Teardown — AWS Bedrock Agent on Azure Container Apps (AI-Led)

Reverses the deploy-agent-aca-aws skill. Deletes Azure resources, the AWS IAM role and OIDC provider, and (opt-in) the Entra objects created along the way.

Paired with: deploy-agent-aca-aws. Uses the same /tmp/deploy-vars.sh produced by that skill.

When to Use

• User says: "tear down the AWS ACA deployment", "delete the Azure resources for the AWS sample", "clean up after the demo"
• User wants to re-run the deploy skill from a clean state
• User is ending a demo and needs to remove billable resources

Do NOT Use When

• Local dev — sidecar/dev/ runs in docker-compose; docker compose down -v is enough
• Shared / long-lived tenants — do not run this against a tenant where other teams may own the Blueprint or Client SPA. Confirm ownership with the user first.
• Hardened / long-lived deployments — this skill assumes a throwaway demo deployment.

Safety posture

This skill is destructive. To prevent accidents:

1. Dry-run by default. Every script defaults to DRY_RUN=1 — it prints the commands it would run and exits. The user must explicitly set DRY_RUN=0 to actually delete.
2. Entra and AWS objects are opt-in. Default behavior deletes only the Azure resource group. Entra apps (Agent Identity, Blueprint, Client SPA, Intermediary) and AWS objects (IAM role, OIDC provider) are preserved unless the user sets DELETE_ENTRA=1 or DELETE_AWS=1.
3. Confirm the tenant + subscription + resource group with the user before running anything. The user has multiple Azure accounts (see user memory).
4. Never auto-delete Blueprints — Blueprints may be shared across agents. If DELETE_ENTRA=1, ask the user one more time: "Delete Blueprint <id>? y/N".

Prerequisites

• /tmp/deploy-vars.sh from the original deployment (contains RG, STS_APP_ID, AWS_ROLE_NAME, AWS_ACCOUNT_ID, TENANT_ID, etc.). If missing, reconstruct the minimum set with the user (at least SUBSCRIPTION_ID, RG).
• az logged in to the same tenant and subscription that owns the RG.
• aws configured for the same account that owns the role (only if DELETE_AWS=1).
• Graph role sufficient to delete Entra apps (only if DELETE_ENTRA=1): Application Administrator or higher.

Procedure

Step 0 — Confirm scope with the user

Print the current settings and wait for explicit confirmation:

Teardown plan (AWS):
  Subscription:  $SUBSCRIPTION_ID
  Resource group: $RG            (WILL be deleted)
  Delete AWS IAM role + OIDC:  $DELETE_AWS
  Delete Entra objects:         $DELETE_ENTRA
  Dry run:                      $DRY_RUN
Proceed? [y/N]

Do not proceed without a y.

Step 1 — Revoke OAuth consent grants on the Agent SP (optional but recommended)

If the Agent Identity (AGENT_CLIENT_ID) will be kept, revoke the Graph OAuth2 consent so a future redeploy starts from a clean state:

AGENT_SP_OID=$(az ad sp show --id "$AGENT_CLIENT_ID" --query id -o tsv 2>/dev/null)
if [[ -n "$AGENT_SP_OID" ]]; then
  az rest --method GET \
    --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants?\$filter=clientId eq '$AGENT_SP_OID'" \
    --query 'value[].id' -o tsv | while read -r g; do
      az rest --method DELETE --uri "https://graph.microsoft.com/v1.0/oauth2PermissionGrants/$g"
  done
fi

This is idempotent — if the SP or the grants are gone already, it no-ops.

Step 2 — Delete the Azure resource group

This removes the Container App, ACA environment, ACR (with all images), Log Analytics workspace, and the user-assigned managed identity in one shot:

az group delete --name "$RG" --yes --no-wait

Note: FICs on the Blueprint and Intermediary Entra apps that point at the deleted MI's object ID become orphaned but inert. They are cleaned up in Step 4 if DELETE_ENTRA=1, or can be left in place — they cannot be re-used since the MI they reference no longer exists.

Step 3 — Delete AWS objects (opt-in: DELETE_AWS=1)

aws iam delete-role-policy --role-name "$AWS_ROLE_NAME" --policy-name BedrockInvokeOnly 2>/dev/null || true
aws iam delete-role --role-name "$AWS_ROLE_NAME" 2>/dev/null || true
aws iam delete-open-id-connect-provider \
  --open-id-connect-provider-arn "arn:aws:iam::${AWS_ACCOUNT_ID}:oidc-provider/sts.windows.net/${TENANT_ID}/" 2>/dev/null || true

Step 4 — Delete Entra objects (opt-in: DELETE_ENTRA=1)

Ask the user once more per object. Delete in this order to avoid broken references:

1. Intermediary app (STS_APP_ID) — safe to delete, created purely for AWS federation.
2. Client SPA (CLIENT_SPA_APP_ID) — safe if no other agent reuses it.
3. Agent Identity — delete via Agent ID portal or Graph (DELETE /agentIdentities/{id}).
4. Blueprint (BLUEPRINT_APP_ID) — ASK AGAIN. Blueprints are often shared.

az ad app delete --id "$STS_APP_ID" 2>/dev/null || true
az ad app delete --id "$CLIENT_SPA_APP_ID" 2>/dev/null || true
# Agent + Blueprint: prompt explicitly, then call Graph

Step 5 — Verify

az group exists --name "$RG"                                          # expect: false
aws iam get-role --role-name "$AWS_ROLE_NAME" 2>&1 | head -1          # expect: NoSuchEntity (if DELETE_AWS=1)
az ad app show --id "$STS_APP_ID" 2>&1 | head -1                      # expect: not found (if DELETE_ENTRA=1)

Orchestrator

The single-entry-point script is scripts/teardown-aca-aws.sh. It reads /tmp/deploy-vars.sh, enforces dry-run by default, prompts at every destructive boundary, and executes steps 1–5 in order.

# Dry run (default)
bash .claude/skills/teardown-agent-aca-aws/scripts/teardown-aca-aws.sh

# Real teardown, Azure only
DRY_RUN=0 bash .claude/skills/teardown-agent-aca-aws/scripts/teardown-aca-aws.sh

# Full teardown
DRY_RUN=0 DELETE_AWS=1 DELETE_ENTRA=1 \
  bash .claude/skills/teardown-agent-aca-aws/scripts/teardown-aca-aws.sh

Common failure modes

References

• Azure — delete resource group
• AWS IAM — delete OIDC identity provider
• Microsoft Graph — oauth2PermissionGrants