delete unused aws iam roles using aws cli

delete-unused-aws-iam-roles-using-aws-cli.sh

#!/bin/bash

aws iam list-roles --max-items 1000 | jq -r '.Roles[]|[.RoleName, .Arn, .CreateDate]|@csv' | grep -v -e '/aws-service-role/' -e '"AWSServiceRoleFor' -e '/aws-reserved/' | tr -d '"' | cut -d, -f1 | while read ROLE_NAME; do
    echo "$ROLE_NAME"
    aws iam get-role --role-name "$ROLE_NAME" | jq -r '.Role|.CreateDate, .RoleLastUsed.LastUsedDate // "UNUSED"'
done | paste -d, - - - | grep ",UNUSED$" | cut -d, -f1 | while read UNUSED_ROLE_NAME; do
    echo "$UNUSED_ROLE_NAME is unused"
    aws iam list-attached-role-policies --role-name "$UNUSED_ROLE_NAME" | jq -r '.AttachedPolicies[].PolicyArn' | while read ATTACHED_POLICY; do
        aws iam detach-role-policy --role-name "$UNUSED_ROLE_NAME" --policy-arn "$ATTACHED_POLICY"
    done
    aws iam list-instance-profiles-for-role --role-name "$UNUSED_ROLE_NAME" | jq -r '.InstanceProfiles[].InstanceProfileName' | while read INSTANCE_PROFILE; do
        aws iam remove-role-from-instance-profile --instance-profile-name "$INSTANCE_PROFILE" --role-name "$UNUSED_ROLE_NAME"
        aws iam delete-instance-profile --instance-profile-name "$INSTANCE_PROFILE"
    done
    aws iam delete-role --role-name "$UNUSED_ROLE_NAME"
done