remove effected inline policy

0

Hello Team,

Could you please help me to know how can we delete an inline police which doesn't exists outside a role that is when there is no identity attached to it. and we would like remove it as its coming up in the effected policies.

Regards, Viswa Jenny

Viswa
preguntada hace un año283 visualizaciones
1 Respuesta
0

The steps to do this in the AWS Console are at https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#remove-policies-console

With the AWS CLI use aws iam delete-role-policy --role-name [my_role] --policy-name [my_inline_policy] https://docs.aws.amazon.com/cli/latest/reference/iam/delete-role-policy.html

profile picture
EXPERTO
Steve_M
respondido hace un año
  • But as per my understanding the inline policy doesn't exists outside a role, so how can we do that?

  • In AWS Console create MyTestRole, with a managed policy (EC2 Full Access) and an inline policy.

    $ aws iam get-role --role-name MyTestRole
    {
        "Role": {
            "Path": "/",
            "RoleName": "MyTestRole",
            "RoleId": "ABCDEFGHIJKLMNOPQRSTU",
            "Arn": "arn:aws:iam::999999999999:role/MyTestRole",
            "CreateDate": "2023-05-08T01:05:52+00:00",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "ec2.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "Allows EC2 instances to call AWS services on your behalf.",
            "MaxSessionDuration": 3600,
            "RoleLastUsed": {}
        }
    }
    $ aws iam list-role-policies --role-name MyTestRole
    {
        "PolicyNames": [
            "TestInlinePolicy"
        ]
    }
    

    Delete the inline policy:

    $ aws iam delete-role-policy --role-name MyTestRole --policy-name TestInlinePolicy
    $ aws iam list-role-policies --role-name MyTestRole
    {
        "PolicyNames": []
    }
    

    Back on the AWS Console the role only has the managed policy, and no inline policy any more.

  • yeah maybe its correct if the role exists. But in my case the policy itself can't be opened, it just popped in the notification that this policy is effected to which no role is attached.

  • OK, so there's an inline policy that is not embedded within any user/group/role, but yet still exists.

    Is it definitely inline policy, and not a customer-managed policy ?

    What is the output of aws iam list-policies --scope=Local

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas