delete_eks_oidc_providers.sh

#!/bin/bash

# Deletes all open-id-connect-providers that are NOT used by EKS instances...

${TRACE:+set -x}

if ! command -v aws &>/dev/null; then
  echo "awscli is not installed. Please install it and re-run this script."
  exit 1
fi

function is-oidc-provider-free() {
  host=${1:?'must priovide host'}

  found=false
  for cluster in $(aws eks list-clusters | jq -r .clusters[]); do
    issuer=$(aws eks describe-cluster --name ${cluster} | jq -r .cluster.identity.oidc.issuer)

    # get the issuer
    if [[ "https://${host}" == "${issuer}" ]]; then
      echo "provider ${host} is used by cluster ${cluster}"
      return 1
    fi
  done
  return 0
}

# list oidc providers
for provider_arn in $(aws iam list-open-id-connect-providers | jq -r .OpenIDConnectProviderList[].Arn); do
  host=$(aws iam get-open-id-connect-provider --open-id-connect-provider-arn ${provider_arn} | jq -r .Url)

  if ! is-oidc-provider-free ${host}; then
    echo "leaving ${provider_arn}"
  else
    echo "deleting ${provider_arn}"
    aws iam delete-open-id-connect-provider --open-id-connect-provider-arn ${provider_arn}
  fi
done