#!/usr/bin/env bash
#  vim:ts=4:sts=4:sw=4:et
#
#  Author: Hari Sekhon
#  Date: 2022-06-15 18:41:42 +0100 (Wed, 15 Jun 2022)
#
#  https://github.com/HariSekhon/DevOps-Bash-tools
#
#  License: see accompanying Hari Sekhon LICENSE file
#
#  If you're using my code you're welcome to connect with me on LinkedIn and optionally send me feedback to help steer this or other code I publish
#
#  https://www.linkedin.com/in/HariSekhon
#

set -euo pipefail
[ -n "${DEBUG:-}" ] && set -x
srcdir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# shellcheck disable=SC1090
. "$srcdir/lib/aws.sh"

# shellcheck disable=SC2034,SC2154
usage_description="
Deletes an IAM policy by first handling all prerequisite steps of deleting all prior versions and detaching all users, groups and roles

Because doing a straight delete will fail with an error like this:

    An error occurred (DeleteConflict) when calling the DeletePolicy operation: This policy has more than one version. Before you delete a policy, you must delete the policy's versions. The default version is deleted with the policy.

or this:

    An error occurred (DeleteConflict) when calling the DeletePolicy operation: Cannot delete a policy attached to entities.
"

help_usage "$@"

min_args 1 "$@"

policy="$1"

export AWS_DEFAULT_OUTPUT=json

aws_account_id="$(aws_account_id)"

policy_arn="arn:aws:iam::$aws_account_id:policy/$policy"

detach_entity(){
    local entity_type="$1"
    local entity="$2"
    entity_type="$(tr '[:upper:]' '[:lower:]' <<< "$entity_type")"
    timestamp "Detaching $entity_type $entity"
    aws iam "detach-${entity_type}-policy" "--${entity_type}-name" "$entity" --policy-arn "$policy_arn"
}

detach_entities(){
    local entity_type="$1"
    aws iam list-entities-for-policy --policy-arn "$policy_arn" |
    jq -r ".Policy${entity_type}s[].${entity_type}Name" |
    while read -r entity; do
        detach_entity "$entity_type" "$entity"
    done
}

older_policy_versions="$(aws iam list-policy-versions --policy-arn "$policy_arn" |
                         jq -r '.Versions[] | select(.IsDefaultVersion == false) | .VersionId')"

for policy_version_id in $older_policy_versions; do
    timestamp "Deleting policy '$policy' version '$policy_version_id'"
    aws iam delete-policy-version --policy-arn "$policy_arn" --version-id "$policy_version_id"
done

detach_entities User
detach_entities Group
detach_entities Role

timestamp "Deleting policy '$policy'"
aws iam delete-policy --policy-arn "$policy_arn"
timestamp "Done"