search

ministryofjustice / analytics-platform

Parent repository for the MOJ Analytics Platform
MIT License
14 stars 1 forks source link

Cannot delete users #33

Closed RobinL closed 6 years ago

RobinL commented 6 years ago

Following recent changes to IAM permissions, the 'Delete user' button now throws an error and doesn't delete the user:

image

Internal Error
500 - {“detail”:“An error occurred (DeleteConflict) when calling the DeleteRole operation: Cannot delete entity, must delete policies first.“}
xoen commented 6 years ago

I did some digging on this and I conclude it's really weird and it shouldn't happen.

I know we detach policies before actually deleting IAM roles but I had another look if there was a regression.

According to Git we didn't change delete_role()/_detach_role_policies() in months.

I also manually tried locally and the _detach_role_policies() actually detaches the policies.

Also, I didn't find this error in Sentry the CP-API, only in the CP-UI.

Does it happen all the time or only sometimes? I wonder if it's some strange race condition caused by AWS detaching those policies asynchronously.

xoen commented 6 years ago

Right, I managed to reproduce locally. My best guess at this time is that it's complaining about the inline policies, mainly s3-access but potentially others.

xoen commented 6 years ago

Ticket with more details, possible solution, etc...https://trello.com/c/04FsXha3/984-cant-delete-users

andyhd commented 6 years ago

@xoen is this issue fixed?

xoen commented 6 years ago

@andyhd I think it is. I think I was waiting for Robin to test that but I see the ticket was moved so let's close this.