129 lines
4.7 KiB
Markdown
129 lines
4.7 KiB
Markdown
# Assignment
|
|
|
|
The Nautilus DevOps team is currently engaged in a cleanup process, focusing on removing unnecessary data and services from their AWS account. As part of the migration process, several resources were created for one-time use only, necessitating a cleanup effort to optimize their AWS environment.
|
|
|
|
Delete the IAM role named iamrole_ammar using Terraform. Make sure to keep the provisioning code, as we might need to provision this instance again later.
|
|
|
|
The Terraform working directory is /home/bob/terraform.
|
|
|
|
Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
|
|
|
|
# Solution
|
|
|
|
# Delete IAM Role (Keep Code) — `iamrole_ammar`
|
|
|
|
Same "delete but keep the code" pattern: **destroy** the role while leaving its
|
|
provisioning block in `main.tf` for later reuse. A **targeted destroy** does exactly
|
|
this — it acts on the real resource and Terraform state only, never on your `.tf`
|
|
source.
|
|
|
|
## `main.tf` — leave unchanged
|
|
|
|
Do **not** delete or comment out the block. It stays exactly as given:
|
|
|
|
```hcl
|
|
resource "aws_iam_role" "role" {
|
|
name = "iamrole_ammar"
|
|
|
|
assume_role_policy = jsonencode({
|
|
Version = "2012-10-17",
|
|
Statement = [
|
|
{
|
|
Effect = "Allow"
|
|
Principal = {
|
|
Service = "ec2.amazonaws.com"
|
|
}
|
|
Action = "sts:AssumeRole"
|
|
}
|
|
]
|
|
})
|
|
|
|
tags = {
|
|
Name = "iamrole_ammar"
|
|
}
|
|
}
|
|
```
|
|
|
|
## How to run
|
|
|
|
```bash
|
|
cd /home/bob/terraform
|
|
|
|
# Destroy ONLY this IAM role; leaves the code in main.tf intact.
|
|
terraform destroy -target=aws_iam_role.role -auto-approve
|
|
```
|
|
|
|
## How it works
|
|
|
|
### Targeted destroy vs. the wrong approaches
|
|
|
|
| Approach | Result |
|
|
|----------|--------|
|
|
| Delete the resource block, then `apply` | Role is destroyed, but the **code is gone** — violates "keep the provisioning code." |
|
|
| `terraform destroy` (no target) | Destroys **everything** in the config, not just this role. |
|
|
| `terraform destroy -target=aws_iam_role.role` | Destroys **only** this role; code stays in `main.tf`. ✅ |
|
|
|
|
The `-target` flag scopes the operation to the single resource address
|
|
(`aws_iam_role.role` — the **Terraform resource name** `role`, not the AWS role name
|
|
`iamrole_ammar`). Terraform calls `DeleteRole`, removes the resource from state, and
|
|
leaves your configuration untouched, because destroy operates on infrastructure and
|
|
state, never on source code.
|
|
|
|
### Why the code surviving matters
|
|
|
|
Keeping the block means the role is trivially re-creatable later: a plain
|
|
`terraform apply` will see it declared in config but absent from state and recreate
|
|
it — assume-role policy and all. That satisfies "we might need to provision this
|
|
again."
|
|
|
|
### One caveat for IAM roles
|
|
|
|
`DeleteRole` only succeeds if the role has **nothing attached**: no managed policies,
|
|
no inline policies, and no instance profile referencing it. The `assume_role_policy`
|
|
(trust policy) shown here is part of the role itself and does **not** block deletion —
|
|
only *permission* policies and instance-profile links do. If the destroy errors with
|
|
`DeleteConflict`, clear those first, then re-run:
|
|
|
|
```bash
|
|
# Detach managed policies
|
|
aws iam list-attached-role-policies --role-name iamrole_ammar \
|
|
--query 'AttachedPolicies[].PolicyArn' --output text | \
|
|
xargs -r -n1 -I{} aws iam detach-role-policy --role-name iamrole_ammar --policy-arn {}
|
|
|
|
# Delete inline policies
|
|
aws iam list-role-policies --role-name iamrole_ammar \
|
|
--query 'PolicyNames[]' --output text | \
|
|
xargs -r -n1 -I{} aws iam delete-role-policy --role-name iamrole_ammar --policy-name {}
|
|
|
|
# Remove from any instance profiles
|
|
aws iam list-instance-profiles-for-role --role-name iamrole_ammar \
|
|
--query 'InstanceProfiles[].InstanceProfileName' --output text | \
|
|
xargs -r -n1 -I{} aws iam remove-role-from-instance-profile --instance-profile-name {} --role-name iamrole_ammar
|
|
|
|
# Then retry
|
|
terraform destroy -target=aws_iam_role.role -auto-approve
|
|
```
|
|
|
|
For a bare role like this one (only a trust policy, no permissions attached), the
|
|
plain targeted destroy works directly.
|
|
|
|
### Expected state afterward
|
|
|
|
After the destroy, the config still declares a resource that no longer exists in
|
|
state, so `terraform plan` will show Terraform wants to **create** `iamrole_ammar`
|
|
again (`+ 1 to add`). That's expected — **do not apply it**. The task wants the role
|
|
deleted with the code retained, which is exactly this state.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
aws iam get-role --role-name iamrole_ammar 2>&1 | grep -q 'NoSuchEntity' \
|
|
&& echo "Role deleted." \
|
|
|| echo "Role still exists."
|
|
|
|
# Confirm the code is still present
|
|
grep -A18 'resource "aws_iam_role" "role"' /home/bob/terraform/main.tf
|
|
```
|
|
|
|
Expected — `get-role` fails with `NoSuchEntity` (role gone), and the resource block is
|
|
still present in `main.tf`. |