#!/usr/bin/env bash
# vim:ts=4:sts=4:sw=4:et
#
# Author: Hari Sekhon
# Date: 2022-06-15 18:41:42 +0100 (Wed, 15 Jun 2022)
#
# https://github.com/HariSekhon/DevOps-Bash-tools
#
# License: see accompanying Hari Sekhon LICENSE file
#
# If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
# https://www.linkedin.com/in/HariSekhon
#
set -euo pipefail
[ -n " ${ DEBUG :- } " ] && set -x
srcdir = " $( cd " $( dirname " ${ BASH_SOURCE [0] } " ) " && pwd ) "
# shellcheck disable=SC1090
. " $srcdir /lib/aws.sh "
# shellcheck disable=SC2034,SC2154
usage_description = "
Finds all users, groups and roles where a given IAM policy is attached, so that you can remove all these references in your Terraform code and avoid this error:
Plan: 1 to add, 1 to change, 1 to destroy.
module.mymodule.aws_iam_policy.mypolicy: Destroying... [ id = arn:aws:iam::***:policy/mypolicy]
╷
│Error: error deleting IAM policy arn:aws:iam::***:policy/mypolicy: DeleteConflict: Cannot delete a policy attached to entities.
│ status code: 409, request id: 1f9ca3ee-48fb-4e5e-9e58-5c266e29e9be
"
help_usage " $@ "
min_args 1 " $@ "
policy = " $1 "
export AWS_DEFAULT_OUTPUT = json
aws_account_id = " $( aws_account_id) "
policy_arn = " arn:aws:iam:: $aws_account_id :policy/ $policy "
find_entities( ) {
local entity_type = " $1 "
aws iam list-entities-for-policy --policy-arn " $policy_arn " |
jq_debug_pipe_dump |
jq -r " .Policy ${ entity_type } s[]. ${ entity_type } Name " |
while read -r entity; do
printf '%s\t%s\n' " $entity_type " " $entity "
done
}
find_entities User
find_entities Group
find_entities Role