I would love a `terraform --nuke`. Not `destroy` - the opposite - destroy/nuke what I don't have in my config.
Oh that would be glorious. Not sure how it'd be possible though.
May be possible using driftctl and some API calls.
AWS Nuke – delete all resources associated with AWS account
31–40 of 124 posts
Re: AWS Nuke – delete all resources associated with AWS account
#32I've used aws-nuke a bunch but the use case seems significantly diminished now that AWS Organizations has the ability to delete entire accounts.
Last time I've checked it was a lengthy process involving attaching a credit card, leaving the organization and then deleting the account. Has it been changed?
I'm in the process of doing this now. You can close accounts from Control Tower without needing to log in as root to each separate account, adding a credit card, removing it from the org, and then closing it manually.
However, you can only close them from Control Tower at the rate of 2 to 3 per month, due to a hard limit quota which cannot be changed, even if you request it. Needless to say, this sucks when you've followed AWS's own best practices and created lots of accounts using Control Tower's "vending machine."
AWS's archaic account model is one reason we've switched to GCP.
Re: AWS Nuke – delete all resources associated with AWS account
#33Are Azure resource groups still pretty comprehensive? You use to be able to create all your stuff in a resource group. Delete the group and it deletes all the stuff with it. Super convenient.
Yeah they seem to be. Except Azure AD stuff, which kinda makes sense (still wish that part were more easily automated)
Re: AWS Nuke – delete all resources associated with AWS account
#34Earlier quoted context omitted.
That's a weird one, but surely an aws-nuke bug? It must already use a deliberate order - there's plenty of resources that need anything linked/constituent deleted first - so that order is/was just not correct for those?
No, Batch's interaction with IAM roles and permission is super weird and not at all documented. It is easy to screw it up.
Aws batch is a terrible product
Re: AWS Nuke – delete all resources associated with AWS account
#35Earlier quoted context omitted.
Last time I've checked it was a lengthy process involving attaching a credit card, leaving the organization and then deleting the account. Has it been changed?
I'm in the process of doing this now. You can close accounts from Control Tower without needing to log in as root to each separate account, adding a credit card, removing it from the org, and then closing it manually. However, you can only close them from Control Tower at the rate of 2 to 3 per month, due to a hard limit quota which cannot be changed, even if you request it. Needless to say, this sucks when you've fo…
It seems to me this cannot possibly be a hard limit. If it’s a hard limit it’s only because AWS wants to milk you dry.
Re: AWS Nuke – delete all resources associated with AWS account
#36so i have this weird monthly charge I cannot for the love of god find out what is causing it. I cancelled my credit card and now my credit score has taken a hit.
All because some unknown AWS service that is in some zone that I cannot find at all and neither can AWS support.
Re: AWS Nuke – delete all resources associated with AWS account
#3799% of our AWS resources are terraformed, but developers constantly push back / want to use the console to create stuff to test or play around with. So we setup a separate "hack" AWS account and give them admin access in there, and have an automated job using AWS Nuke to delete everything in there once a quarter.
Re: AWS Nuke – delete all resources associated with AWS account
#3899% of our AWS resources are terraformed, but developers constantly push back / want to use the console to create stuff to test or play around with. So we setup a separate "hack" AWS account and give them admin access in there, and have an automated job using AWS Nuke to delete everything in there once a quarter.
We give each one of our developers their very own aws account managed through AWS organizations service. They are full administrators and responsible for resources and cost.
So far we haven’t had any issues or bad surprises, although we have setup some aws billing alerts just in case.
Feel free to make them responsible for cost and resources and you’ll be surprised how well they can manage their own account.
Re: AWS Nuke – delete all resources associated with AWS account
#39Earlier quoted context omitted.
I'm in the process of doing this now. You can close accounts from Control Tower without needing to log in as root to each separate account, adding a credit card, removing it from the org, and then closing it manually. However, you can only close them from Control Tower at the rate of 2 to 3 per month, due to a hard limit quota which cannot be changed, even if you request it. Needless to say, this sucks when you've fo…
It seems to me this cannot possibly be a hard limit. If it’s a hard limit it’s only because AWS wants to milk you dry.
I suspect it’s a hard limit to prevent disgruntled (former) admin blast radius.
Re: AWS Nuke – delete all resources associated with AWS account
#4099% of our AWS resources are terraformed, but developers constantly push back / want to use the console to create stuff to test or play around with. So we setup a separate "hack" AWS account and give them admin access in there, and have an automated job using AWS Nuke to delete everything in there once a quarter.
We give each one of our developers their very own aws account managed through AWS organizations service. They are full administrators and responsible for resources and cost. So far we haven’t had any issues or bad surprises, although we have setup some aws billing alerts just in case. Feel free to make them responsible for cost and resources and you’ll be surprised how well they can manage their own account.
> We give each one of our developers their very own aws account managed through AWS organizations service. They are full administrators and responsible for resources and cost.
How many developers work at your organization?