DeleteInstanceProfile 사용하기
DeleteInstanceProfile 사용하기 (SDK/CLI)
DeleteInstanceProfile(인스턴스 프로필 삭제) API를 활용하는 방법을 코드 예시로 정리했어요. 각 예시는 어떤 동작을 하는지, 어떤 파라미터를 쓰는지 순서대로 살펴볼 수 있어요.
출처: 문서
본문
다음 코드 예시들은 DeleteInstanceProfile 를 어떻게 사용하는지 보여줘요.
.NET
/// <summary>
/// Detaches a role from an instance profile, detaches policies from the role,
/// and deletes all the resources.
/// </summary>
/// <param name="profileName">The name of the profile to delete.</param>
/// <param name="roleName">The name of the role to delete.</param>
/// <returns>Async task.</returns>
public async Task DeleteInstanceProfile(string profileName, string roleName)
{
try
{
await _amazonIam.RemoveRoleFromInstanceProfileAsync(
new RemoveRoleFromInstanceProfileRequest()
{
InstanceProfileName = profileName,
RoleName = roleName
});
await _amazonIam.DeleteInstanceProfileAsync(
new DeleteInstanceProfileRequest() { InstanceProfileName = profileName });
var attachedPolicies = await _amazonIam.ListAttachedRolePoliciesAsync(
new ListAttachedRolePoliciesRequest() { RoleName = roleName });
foreach (var policy in attachedPolicies.AttachedPolicies)
{
await _amazonIam.DetachRolePolicyAsync(
new DetachRolePolicyRequest()
{
RoleName = roleName,
PolicyArn = policy.PolicyArn
});
// Delete the custom policies only.
if (!policy.PolicyArn.StartsWith("arn:aws:iam::aws"))
{
await _amazonIam.DeletePolicyAsync(
new Amazon.IdentityManagement.Model.DeletePolicyRequest()
{
PolicyArn = policy.PolicyArn
});
}
}
await _amazonIam.DeleteRoleAsync(
new DeleteRoleRequest() { RoleName = roleName });
}
catch (NoSuchEntityException)
{
Console.WriteLine($"Instance profile {profileName} does not exist.");
}
}
GitHub에 더 많은 내용이 있어요. AWS Code Examples Repository에서 전체 예시를 찾아 실행 방법을 배울 수 있어요.
AWS CLI
인스턴스 프로필 삭제하기
aws iam delete-instance-profile \
--instance-profile-name ExampleInstanceProfile
다음 delete-instance-profile 명령은 ExampleInstanceProfile이라는 인스턴스 프로필을 삭제해요.
JavaScript(SDK v3)
const client = new IAMClient({});
await client.send(
new DeleteInstanceProfileCommand({
InstanceProfileName: NAMES.instanceProfileName,
}),
);
GitHub에 더 많은 내용이 있어요. AWS Code Examples Repository에서 전체 예시를 찾아 실행 방법을 배울 수 있어요.
PowerShell Tools (V4)
예시 1: MyAppInstanceProfile이라는 EC2 인스턴스 프로필을 삭제해요. 첫 번째 명령은 인스턴스 프로필에서 역할을 분리하고, 두 번째 명령은 인스턴스 프로필을 삭제해요.
(Get-IAMInstanceProfile -InstanceProfileName MyAppInstanceProfile).Roles | Remove-IAMRoleFromInstanceProfile -InstanceProfileName MyAppInstanceProfile
Remove-IAMInstanceProfile -InstanceProfileName MyAppInstanceProfile
PowerShell Tools (V5)
예시 1: MyAppInstanceProfile이라는 EC2 인스턴스 프로필을 삭제해요. 첫 번째 명령은 인스턴스 프로필에서 역할을 분리하고, 두 번째 명령은 인스턴스 프로필을 삭제해요.
(Get-IAMInstanceProfile -InstanceProfileName MyAppInstanceProfile).Roles | Remove-IAMRoleFromInstanceProfile -InstanceProfileName MyAppInstanceProfile
Remove-IAMInstanceProfile -InstanceProfileName MyAppInstanceProfile
Python(Boto3)
class AutoScalingWrapper:
"""
Encapsulates Amazon EC2 Auto Scaling and EC2 management actions.
"""
def __init__(
self,
resource_prefix: str,
inst_type: str,
ami_param: str,
autoscaling_client: boto3.client,
ec2_client: boto3.client,
ssm_client: boto3.client,
iam_client: boto3.client,
):
"""
Initializes the AutoScaler class with the necessary parameters.
:param resource_prefix: The prefix for naming AWS resources that are created by this class.
:param inst_type: The type of EC2 instance to create, such as t3.micro.
:param ami_param: The Systems Manager parameter used to look up the AMI that is created.
:param autoscaling_client: A Boto3 EC2 Auto Scaling client.
:param ec2_client: A Boto3 EC2 client.
:param ssm_client: A Boto3 Systems Manager client.
:param iam_client: A Boto3 IAM client.
"""
self.inst_type = inst_type
self.ami_param = ami_param
self.autoscaling_client = autoscaling_client
self.ec2_client = ec2_client
self.ssm_client = ssm_client
self.iam_client = iam_client
sts_client = boto3.client("sts")
self.account_id = sts_client.get_caller_identity()["Account"]
self.key_pair_name = f"{resource_prefix}-key-pair"
self.launch_template_name = f"{resource_prefix}-template-"
self.group_name = f"{resource_prefix}-group"
# Happy path
self.instance_policy_name = f"{resource_prefix}-pol"
self.instance_role_name = f"{resource_prefix}-role"
self.instance_profile_name = f"{resource_prefix}-prof"
# Failure mode
self.bad_creds_policy_name = f"{resource_prefix}-bc-pol"
self.bad_creds_role_name = f"{resource_prefix}-bc-role"
self.bad_creds_profile_name = f"{resource_prefix}-bc-prof"
def delete_instance_profile(self, profile_name: str, role_name: str) -> None:
"""
Detaches a role from an instance profile, detaches policies from the role,
and deletes all the resources.
:param profile_name: The name of the profile to delete.
:param role_name: The name of the role to delete.
"""
try:
self.iam_client.remove_role_from_instance_profile(
InstanceProfileName=profile_name, RoleName=role_name
)
self.iam_client.delete_instance_profile(InstanceProfileName=profile_name)
log.info("Deleted instance profile %s.", profile_name)
attached_policies = self.iam_client.list_attached_role_policies(
RoleName=role_name
)
for pol in attached_policies["AttachedPolicies"]:
self.iam_client.detach_role_policy(
RoleName=role_name, PolicyArn=pol["PolicyArn"]
)
if not pol["PolicyArn"].startswith("arn:aws:iam::aws"):
self.iam_client.delete_policy(PolicyArn=pol["PolicyArn"])
log.info("Detached and deleted policy %s.", pol["PolicyName"])
self.iam_client.delete_role(RoleName=role_name)
log.info("Deleted role %s.", role_name)
except ClientError as err:
log.error(
f"Couldn't delete instance profile {profile_name} or detach "
f"policies and delete role {role_name}: {err}"
)
if err.response["Error"]["Code"] == "NoSuchEntity":
log.info(
"Instance profile %s doesn't exist, nothing to do.", profile_name
)
GitHub에 더 많은 내용이 있어요. AWS Code Examples Repository에서 전체 예시를 찾아 실행 방법을 배울 수 있어요.
이 예시는 인스턴스 프로필에서 역할을 제거하고 역할에 연결된 모든 정책을 분리하며 모든 리소스를 삭제해요.