maintenance/aws-janitor/resources/iam_roles.go
func roleIsManaged(role *iam.Role) bool {
	name := aws.StringValue(role.RoleName)
	path := aws.StringValue(role.Path)

	// Most AWS system roles are in a directory called `aws-service-role`
	if strings.HasPrefix(path, "/aws-service-role/") {
		return false
	}

	// kops roles have names start with `masters.` or `nodes.`
	if strings.HasPrefix(name, "masters.") || strings.HasPrefix(name, "nodes.") {
		return true
	}

	klog.Infof("Unknown role name=%q, path=%q; assuming not managed", name, path)
	return false
}
func roleIsManaged(role *iam.Role) bool {
	name := aws.StringValue(role.RoleName)
	path := aws.StringValue(role.Path)

	// Most AWS system roles are in a directory called `aws-service-role`
	if strings.HasPrefix(path, "/aws-service-role/") {
		return false
	}

	// kops roles have names start with `masters.` or `nodes.`
	if strings.HasPrefix(name, "masters.") || strings.HasPrefix(name, "nodes.") {
		return true
	}

	klog.Infof("Unknown role name=%q, path=%q; assuming not managed", name, path)
	return false
}
// roleIsManaged checks if the role should be managed (and thus deleted) by us
// In particular, we want to avoid "system" AWS roles or roles that might support test-infra