Closed lvh closed 4 years ago
FWIW making id
be .*OrganizationAccountAccessRole.*
did not help.
The role with id OrganizationAccountAccessRole is deleted anyway.
Just to make sure that I understand what you want to achieve: You DON'T want to delete (ie keep) the IAM role with OrganizationAccountAccessRole
but delete all other IAM roles?
The semantics of
aws_iam_role:
- id: OrganizationAccountAccessRole
however, is to delete the resource aws_iam_role
wit id OrganizationAccountAccessRole
. The filter selects the resources that should be deleted not the resources that should be kept.
In your case, you might want to negate the regular expression to delete all roles except the one starting with string OrganizationAccountAccessRole
aws_iam_role:
- id: ^(?!OrganizationAccountAccessRole.*$).*
Duh, I definitely feel silly now :-) Yep, that worked.
Hi! I'm using awsweeper v0.3.2 (binary release off github) with the following config file:
The role with id
OrganizationAccountAccessRole
is deleted anyway. --dry-run showsOrganizationAccountAccessRole
as the id of the resource, so it's not like the problem is it's secretly using an ARN as the id or anything.