Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Nuke – delete all resources associated with AWS account

github.com

Post reply on HN
Print view View original

41–50 of 124 posts

Re: AWS Nuke – delete all resources associated with AWS account

#41

Post by cure »

Frajedo wrote: post #38
arkadiyt wrote: post #37

99% of our AWS resources are terraformed, but developers constantly push back / want to use the console to create stuff to test or play around with. So we setup a separate "hack" AWS account and give them admin access in there, and have an automated job using AWS Nuke to delete everything in there once a quarter.

We give each one of our developers their very own aws account managed through AWS organizations service. They are full administrators and responsible for resources and cost. So far we haven’t had any issues or bad surprises, although we have setup some aws billing alerts just in case. Feel free to make them responsible for cost and resources and you’ll be surprised how well they can manage their own account.

> although we have setup some aws billing alerts just in case.

My experience with these has been decidedly mixed. As in, you define them and never, ever see an alert.

Re: AWS Nuke – delete all resources associated with AWS account

#43

Post by adamw2k »

Funny enough, on the completely opposite end of the spectrum, I was once surprised that after you close an account (post M&A in this case), you can typically restore the resources for ~90 days if you decide you want it back and don't nuke before you request the closure. Can be useful or scary depending on the contents of the account...

Re: AWS Nuke – delete all resources associated with AWS account

#44

Post by master_crab »

adamw2k wrote: post #43

Funny enough, on the completely opposite end of the spectrum, I was once surprised that after you close an account (post M&A in this case), you can typically restore the resources for ~90 days if you decide you want it back and don't nuke before you request the closure. Can be useful or scary depending on the contents of the account...

Yeah it’s actually a selling point in case a disgruntled employee or hacker gets credentials and asks for the account to be shutdown.

Re: AWS Nuke – delete all resources associated with AWS account

#45

Post by [deleted] »

cure wrote: post #41
Frajedo wrote: post #38

Earlier quoted context omitted.

We give each one of our developers their very own aws account managed through AWS organizations service. They are full administrators and responsible for resources and cost. So far we haven’t had any issues or bad surprises, although we have setup some aws billing alerts just in case. Feel free to make them responsible for cost and resources and you’ll be surprised how well they can manage their own account.

> although we have setup some aws billing alerts just in case. My experience with these has been decidedly mixed. As in, you define them and never, ever see an alert.

[deleted]

Re: AWS Nuke – delete all resources associated with AWS account

#46

Post by ___8___ »

ezekiel11 wrote: post #36

so i have this weird monthly charge I cannot for the love of god find out what is causing it. I cancelled my credit card and now my credit score has taken a hit. All because some unknown AWS service that is in some zone that I cannot find at all and neither can AWS support.

Is the charge the same every month?

Re: AWS Nuke – delete all resources associated with AWS account

#47

Post by jiggawatts »

orf wrote: post #11

Shout out to AWS batch, where if you delete the role assigned to a compute cluster the cluster itself becomes impossible to delete. Found this out after using AWS nuke

This is because neither AWS nor Azure use referential integrity in any of their "cloud scale" databases. For example, Azure uses some hideous JavaScript-based document DB where things like renames, moves, and deletes are hit & miss at best. A never-ending whack-a-mole of bugs and issues.

Remember boys and girls: Being "cloud scale" means data corruption and referential integrity violation!

Re: AWS Nuke – delete all resources associated with AWS account

#48

Post by orf »

jiggawatts wrote: post #47
orf wrote: post #11

Shout out to AWS batch, where if you delete the role assigned to a compute cluster the cluster itself becomes impossible to delete. Found this out after using AWS nuke

This is because neither AWS nor Azure use referential integrity in any of their "cloud scale" databases. For example, Azure uses some hideous JavaScript-based document DB where things like renames, moves, and deletes are hit & miss at best. A never-ending whack-a-mole of bugs and issues. Remember boys and girls: Being "cloud scale" means data corruption and referential integrity violation!

I don’t think it is - the issue is that the Batch service needs to assume your role in order to clean up associated cluster resources like auto scaling groups.

If the role is deleted, it can’t do this.

Re: AWS Nuke – delete all resources associated with AWS account

#50

Post by tpmx »

I noticed that this GCP article about Terraform best practices linked to a similar tool: cloud-nuke (https://github.com/gruntwork-io/cloud-nuke)

https://cloud.google.com/docs/terraform/best-practices-for-t...

> After you run the terraform destroy command, also run additional clean-up procedures to remove any resources that Terraform failed to destroy. Do this by deleting any projects used for test execution or by using a tool like cloud-nuke.

> Warning: Don't use such tools in a production environment.

It seems like this tool only supports AWS though, at least nowadays.

I kind of feel bad for the GCP people here. Damned if you do (link to an external project, which might change), damned if you don't.

Besides this thing, I really enjoyed reading this article though! AWS is missing this kind of content.

Post reply on HN