I have below code which deletes the inline policy, managed policy and the role it self from the IAM.
For this I have created a role with following custom policies attached to it.
STS
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": [
"sts:AssumeRole"
],
"Resource": "arn:aws:iam::321750505551:role/MathRole-*"
}
]
}
IAM –
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "VisualEditor0",
"Effect": "Allow",
"Action": "iam:*",
"Resource": [
"arn:aws:iam::321750505551:role/MathRole-*",
"arn:aws:iam::321750505551:policy/MathPolicy-*"
]
}
]
}
My Code is as below
self.iam_client = boto3.client('iam', verify=False)
math_role_name = f"MathRole-{userId}-role"
logger.info(f"Deleting the policies and math role {math_role_name} for test user ")
# response = iam_client.delete_role(roleName=math_role_name)
response = self.iam_client.list_role_policies(RoleName=math_role_name)
for inline_policy in response['PolicyNames']:
logger.info(f"deleting inline policy: {inline_policy}")
delete_inline_policy_response = self.iam_client.delete_role_policy(
RoleName=math_role_name,
PolicyName=inline_policy
)
logger.info(f"deleted inline policy response {delete_inline_policy_response}")
attached_policies = self.iam_client.list_attached_role_policies(RoleName=math_role_name)
for items in attached_policies['AttachedPolicies']:
logger.info(f"detaching the attached policy : {items['PolicyArn']}")
detach_inline_policy_response = self.iam_client.detach_role_policy(
RoleName=math_role_name,
PolicyArn=items['PolicyArn']
)
logger.info(f"deleted managed policy response {detach_inline_policy_response}")
logger.info(f"list instance profile for the role")
instance_profile = self.iam_client.list_instance_profiles_for_role(
RoleName=math_role_name
)
logger.info(
f"deleting instance profile for role {math_role_name} :{instance_profile['InstanceProfiles'][0]['InstanceProfileName']}")
delete_role_from_instance_profile = self.iam_client.remove_role_from_instance_profile(
InstanceProfileName=instance_profile['InstanceProfiles'][0]['InstanceProfileName'],
RoleName=math_role_name
)
delete_instance_profile = self.iam_client.delete_instance_profile(
InstanceProfileName=instance_profile['InstanceProfiles'][0]['InstanceProfileName']
)
logger.info(f"deleting role : {math_role_name}")
delete_role = self.iam_client.delete_role(
RoleName=math_role_name
)
logger.info(f"deleted role response {delete_role}")
However When I run with with my role it throws following error
botocore.exceptions.ClientError: An error occurred (AccessDenied) when calling the RemoveRoleFromInstanceProfile operation: User: arn:aws:sts::321750505551:assumed-role/MathRole-devops-QA-GithubActions/GitHub_to_AWS_via_FederatedOIDC is not authorized to perform: iam:RemoveRoleFromInstanceProfile on resource: instance profile MathRole-64ed9e32086f90da1426bf51-role because no identity-based policy allows the iam:RemoveRoleFromInstanceProfile action
Any idea what policy I need to attach to the role so that it can delete the role from instance profile
How to remove the intance profile role while delete the role.
What policy I need to attach to my role to delete instance profile role.
Instance profile deletion throws an error.