remove effected inline policy

0

Hello Team,

Could you please help me to know how can we delete an inline police which doesn't exists outside a role that is when there is no identity attached to it. and we would like remove it as its coming up in the effected policies.

Regards, Viswa Jenny

Viswa
已提問 1 年前檢視次數 283 次
1 個回答
0

The steps to do this in the AWS Console are at https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#remove-policies-console

With the AWS CLI use aws iam delete-role-policy --role-name [my_role] --policy-name [my_inline_policy] https://docs.aws.amazon.com/cli/latest/reference/iam/delete-role-policy.html

profile picture
專家
Steve_M
已回答 1 年前
  • But as per my understanding the inline policy doesn't exists outside a role, so how can we do that?

  • In AWS Console create MyTestRole, with a managed policy (EC2 Full Access) and an inline policy.

    $ aws iam get-role --role-name MyTestRole
    {
        "Role": {
            "Path": "/",
            "RoleName": "MyTestRole",
            "RoleId": "ABCDEFGHIJKLMNOPQRSTU",
            "Arn": "arn:aws:iam::999999999999:role/MyTestRole",
            "CreateDate": "2023-05-08T01:05:52+00:00",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "Service": "ec2.amazonaws.com"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "Description": "Allows EC2 instances to call AWS services on your behalf.",
            "MaxSessionDuration": 3600,
            "RoleLastUsed": {}
        }
    }
    $ aws iam list-role-policies --role-name MyTestRole
    {
        "PolicyNames": [
            "TestInlinePolicy"
        ]
    }
    

    Delete the inline policy:

    $ aws iam delete-role-policy --role-name MyTestRole --policy-name TestInlinePolicy
    $ aws iam list-role-policies --role-name MyTestRole
    {
        "PolicyNames": []
    }
    

    Back on the AWS Console the role only has the managed policy, and no inline policy any more.

  • yeah maybe its correct if the role exists. But in my case the policy itself can't be opened, it just popped in the notification that this policy is effected to which no role is attached.

  • OK, so there's an inline policy that is not embedded within any user/group/role, but yet still exists.

    Is it definitely inline policy, and not a customer-managed policy ?

    What is the output of aws iam list-policies --scope=Local

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南