AWS组织创建的测试账号无法删除IAM角色，Root用户遭显式拒绝

Hey there, let's figure out why you're stuck deleting those IAM roles in your 'test' member account—even the root user is hitting an explicit deny error. Explicit denies always take top priority over any allow permissions, so here are the most likely culprits and fixes to check:

1. Check AWS Organizations Service Control Policies (SCPs) #

This is the #1 suspect here since your management account can delete roles just fine, but the member account can't. SCPs are organization-level policies that apply to all member accounts and override account-level permissions—even for the root user.

• How to investigate:

  • Log into your AWS Organizations management account, head to the Organizations console.
  • Locate the OU (Organization Unit) that your 'test' account belongs to, then check all SCPs attached to this OU and any parent OUs (including the root OU).
  • Look for any SCP that includes "Effect": "Deny" paired with the iam:DeleteRole action, or a policy that targets the specific test role ARN as a resource.
  • Remember: SCPs default to allowing all actions unless explicitly denied, so even a single deny rule will block the deletion.

• Fix:

  • If you find such an SCP, you can temporarily modify it to remove the deny rule, delete the problematic role(s), then revert the SCP if needed. Alternatively, adjust the SCP's conditions to allow deletion of specific roles (like adding a StringNotEquals condition for the role name/ARN).

2. Verify IAM Permissions Boundaries #

Even if the role has no attached policies, there might be a permissions boundary applied either to the role itself or at the account level that's blocking deletion.

• How to investigate:
  • In your 'test' account's IAM console, open the details page for the test role. Check the Permissions boundary section to see if a policy is attached—look for any explicit deny on iam:DeleteRole.
  • Also, check your account's IAM settings under Permissions boundaries for IAM entities to see if a default boundary policy is enforced across all IAM entities in the account.

3. Rule Out Edge Cases (Less Likely) #

• Session Policies: If you were using the root user via an STS session (uncommon for root, but worth checking), verify there's no session policy attached that denies iam:DeleteRole.
• Resource-Based Policies: IAM roles rarely use resource-based policies, but double-check the role's Trust relationships—though these typically control who can assume the role, not delete it, it's a quick check to rule out odd configurations.

Quick Test to Confirm #

If you suspect an SCP is the issue, you can temporarily move the 'test' account to the root OU (which might have more permissive SCPs) and try deleting the role again. If it works, you know the problem is in the OU's attached SCPs.

内容的提问来源于stack exchange，提问作者dsantinelli