I have a number of stray permissions in a Drupal 8 site left over from role and permissions migrations from Drupal 7. By stray permission, I mean ones that were related to D7 contrib modules or content types that got removed or renamed during migration, but are still present in active config—even though they're not visible in Drupal UI's permissions matrix—and therefore are being exported to Yaml config files.
I thought maybe submitting the
/admin/people/permissions page would remove strays from active config, and then a
drush cex would then remove the permissions from the
user.role.<rolename>.yml files, but this is not the case.
So, is there another way to trim these down in active config to only what is currently configured in the Permissions matrix on Drupal's UI?
I've filed a related issue #2953111 to prevent migration of permissions from modules that don't exist in Drupal 8 but am really looking for a quick way to delete these strays without a very manual verification process one-by-one through each role's Yaml file.