AWS IAM documentation change

Service: IAM · 2025-06-25 · Documentation low

File: IAM/latest/UserGuide/iam_example_iam_DeleteUser_section.md

Summary

Added comprehensive PowerShell V5 example for secure user deletion including MFA/access key cleanup

Security assessment

While demonstrating secure deletion practices, this is a standard operational procedure rather than addressing a specific vulnerability. Shows existing security best practices but does not introduce new security features.

Diff

diff --git a/IAM/latest/UserGuide/iam_example_iam_DeleteUser_section.md b/IAM/latest/UserGuide/iam_example_iam_DeleteUser_section.md
index 6ac08933c..b234a6964 100644
--- a//IAM/latest/UserGuide/iam_example_iam_DeleteUser_section.md
+++ b//IAM/latest/UserGuide/iam_example_iam_DeleteUser_section.md
@@ -508,0 +509,54 @@ PowerShell
+**Tools for PowerShell V5**
+    
+
+**Example 1: This example deletes the IAM user named`Bob`.**
+    
+    
+    Remove-IAMUser -UserName Bob
+    
+
+**Example 2: This example deletes the IAM user named`Theresa` along with any elements that must be deleted first.**
+    
+    
+    $name = "Theresa"
+    
+    # find any groups and remove user from them
+    $groups = Get-IAMGroupForUser -UserName $name
+    foreach ($group in $groups) { Remove-IAMUserFromGroup -GroupName $group.GroupName -UserName $name -Force }
+    
+    # find any inline policies and delete them
+    $inlinepols = Get-IAMUserPolicies -UserName $name
+    foreach ($pol in $inlinepols) { Remove-IAMUserPolicy -PolicyName $pol -UserName $name -Force}
+    
+    # find any managed polices and detach them
+    $managedpols = Get-IAMAttachedUserPolicies -UserName $name
+    foreach ($pol in $managedpols) { Unregister-IAMUserPolicy -PolicyArn $pol.PolicyArn -UserName $name }
+    
+    # find any signing certificates and delete them
+    $certs = Get-IAMSigningCertificate -UserName $name
+    foreach ($cert in $certs) { Remove-IAMSigningCertificate -CertificateId $cert.CertificateId -UserName $name -Force }
+    
+    # find any access keys and delete them
+    $keys = Get-IAMAccessKey -UserName $name
+    foreach ($key in $keys) { Remove-IAMAccessKey -AccessKeyId $key.AccessKeyId -UserName $name -Force }
+    
+    # delete the user's login profile, if one exists - note: need to use try/catch to suppress not found error
+    try { $prof = Get-IAMLoginProfile -UserName $name -ea 0 } catch { out-null }
+    if ($prof) { Remove-IAMLoginProfile -UserName $name -Force }
+    
+    # find any MFA device, detach it, and if virtual, delete it.
+    $mfa = Get-IAMMFADevice -UserName $name
+    if ($mfa) { 
+        Disable-IAMMFADevice -SerialNumber $mfa.SerialNumber -UserName $name 
+        if ($mfa.SerialNumber -like "arn:*") { Remove-IAMVirtualMFADevice -SerialNumber $mfa.SerialNumber }
+    }
+    
+    # finally, remove the user
+    Remove-IAMUser -UserName $name -Force
+    
+
+  * For API details, see [DeleteUser](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. 
+
+
+
+