User policy that allows Deleting iam users

Question

As mentioned in the AWS documentation, I created policy to allow delete IAM users' operation.
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_delegate-permissions_examples.html

"Deleting the user. This task requires permissions to perform all of the following actions: DeleteSigningCertificate, DeleteLoginProfile, RemoveUserFromGroup, and DeleteUser"

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VisualEditor0",
			"Effect": "Allow",
			"Action": [
				"iam:RemoveUserFromGroup",
				"iam:DeleteSigningCertificate",
				"iam:GetUserPolicy",
				"iam:ListUsers",
				"iam:DeleteUser"
			],
			"Resource": "*"
		}
	]
}
But it doesn't allow to delete users.

Oleksii Bebych · Answer

try this one

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "iam:RemoveUserFromGroup",
                "iam:DeleteSigningCertificate",
                "iam:DeleteUserPolicy",
                "iam:ListUserPolicies",
                "iam:ListGroupsForUser",
                "iam:DeleteAccessKey",
                "iam:DeleteSSHPublicKey",
                "iam:DeleteServiceSpecificCredential",
                "iam:DeleteLoginProfile",
                "iam:GetUser",
                "iam:ListAttachedUserPolicies",
                "iam:ListUserTags",
                "iam:DetachUserPolicy",
                "iam:DeleteUser",
                "iam:ListUsers",
                "iam:DeleteVirtualMFADevice"
            ],
            "Resource": "*"
        }
    ]
}

```

Praveen Muppala(AWS) · Answer

The above policy should work.

To ensure comprehensive user deletion, it's imperative to account for all associated resources and credentials. This includes Attached Managed Policies, Inline Policies, Access Keys, Group Associations, Tags, Signing Certificates, and CodeCommit SSH Credentials. Please refer to the updated policy guidelines as detailed in the AWS documentation here - https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_delegate-permissions_examples.html#creds-policies-users

User policy that allows Deleting iam users

Add your answer

Relevant content