Function delete 

pub fn delete(r: &TaggedResource, dry_run: bool) -> DeleteOutcome

Attempt to delete a single resource. dry_run=true skips the actual call.

For IAM roles we first detach attached policies + delete inline policies, since AWS rejects delete-role if anything is still attached. Without this pre-step users hit cryptic “cannot delete entity because it is currently attached to 1 entities” errors and have to drop into the AWS console.