# Hard to maintain idempotentcy with iam and iam\_policy modules

**URL:** <https://forum.ansible.com/t/hard-to-maintain-idempotentcy-with-iam-and-iam-policy-modules/19280>\
**Category:** Ansible Developer\
**Created:** [September 17, 2015, 12:42am UTC](https://forum.ansible.com/t/hard-to-maintain-idempotentcy-with-iam-and-iam-policy-modules/19280 "2015-09-17T00:42:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Rob\_White](https://avatars.discourse-cdn.com/v4/letter/r/71c47a/32.png) [@Rob\_White](https://forum.ansible.com/u/Rob_White)\
**Post date:** [September 17, 2015, 12:42am UTC](https://forum.ansible.com/t/hard-to-maintain-idempotentcy-with-iam-and-iam-policy-modules/19280/1 "2015-09-17T00:42:21Z")

</div>

Hi all,

I’ve noticed a bit of an issue with maintaining idempotency with iam and iam\_policy modules.

Consider the following:

- name: IAM policy

iam\_policy:

iam\_type: role

iam\_name: myrole

policy\_name: mypolicy

state: absent

- name: IAM role

iam:

iam\_type: role

name: myrole

state: absent

If i run this playbook then it works correctly - the policy is removed, followed by the role.

However, if i now rerun this playbook then the iam\_policy will now fail with “The role with name myrole cannot be found.”

If I just leave out the iam\_policy call then i can never delete the role because it will fail with “Cannot delete entity, must delete policies first.”

So, best way to solve?

I’ve come up with 2 ways…

1. Modify iam\_policy - Consider that if the role is not available when iam\_policy looks it up then it is safe to assume that the policy is absent so rather than failing we just exit

2. Modify iam - Add a parameter to iam to remove any attached policy before the role removal is attempted

I would certainly lean towards (1) but i open up the floor…

---

<div class="post-metadata">

**Author:** ![Jonathan\_Davila](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jonathan\_Davila](https://forum.ansible.com/u/Jonathan_Davila)\
**Post date:** [September 21, 2015, 12:13pm UTC](https://forum.ansible.com/t/hard-to-maintain-idempotentcy-with-iam-and-iam-policy-modules/19280/2 "2015-09-21T12:13:12Z")

</div>

Thanks for this. I also lean towards option #1. Are you able to open a PR? If not, then I can submit a patch sometime this week.