Filter IAM roles and policy attachments related to SSO (#1028)

rebuy-de · Jun 20, 2023 · 58e4627 · 58e4627
1 parent fb4e27a
commit 58e4627
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/resources/iam-role-policy-attachments.go b/resources/iam-role-policy-attachments.go
@@ -82,6 +82,9 @@ func (e *IAMRolePolicyAttachment) Filter() error {
 	if strings.Contains(e.policyArn, ":iam::aws:policy/aws-service-role/") {
 		return fmt.Errorf("cannot detach from service roles")
 	}
+	if strings.HasPrefix(*e.role.Path, "/aws-reserved/sso.amazonaws.com/") {
+		return fmt.Errorf("cannot detach from SSO roles")
+	}
 	return nil
 }
 

diff --git a/resources/iam-roles.go b/resources/iam-roles.go
@@ -73,6 +73,9 @@ func (e *IAMRole) Filter() error {
 	if strings.HasPrefix(e.path, "/aws-service-role/") {
 		return fmt.Errorf("cannot delete service roles")
 	}
+	if strings.HasPrefix(e.path, "/aws-reserved/sso.amazonaws.com/") {
+		return fmt.Errorf("cannot delete SSO roles")
+	}
 	return nil
 }