aws.iam-group | Detach Managed Policies

[joyceol]

Hello,

I'm trying to remove any new groups that is with the AdminstratorAccess attached.

However, I noticed that there ir no specific action for delete managed policies.

I've try to delete the group itself, but I get the error: An error occurred (DeleteConflict) when calling the DeleteGroup operation: Cannot delete entity, must detach all policies first.

The Policy:

policies:
  - name: iam-group-detach-policy
    resource: iam-group
    description: Detach AdministratorAccess policy from new roles
    mode:
        type: cloudtrail
        events:
          - source: iam.amazonaws.com
            event: CreateGroup
            ids: requestParameters.groupName
    filters:
    - type: has-specific-managed-policy
      value: AdministratorAccess
    actions:
      - type: delete

[thisisshi]

thanks for the question, this is actually a enhancement we would need to make to the iam-group resource to add a detach-managed-policies action

[matthiasbuchner]

You can use set-policy

      - type: set-policy
        state: detached
        arn: "*"