iam: include policy in role show output

[natalie-o-perret]

Description

Show an IAM role policy alongside the normal role details. Keep --policy as the existing policy-only output for scripts.

Table output now prints the policy table after the role metadata. JSON output includes it under policy.

Checklist

(For exoscale contributors)

• Changelog updated (under Unreleased block, and add the Pull Request #number for each bit you add to the CHANGELOG.md)
• Testing

Testing

Live before/after check using a temporary role with a denied service and three policy rules. The role was deleted after capturing the output.

Before, using the installed binary:

$ exo iam role show cli-pr-903-policy-output-test
| ID          | <role-id>                            |
| Name        | cli-pr-903-policy-output-test        |
| Description | Temporary CLI PR 903 output test     |
| Editable    | true                                 |
| Labels      | purpose:cli-pr-903                   |
| Permissions | n/a                                  |

After, using the patched binary:

$ ./bin/exo iam role show cli-pr-903-policy-output-test
| ID          | <role-id>                            |
| Name        | cli-pr-903-policy-output-test        |
| Description | Temporary CLI PR 903 output test     |
| Editable    | true                                 |
| Labels      | purpose:cli-pr-903                   |
| Permissions | n/a                                  |
| SERVICE | TYPE (DEFAULT STRATEGY "ALLOW") | RULE ACTION |                     RULE EXPRESSION                     |
|---------|---------------------------------|-------------|---------------------------------------------------------|
| sos     | rules                           | allow       | operation in ['list-sos-buckets-usage', 'list-buckets'] |
|         |                                 | deny        | !(resources.bucket in ['my-bucket', 'my-other-bucket']) |
|         |                                 | deny        | operation in ['list-objects', 'get-object']             |
| cdn     | deny                            |             |                                                         |

JSON output contains the same complete policy:

$ ./bin/exo iam role show cli-pr-903-policy-output-test --output-format json
{"id":"<role-id>","name":"cli-pr-903-policy-output-test","description":"Temporary CLI PR 903 output test","editable":true,"labels":{"purpose":"cli-pr-903"},"permission":null,"policy":{"default-service-strategy":"allow","services":{"cdn":{"type":"deny","rules":[]},"sos":{"type":"rules","rules":[{"action":"allow","expression":"operation in ['list-sos-buckets-usage', 'list-buckets']"},{"action":"deny","expression":"!(resources.bucket in ['my-bucket', 'my-other-bucket'])"},{"action":"deny","expression":"operation in ['list-objects', 'get-object']"}]}}}}

Cleanup was confirmed:

$ ./bin/exo iam role show cli-pr-903-policy-output-test
error: "cli-pr-903-policy-output-test" not found in ListIAMRolesResponse: Not Found

A focused fake API test covers the reported deny-by-default policy with compute and networking allowed. go test ./cmd/iam passes.

The full make test-verbose suite passes. make build succeeds. golangci-lint run --timeout 4m reports 0 issues.

---

Note

AI assistance: PR description, test scaffolding.

[natalie-o-perret]

[SC-196302]

[kobajagi]

Can you add example of the output table with full featured policy?