Is that possible to delete a managed policy in AWS IAM from my account?

Viewed 174

In web console of AWS IAM policies, the option "Delete" out of the "Action" drop down menu is disabled when selecting any managed policy.

In CLI, when trying to delete a managed policy, I got:

$ aws iam delete-policy --policy-arn arn:aws:iam::aws:policy/service-role/AWSQuickSightElasticsearchPolicy

An error occurred (AccessDenied) when calling the DeletePolicy operation: Cannot delete policies outside your own account.

the simple question: is that possible to remove any managed policy from my account? If yes, how?

2 Answers

"Cannot delete policies outside your own account" is telling. The policy-arn parameter has an account ID of aws, which I doubt is one that your authenticated identity can delete. (Unless you authed as Jeff Bezos, LOL.)

To remove a managed policy, the docs say:

  1. Detach the policy from all users, groups, and roles that the policy is attached to, using DetachUserPolicy, DetachGroupPolicy, or DetachRolePolicy.
  2. Delete all versions of the policy using DeletePolicyVersion.
  3. Delete the policy (this automatically deletes the policy's default version) using this operation.

My guess is that the Web Console was greyed out because either the policy was attached or because there were versions. Make sure to delete those, per the instructions.

The command line failed because of the given ARN. When doing that last step, make sure to use the account ID for the account holding the managed policy to delete.

Related