AWS API Changes

2017/09/18 - AWS Identity and Access Management - 2 new api methods

Changes Update iam client to latest version

GetServiceLinkedRoleDeletionStatus (new)

Link ¶

Retrieves the status of your service-linked role deletion. After you use the DeleteServiceLinkedRole API operation to submit a service-linked role for deletion, you can use the DeletionTaskId parameter in GetServiceLinkedRoleDeletionStatus to check the status of the deletion. If the deletion fails, this operation returns the reason that it failed.

See also: AWS API Documentation

Request Syntax

client.get_service_linked_role_deletion_status(
    DeletionTaskId='string'
)

type DeletionTaskId:

string

param DeletionTaskId:

[REQUIRED]

The deletion task identifier. This identifier is returned by the DeleteServiceLinkedRole operation in the format task/aws-service-role/<service-principal-name>/<role-name>/<task-uuid>.

rtype:

dict

returns:

Response Syntax

{
    'Status': 'SUCCEEDED'|'IN_PROGRESS'|'FAILED'|'NOT_STARTED',
    'Reason': {
        'Reason': 'string',
        'RoleUsageList': [
            {
                'Region': 'string',
                'Resources': [
                    'string',
                ]
            },
        ]
    }
}

Response Structure

(dict) --
- Status (string) --
  
  The status of the deletion.
- Reason (dict) --
  
  An object that contains details about the reason the deletion failed.
  - Reason (string) --
    
    A short description of the reason that the service-linked role deletion failed.
  - RoleUsageList (list) --
    
    A list of objects that contains details about the service-linked role deletion failure. If the service-linked role has active sessions or if any resources that were used by the role have not been deleted from the linked service, the role can't be deleted. This parameter includes a list of the resources that are associated with the role and the region in which the resources are being used.
    - (dict) --
      
      An object that contains details about how a service-linked role is used.
      
      This data type is used as a response element in the GetServiceLinkedRoleDeletionStatus operation.
      - Region (string) --
        
        The name of the region where the service-linked role is being used.
      - Resources (list) --
        
        The name of the resource that is using the service-linked role.
        
        (string) --
        
        The Amazon Resource Name (ARN). ARNs are unique identifiers for AWS resources.
        
        For more information about ARNs, go to Amazon Resource Names (ARNs) and AWS Service Namespaces in the AWS General Reference.

DeleteServiceLinkedRole (new)

Link ¶

Submits a service-linked role deletion request and returns a DeletionTaskId, which you can use to check the status of the deletion. Before you call this operation, confirm that the role has no active sessions and that any resources used by the role in the linked service are deleted. If you call this operation more than once for the same service-linked role and an earlier deletion task is not complete, then the DeletionTaskId of the earlier request is returned.

If you submit a deletion request for a service-linked role whose linked service is still accessing a resource, then the deletion task fails. If it fails, the GetServiceLinkedRoleDeletionStatus API operation returns the reason for the failure, including the resources that must be deleted. To delete the service-linked role, you must first remove those resources from the linked service and then submit the deletion request again. Resources are specific to the service that is linked to the role. For more information about removing resources from a service, see the AWS documentation for your service.

For more information about service-linked roles, see Roles Terms and Concepts: AWS Service-Linked Role in the IAM User Guide.