remove effected inline policy

0

Hello Team,

Could you please help me to know how can we delete an inline police which doesn't exists outside a role that is when there is no identity attached to it. and we would like remove it as its coming up in the effected policies.

Regards, Viswa Jenny

Viswa
feita há um ano283 visualizações
1 Resposta
0

The steps to do this in the AWS Console are at https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#remove-policies-console

With the AWS CLI use aws iam delete-role-policy --role-name [my_role] --policy-name [my_inline_policy] https://docs.aws.amazon.com/cli/latest/reference/iam/delete-role-policy.html

profile picture
ESPECIALISTA
Steve_M
respondido há um ano
  • But as per my understanding the inline policy doesn't exists outside a role, so how can we do that?

  • In AWS Console create MyTestRole, with a managed policy (EC2 Full Access) and an inline policy.

    $ aws iam get-role --role-name MyTestRole
    {
        "Role": {
            "Path": "/",
            "RoleName": "MyTestRole",
            "RoleId": "ABCDEFGHIJKLMNOPQRSTU",
            "Arn": "arn:aws:iam::999999999999:role/MyTestRole",
            "CreateDate": "2023-05-08T01:05:52+00:00",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "ec2.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "Allows EC2 instances to call AWS services on your behalf.",
            "MaxSessionDuration": 3600,
            "RoleLastUsed": {}
        }
    }
    $ aws iam list-role-policies --role-name MyTestRole
    {
        "PolicyNames": [
            "TestInlinePolicy"
        ]
    }
    

    Delete the inline policy:

    $ aws iam delete-role-policy --role-name MyTestRole --policy-name TestInlinePolicy
    $ aws iam list-role-policies --role-name MyTestRole
    {
        "PolicyNames": []
    }
    

    Back on the AWS Console the role only has the managed policy, and no inline policy any more.

  • yeah maybe its correct if the role exists. But in my case the policy itself can't be opened, it just popped in the notification that this policy is effected to which no role is attached.

  • OK, so there's an inline policy that is not embedded within any user/group/role, but yet still exists.

    Is it definitely inline policy, and not a customer-managed policy ?

    What is the output of aws iam list-policies --scope=Local

Você não está conectado. Fazer login para postar uma resposta.

Uma boa resposta responde claramente à pergunta, dá feedback construtivo e incentiva o crescimento profissional de quem perguntou.

Diretrizes para responder a perguntas