automation: detach policies before deleting role
You can't delete an IAM role that has attached policies.
With this change, the purge-ec2-resources command now works.
Differential Revision: https://phab.mercurial-scm.org/D6284
--- a/contrib/automation/hgautomation/aws.py Fri Apr 19 05:07:44 2019 -0700
+++ b/contrib/automation/hgautomation/aws.py Fri Apr 19 05:15:43 2019 -0700
@@ -505,6 +505,10 @@
for role in iamresource.roles.all():
if role.name.startswith(prefix):
+ for p in role.attached_policies.all():
+ print('detaching policy %s from %s' % (p.arn, role.name))
+ role.detach_policy(PolicyArn=p.arn)
+
print('removing role %s' % role.name)
role.delete()