Using service-linked roles for cleanup

To edit the description of a service-linked role (console)

1. In the navigation pane of the IAM console, choose Roles.

2. Choose the name of the role to modify.

3. To the right of the Role description, choose Edit.

4. Enter a new description in the box and choose Save changes.

To change the description of a service-linked role (CLI)

1. (Optional) To view the current description for a role, use the following commands:

   $ aws iam get-role --role-name role-name

   Use the role name, not the ARN, to refer to roles with the CLI commands. For example, if a role has the following ARN: arn:aws-cn:iam::123456789012:role/myrole, you refer to the role as myrole.

2. To update a service-linked role's description, use one of the following commands:

   $ aws iam update-role-description --role-name role-name --description description

To change the description of a service-linked role (API)

1. (Optional) To view the current description for a role, use the following command:

   IAM API: GetRole

2. To update a role's description, use the following command:

   IAM API: UpdateRoleDescription

To check whether the service-linked role has an active session in the IAM console

1. Open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Roles. Select the name (not the check box) of the AWSServiceRoleForEMRCleanup service-linked role.

3. On the Summary page for the selected service-linked role, choose Access Advisor.

4. On the Access Advisor tab, review the recent activity for the service-linked role.

   Note

   If you are unsure whether Amazon EMR is using the AWSServiceRoleForEMRCleanup service-linked role, you can try to delete the service-linked role. If the service is using the service-linked role, then the deletion fails and you can view the Regions where the service-linked role is being used. If the service-linked role is being used, then you must wait for the session to end before you can delete the service-linked role. You cannot revoke the session for a service-linked role.

To remove Amazon EMR resources used by the AWSServiceRoleForEMRCleanup

• Terminate all clusters in your account. For more information, see Terminate a cluster.

To delete a service-linked role (console)

1. Open the IAM console at https://console.amazonaws.cn/iam/.

2. In the navigation pane, choose Roles. Select the check box next to AWSServiceRoleForEMRCleanup, not the name or row itself.

3. For Role actions at the top of the page, choose Delete role.

4. In the confirmation dialog box, review the service last accessed data, which shows when each of the selected roles last accessed an Amazon service. This helps you to confirm whether the role is currently active. To proceed, choose Yes, Delete.

5. Watch the IAM console notifications to monitor the progress of the service-linked role deletion. Because the IAM service-linked role deletion is asynchronous, after you submit the service-linked role for deletion, the deletion task can succeed or fail. If the task fails, you can choose View details or View Resources from the notifications to learn why the deletion failed. If the deletion fails because there are resources in the service that are being used by the role, then the reason for the failure includes a list of resources.

To delete a service-linked role (CLI)

1. To check the status of the deletion task, you must capture the deletion-task-id from the response. Type the following command to submit a service-linked role deletion request:

   $ aws iam delete-service-linked-role --role-name AWSServiceRoleForEMRCleanup

2. Type the following command to check the status of the deletion task:

   $ aws iam get-service-linked-role-deletion-status --deletion-task-id deletion-task-id

   The status of the deletion task can be NOT_STARTED, IN_PROGRESS, SUCCEEDED, or FAILED. If the deletion fails, the call returns the reason that it failed so that you can troubleshoot.

To delete a service-linked role (API)

1. To submit a deletion request for a service-linked role, call DeleteServiceLinkedRole. In the request, specify the AWSServiceRoleForEMRCleanup role name.

   To check the status of the deletion task, you must capture the DeletionTaskId from the response.

2. To check the status of the deletion, call GetServiceLinkedRoleDeletionStatus. In the request, specify the DeletionTaskId.

   The status of the deletion task can be NOT_STARTED, IN_PROGRESS, SUCCEEDED, or FAILED. If the deletion fails, the call returns the reason that it failed so that you can troubleshoot.