def InstanceProfileMitigator(
    zone: str,
    instance_id: str,
    revoke_existing: bool = False
    ) -> None:
  """Remove an instance profile attachment from an instance.

  Also, optionally revoke existing issued tokens for the profile.

  Args:
    zone (str): AWS Availability Zone the instance is in.
    instance_id (str): The id (i-xxxxxx) of the virtual machine.
    revoke_existing (bool): True to revoke existing tokens for the profile's
      role. False otherwise.

  Raises:
    ResourceNotFoundError: If the instance cannot be found, or does not have a
      profile attachment.
  """
  logger.info('Finding profile attachment')
  aws_account = account.AWSAccount(zone)
  assoc_id, profile = aws_account.ec2.GetInstanceProfileAttachment(instance_id)

  if not profile or not assoc_id:
    raise errors.ResourceNotFoundError(
        'Instance not found or does not have a profile attachment: {0:s}'.
          format(instance_id), __name__)

  logger.info('Removing profile attachment')
  aws_account.ec2.DisassociateInstanceProfile(assoc_id)

  if revoke_existing:
    logger.info('Invalidating old tokens')
    role_name = profile.split('/')[1]
    aws_account.iam.RevokeOldSessionsForRole(role_name)
Remove an instance profile attachment from an instance.

Also, optionally revoke existing issued tokens for the profile.

Args:
zone (str): AWS Availability Zone the instance is in.
instance_id (str): The id (i-xxxxxx) of the virtual machine.
revoke_existing (bool): True to revoke existing tokens for the profile's
role. False otherwise.

Raises:
ResourceNotFoundError: If the instance cannot be found, or does not have a
profile attachment.
libcloudforensics/providers/aws/forensics.py