AWS IAM documentation change
Summary
Added PowerShell V5 examples for policy deletion with dependency cleanup
Security assessment
Documents secure policy removal process (detaching from entities) but doesn't fix a specific vulnerability
Diff
diff --git a/IAM/latest/UserGuide/iam_example_iam_DeletePolicy_section.md b/IAM/latest/UserGuide/iam_example_iam_DeletePolicy_section.md index 9a6b35edd..0842ea0ba 100644 --- a//IAM/latest/UserGuide/iam_example_iam_DeletePolicy_section.md +++ b//IAM/latest/UserGuide/iam_example_iam_DeletePolicy_section.md @@ -433,0 +434,26 @@ PowerShell +**Tools for PowerShell V5** + + +**Example 1: This example deletes the policy whose ARN is`arn:aws:iam::123456789012:policy/MySamplePolicy`. Before you can delete the policy, you must first delete all versions except the default by running `Remove-IAMPolicyVersion`. You must also detach the policy from any IAM users, groups, or roles.** + + + Remove-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy + + +**Example 2: This example deletes a policy by first deleting all the non-default policy versions, detaching it from all attached IAM entities, and finally deleting the policy itself. The first line retrieves the policy object. The second line retrieves all the policy versions that are not flagged as the default version into a collection and then deletes each policy in the collection. The third line retrieves all of the IAM users, groups, and roles to which the policy is attached. Lines four through six detach the policy from each attached entity. The last line uses this command to remove the managed policy as well as the remaining default version. The example includes the`-Force` switch parameter on any line that needs it to suppress prompts for confirmation.** + + + $pol = Get-IAMPolicy -PolicyArn arn:aws:iam::123456789012:policy/MySamplePolicy + Get-IAMPolicyVersions -PolicyArn $pol.Arn | where {-not $_.IsDefaultVersion} | Remove-IAMPolicyVersion -PolicyArn $pol.Arn -force + $attached = Get-IAMEntitiesForPolicy -PolicyArn $pol.Arn + $attached.PolicyGroups | Unregister-IAMGroupPolicy -PolicyArn $pol.arn + $attached.PolicyRoles | Unregister-IAMRolePolicy -PolicyArn $pol.arn + $attached.PolicyUsers | Unregister-IAMUserPolicy -PolicyArn $pol.arn + Remove-IAMPolicy $pol.Arn -Force + + + * For API details, see [DeletePolicy](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. + + + +