Offboarding and resource decommissioning (optional)

To decommission all manually created resources, remove them in the reverse order that they were created (Step 2.7 → Step 2.1):

# 1. (Reverses Step 2.7) Delete scanner role (optional — only if outpost scanning was configured)
aws iam detach-role-policy --role-name "${SCANNER_ROLE_NAME}" \
  --policy-arn "arn:aws:iam::aws:policy/ReadOnlyAccess"
aws iam detach-role-policy --role-name "${SCANNER_ROLE_NAME}" \
  --policy-arn "arn:aws:iam::aws:policy/SecurityAudit"
aws iam delete-role --role-name "${SCANNER_ROLE_NAME}"

# 2. (Reverses Step 2.6) Delete inline policy from logs ingestion role
aws iam delete-role-policy \
  --role-name "${LOGS_ROLE_NAME}" \
  --policy-name "CloudTrailReadAccessPolicy"

# 3. (Reverses Step 2.6) Delete logs ingestion role
aws iam delete-role --role-name "${LOGS_ROLE_NAME}"

# 4. (Reverses Step 2.5) Unsubscribe SQS from SNS (find subscription ARN first)
SUBSCRIPTION_ARN=$(aws sns list-subscriptions-by-topic \
  --topic-arn "${CLOUDTRAIL_SNS_ARN}" \
  --query "Subscriptions[?Endpoint=='${SQS_QUEUE_ARN}'].SubscriptionArn" \
  --output text)
aws sns unsubscribe --subscription-arn "${SUBSCRIPTION_ARN}"

# 5. (Reverses Step 2.4) Delete SQS queue policy (reset to default — no explicit policy)
aws sqs set-queue-attributes \
  --queue-url "${SQS_QUEUE_URL}" \
  --attributes '{"Policy":""}'

# 6. (Reverses Step 2.3) Delete SQS queue
aws sqs delete-queue --queue-url "${SQS_QUEUE_URL}"

# 7. (Reverses Step 2.2) Detach managed policies from platform role
aws iam detach-role-policy --role-name "${CORTEX_ROLE_NAME}" \
  --policy-arn "arn:aws:iam::aws:policy/ReadOnlyAccess"
aws iam detach-role-policy --role-name "${CORTEX_ROLE_NAME}" \
  --policy-arn "arn:aws:iam::aws:policy/AmazonMemoryDBReadOnlyAccess"
aws iam detach-role-policy --role-name "${CORTEX_ROLE_NAME}" \
  --policy-arn "arn:aws:iam::aws:policy/SecurityAudit"
aws iam detach-role-policy --role-name "${CORTEX_ROLE_NAME}" \
  --policy-arn "arn:aws:iam::aws:policy/AmazonSQSReadOnlyAccess"
aws iam detach-role-policy --role-name "${CORTEX_ROLE_NAME}" \
  --policy-arn "arn:aws:iam::aws:policy/AWSOrganizationsReadOnlyAccess"
aws iam detach-role-policy --role-name "${CORTEX_ROLE_NAME}" \
  --policy-arn "${DISCOVERY_POLICY_ARN}"

# 8. (Reverses Step 2.2) Delete platform role
aws iam delete-role --role-name "${CORTEX_ROLE_NAME}"

# 9. (Reverses Step 2.1) Delete custom discovery policy
aws iam delete-policy --policy-arn "${DISCOVERY_POLICY_ARN}"