{"action":"opened","issue":{"url":"https://api.github.com/repos/boto/boto3/issues/852","repository_url":"https://api.github.com/repos/boto/boto3","labels_url":"https://api.github.com/repos/boto/boto3/issues/852/labels{/name}","comments_url":"https://api.github.com/repos/boto/boto3/issues/852/comments","events_url":"https://api.github.com/repos/boto/boto3/issues/852/events","html_url":"https://github.com/boto/boto3/issues/852","id":183054705,"number":852,"title":"Docs for IAM Role collections: policies vs attached_policies","user":{"login":"FrancescoRizzi","id":732486,"avatar_url":"https://avatars.githubusercontent.com/u/732486?v=3","gravatar_id":"","url":"https://api.github.com/users/FrancescoRizzi","html_url":"https://github.com/FrancescoRizzi","followers_url":"https://api.github.com/users/FrancescoRizzi/followers","following_url":"https://api.github.com/users/FrancescoRizzi/following{/other_user}","gists_url":"https://api.github.com/users/FrancescoRizzi/gists{/gist_id}","starred_url":"https://api.github.com/users/FrancescoRizzi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/FrancescoRizzi/subscriptions","organizations_url":"https://api.github.com/users/FrancescoRizzi/orgs","repos_url":"https://api.github.com/users/FrancescoRizzi/repos","events_url":"https://api.github.com/users/FrancescoRizzi/events{/privacy}","received_events_url":"https://api.github.com/users/FrancescoRizzi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-10-14T13:49:14Z","updated_at":"2016-10-14T13:49:14Z","closed_at":null,"body":"After durdling around a bit I _think_ I understand this, and may recommend an improvement to the documentation... \r\n\r\n**Doc Change 1:**\r\nThe [documentation for the IAM Role collection attached_policies](https://boto3.readthedocs.io/en/latest/reference/services/iam.html#IAM.Role.attached_policies) should read:\r\n\r\n> A list of managed policies attached to the role.\r\n\r\nwording from [AWS IAM REST API doc for RoleDetails, AttachedManagedPolicies.member.N](http://docs.aws.amazon.com/IAM/latest/APIReference/API_RoleDetail.html).\r\n\r\nInstead of:\r\n\r\n> A collection of Policy resources\r\n\r\n**Doc Change 2:**\r\nThe [documentation for the IAM Role collection policies](https://boto3.readthedocs.io/en/latest/reference/services/iam.html#IAM.Role.policies) should read:\r\n\r\n> A list of inline policies embedded in the role.\r\n\r\nwording from [AWS IAM REST API doc for RoleDetails, RolePolicyList.member.N](http://docs.aws.amazon.com/IAM/latest/APIReference/API_RoleDetail.html).\r\n\r\nInstead of:\r\n\r\n> A collection of RolePolicy resources\r\n\r\n**Motivation:**\r\nThese changes may help someone (like me) who is looking for ways to (for instance) delete an IAM Role, which, it turns out:\r\n\r\n* requires you to delete/detach the Role Policies first, which, it turns out:\r\n* is done differently for _inline_ policies (see [IAM Client delete_role_policy](https://boto3.readthedocs.io/en/latest/reference/services/iam.html#IAM.Client.delete_role_policy) ) and _managed_ policies (see [IAM Client detach_role_policy](https://boto3.readthedocs.io/en/latest/reference/services/iam.html#IAM.Client.detach_role_policy) ), which, it turns out:\r\n* requires you to get a list of the policies first, which you might get via [ListRolePolicies Paginator](https://boto3.readthedocs.io/en/latest/reference/services/iam.html#IAM.Paginator.ListRolePolicies) (yay!), which, it turns out:\r\n* A) returns a list of Policy Names (whereas the delete_role_policy and detach_role_policy APis require the Policy ARNs) (_sad_panda_), and\r\n* B) does not expose a way to distinguish between inline and managed policies, which, it turns out:\r\n* B1) is not exposed by [the RolePolicy resource](https://boto3.readthedocs.io/en/latest/reference/services/iam.html#rolepolicy) (_sadder_panda_), and\r\n* B2) is not exposed by [IAM Client get_role_policy](https://boto3.readthedocs.io/en/latest/reference/services/iam.html#IAM.Client.get_role_policy) either (_raging_panda_)\r\n\r\n"}}
{"actor":{"display_login":"FrancescoRizzi"}}