This is an archive of the discontinued Mercurial Phabricator instance.

Differential D6284

automation: detach policies before deleting role
ClosedPublic

Authored by indygreg on Apr 19 2019, 8:20 AM.

Details

Reviewers
None
Group Reviewers
hg-reviewers
Commits
rHGfcb97cb91ff8: automation: detach policies before deleting role
Summary

You can't delete an IAM role that has attached policies.

With this change, the purge-ec2-resources command now works.

Diff Detail

Repository
rHG Mercurial
Lint
Automatic diff as part of commit; lint not applicable.
Unit
Automatic diff as part of commit; unit tests not applicable.

Event Timeline

indygreg created this revision.Apr 19 2019, 8:20 AM
Closed by commit rHGfcb97cb91ff8: automation: detach policies before deleting role (authored by indygreg). · Explain WhyMay 15 2019, 11:46 AM
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

Diff 15088

contrib/automation/hgautomation/aws.py

group.delete() group.delete()
for profile in iamresource.instance_profiles.all(): for profile in iamresource.instance_profiles.all():
if profile.name.startswith(prefix): if profile.name.startswith(prefix):
delete_instance_profile(profile) delete_instance_profile(profile)
for role in iamresource.roles.all(): for role in iamresource.roles.all():
if role.name.startswith(prefix): if role.name.startswith(prefix):
for p in role.attached_policies.all():
print('detaching policy %s from %s' % (p.arn, role.name))
role.detach_policy(PolicyArn=p.arn)
print('removing role %s' % role.name) print('removing role %s' % role.name)
role.delete() role.delete()
def wait_for_ip_addresses(instances): def wait_for_ip_addresses(instances):
"""Wait for the public IP addresses of an iterable of instances.""" """Wait for the public IP addresses of an iterable of instances."""
for instance in instances: for instance in instances:
while True: while True: