remove effected inline policy

0

Hello Team,

Could you please help me to know how can we delete an inline police which doesn't exists outside a role that is when there is no identity attached to it. and we would like remove it as its coming up in the effected policies.

Regards, Viswa Jenny

Viswa
asked a year ago274 views
1 Answer
0

The steps to do this in the AWS Console are at https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#remove-policies-console

With the AWS CLI use aws iam delete-role-policy --role-name [my_role] --policy-name [my_inline_policy] https://docs.aws.amazon.com/cli/latest/reference/iam/delete-role-policy.html

profile picture
EXPERT
Steve_M
answered a year ago
  • But as per my understanding the inline policy doesn't exists outside a role, so how can we do that?

  • In AWS Console create MyTestRole, with a managed policy (EC2 Full Access) and an inline policy.

    $ aws iam get-role --role-name MyTestRole
    {
        "Role": {
            "Path": "/",
            "RoleName": "MyTestRole",
            "RoleId": "ABCDEFGHIJKLMNOPQRSTU",
            "Arn": "arn:aws:iam::999999999999:role/MyTestRole",
            "CreateDate": "2023-05-08T01:05:52+00:00",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "ec2.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "Allows EC2 instances to call AWS services on your behalf.",
            "MaxSessionDuration": 3600,
            "RoleLastUsed": {}
        }
    }
    $ aws iam list-role-policies --role-name MyTestRole
    {
        "PolicyNames": [
            "TestInlinePolicy"
        ]
    }
    

    Delete the inline policy:

    $ aws iam delete-role-policy --role-name MyTestRole --policy-name TestInlinePolicy
    $ aws iam list-role-policies --role-name MyTestRole
    {
        "PolicyNames": []
    }
    

    Back on the AWS Console the role only has the managed policy, and no inline policy any more.

  • yeah maybe its correct if the role exists. But in my case the policy itself can't be opened, it just popped in the notification that this policy is effected to which no role is attached.

  • OK, so there's an inline policy that is not embedded within any user/group/role, but yet still exists.

    Is it definitely inline policy, and not a customer-managed policy ?

    What is the output of aws iam list-policies --scope=Local

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions