IAM Role Removal Does Not Require Removal of Permission Boundary (#961)…

… (#1000)

[PR #961/e670b348 backport][stable-3] IAM Role Removal Does Not Require Removal of Permission Boundary

This is a backport of PR #961 as merged into main (e670b34).
SUMMARY

Removes unnecessary removal of permission boundary from a role when deleting a role. Unlike inline policies, permission boundaries do not need to be removed from an IAM role before deleting the IAM role. This behavior causes issues when a permission boundary is inherited that prevents removal of the permission boundary.
Fixes #959

ISSUE TYPE


Bugfix Pull Request

COMPONENT NAME
iam_role

changelogs/fragments/961-iam-role-should-not-remove-permission-boundary-before-deletion.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - iam_role - Removes unnecessary removal of permission boundary from a role when deleting a role. Unlike inline policies, permission boundaries do not need to be removed from an IAM role before deleting the IAM role. This behavior causes issues when a permission boundary is inherited that prevents removal of the permission boundary. (https://github.com/ansible-collections/community.aws/pull/961)

plugins/modules/iam_role.py

@@ -571,10 +571,8 @@ def destroy_role():
     # Before we try to delete the role we need to remove any
     # - attached instance profiles
     # - attached managed policies
-    # - permissions boundary
     remove_instance_profiles(role_params, role)
     update_managed_policies(role_params, role, [], True)
-    update_role_permissions_boundary(boundary_params, role)
 
     try:
         if not module.check_mode: