使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款
AWS re:Postre:Post

Identify in-built or default IAM Roles

0

I am trying to come up with a program to manage or clean up older IAM Roles. In the process I am trying to identify AWS or Amazon created in-built or default IAM Roles. I would like to ignore deleting all such roles. Any pointers how to identify such IAM Roles

  • Sarvo
    2 年前

    some sample role I see are like AmazonSSMRoleForInstancesQuickSetup, AmazonEC2RoleforSSM etc.

主題
安全性、身分識別與合規
標籤
AWS Identity and Access Management
語言
English
Sarvo
已提問 2 年前檢視次數 838 次
1 個回答
2
已接受的答案

You should definitely check for "aws-reserved" and "aws-service-role" in the ARN of the role you consider deleting. Service-Linked Roles and Roles for SSO will contain these prefixes in their ARN's.

However, I would rather recommend you to attach tags to the roles you create. You can then simply filter your roles by custom tags to make sure you only delete the Roles you created. Implementing Tag policies for your organization, will ensure that certain tags are set(https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html).

Bent
已回答 2 年前
  • Sarvo
    2 年前

    Thanks for the suggestion. We have tagged many IAM Roles, however while practicing or learning some AWS services, there has been no regulation over IAM roles created manually and not been tagged. I see bunch of IAM Roles having ARN: arn:aws:iam::<AccountId>:role/aws-service-role/aws-service-role/ssm.amazonaws.com/AWSServiceRoleForAmazonSSM. Another pattern I noticed is that all these Roles have Path value /aws-service-role/<service-name> , is this same as the prefix you are referring to as well.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋，同時有助於提問者的專業成長。

回答問題指南

相關內容