Delete an old IAM policy version

Part 102 of AWS from Zero. This lesson changes or inspects one IAM concept so the permission model stays understandable.

What we are learning

IAM does not allow deletion of the current default version. Old versions can be removed to stay within the version limit.

POLICY_ARN="arn:aws:iam::123456789012:policy/AwsZeroListBuckets"
OLD_VERSION="v1"

Confirm the selected version is non-default and preserve its document if your change process requires an audit artifact.

aws iam delete-policy-version \
  --policy-arn "$POLICY_ARN" \
  --version-id "$OLD_VERSION"

IAM writes can take a short time to propagate. Inspect the resource after every change.

aws iam list-policy-versions \
  --policy-arn "$POLICY_ARN" \
  --query "Versions[].{ID:VersionId,Default:IsDefaultVersion}" \
  --output table

Read the returned ARN, path, IDs, and attachment state instead of checking only the command exit code.

aws iam get-policy-version \
  --policy-arn "$POLICY_ARN" \
  --version-id "$OLD_VERSION"

Before deletion, retrieve the exact document one final time.

Never automate deletion by assuming v1 is oldest and safe. Check IsDefaultVersion, creation time, and rollback policy.

# This lesson is read-only or reuses a named demo identity.
aws sts get-caller-identity

Keep shared demo identities only while following the IAM sequence. Part 125 removes them in dependency order.

Next, we will learn Create and remove an inline IAM user policy.