered as a separate table with a Policy: heading. Keep --policy as the existing policy-only output for scripts.

JSON output includes the policy under policy.

Checklist

(For exoscale contributors)

• Changelog updated (under Unreleased block, and add the Pull Request #number for each bit you add to the CHANGELOG.md)
• Testing

Testing

Live before/after check using a temporary role with a denied service and three policy rules. The role was deleted after capturing the output.

Before, using the installed binary:

$ exo iam role show cli-pr-903-policy-output-test
| ID          | <role-id>                            |
| Name        | cli-pr-903-policy-output-test        |
| Description | Temporary CLI PR 903 output test     |
| Editable    | true                                 |
| Labels      | purpose:cli-pr-903                   |
| Permissions | n/a                                  |

After, using the patched binary:

$ ./bin/exo iam role show cli-pr-903-policy-output-test
| ID          | <role-id>                            |
| Name        | cli-pr-903-policy-output-test        |
| Description | Temporary CLI PR 903 output test     |
| Editable    | true                                 |
| Labels      | purpose:cli-pr-903                   |
| Permissions | n/a                                  |

Policy:
| SERVICE | TYPE (DEFAULT STRATEGY "ALLOW") | RULE ACTION |                     RULE EXPRESSION                     |
|---------|---------------------------------|-------------|---------------------------------------------------------|
| sos     | rules                           | allow       | operation in ['list-sos-buckets-usage', 'list-buckets'] |
|         |                                 | deny        | !(resources.bucket in ['my-bucket', 'my-other-bucket']) |
|         |                                 | deny        | operation in ['list-objects', 'get-object']             |
| cdn     | deny                            |             |                                                         |

A live read-only check against the existing DBaaS role confirms the final blank-line and heading layout.

JSON output contains the complete policy under policy. --policy continues to print only the policy table.

A focused fake API test covers the reported deny-by-default policy with compute and networking allowed. go test ./cmd/iam passes.

The full make test-verbose suite passes. make build succeeds. golangci-lint run --timeout 4m reports 0 issues.

---

Note

AI assistance: PR description, test scaffolding.

[natalie-o-perret]

[SC-196302]

[kobajagi]

Can you add example of the output table with full featured policy?

[natalie-o-perret]

Can you add example of the output table with full featured policy?

Updated the PR description accordingly with output from a live full-featured policy, including allow and deny rules with expressions.

[kobajagi]

Thanks @natalie-o-perret . IMO it feels cluttered, rule expression can also be very long which will extend policy table even more. Probably why policy was factored out in the first place.

[natalie-o-perret]

IMO it feels cluttered, rule expression can also be very long which will extend policy table even more. Probably why policy was factored out in the first place.

Yea, agreed. I updated the PR to keep the default table unchanged and include the nested policy only in JSON output. --policy remains the opt-in full policy table.