Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Nuke – delete all resources associated with AWS account

github.com

Post reply on HN
Print view View original

91–100 of 124 posts

Re: AWS Nuke – delete all resources associated with AWS account

#91

Post by speedgoose »

TedDoesntTalk wrote: post #77
orf wrote: post #70

Earlier quoted context omitted.

Yes, in the service that provides the AWS resource. Because it didn’t handle the fact that the role it’s using might be deleted or otherwise rendered un-assumable for a variety of different reasons at any point in time. Which is a feature. Not a bug.

I’m curious how you see this as a feature when it can get you into a very expensive and unresolvable situation; a AWS resource can’t be deleted and is running up costs. You’re at the mercy of AWS support.

It can also be a security vulnerability if the resource that cannot be deleted is compromised and can access or contain critical data for example.

Re: AWS Nuke – delete all resources associated with AWS account

#92

Post by speedgoose »

bergenty wrote: post #87
TedDoesntTalk wrote: post #77

Earlier quoted context omitted.

I’m curious how you see this as a feature when it can get you into a very expensive and unresolvable situation; a AWS resource can’t be deleted and is running up costs. You’re at the mercy of AWS support.

It’s not a feature but how do you solve this? You can’t block role deletion because it has a resource associated with it, that would be a functional nightmare.

A very classic way of doing would be to prevent deleting a role that are resource tightly associated to it by default. If someone really wants to delete the role anyway, you can provide a feature to do that and delete associated ressources in cascade.

Re: AWS Nuke – delete all resources associated with AWS account

#93

Post by cube00 »

101008 wrote: post #61
Frajedo wrote: post #38

Earlier quoted context omitted.

We give each one of our developers their very own aws account managed through AWS organizations service. They are full administrators and responsible for resources and cost. So far we haven’t had any issues or bad surprises, although we have setup some aws billing alerts just in case. Feel free to make them responsible for cost and resources and you’ll be surprised how well they can manage their own account.

> Feel free to make them responsible for cost and resources and you’ll be surprised how well they can manage their own account. Wow, this is horrible. I understand responsability but this is too much. Are other employees responsible if the company loses money for their actions?

I suspect it's more the individuals would be warned and re-trained if they didn't keep their costs under control (usually it's done at the team level) rather then having actual financial responsibility.

Re: AWS Nuke – delete all resources associated with AWS account

#94

Post by GeorgeWBasic »

ezekiel11 wrote: post #36

so i have this weird monthly charge I cannot for the love of god find out what is causing it. I cancelled my credit card and now my credit score has taken a hit. All because some unknown AWS service that is in some zone that I cannot find at all and neither can AWS support.

That seems like the sort of thing chargebacks are intended to solve. Your credit shouldn't be taking a hit for that.

Re: AWS Nuke – delete all resources associated with AWS account

#95

Post by TedDoesntTalk »

speedgoose wrote: post #92
bergenty wrote: post #87

Earlier quoted context omitted.

It’s not a feature but how do you solve this? You can’t block role deletion because it has a resource associated with it, that would be a functional nightmare.

A very classic way of doing would be to prevent deleting a role that are resource tightly associated to it by default. If someone really wants to delete the role anyway, you can provide a feature to do that and delete associated ressources in cascade.

"Cascading deletes"

Re: AWS Nuke – delete all resources associated with AWS account

#96

Post by bergenty »

speedgoose wrote: post #92
bergenty wrote: post #87

Earlier quoted context omitted.

It’s not a feature but how do you solve this? You can’t block role deletion because it has a resource associated with it, that would be a functional nightmare.

A very classic way of doing would be to prevent deleting a role that are resource tightly associated to it by default. If someone really wants to delete the role anyway, you can provide a feature to do that and delete associated ressources in cascade.

It’s like you didn’t even read what I wrote. That way sucks, especially if you have hundreds of allocated resources. Cascade delete is not a realistic option here either. Imagine someone leaves the company without notice. All their resources need to be deleted?

Re: AWS Nuke – delete all resources associated with AWS account

#97

Post by speedgoose »

bergenty wrote: post #96
speedgoose wrote: post #92

Earlier quoted context omitted.

A very classic way of doing would be to prevent deleting a role that are resource tightly associated to it by default. If someone really wants to delete the role anyway, you can provide a feature to do that and delete associated ressources in cascade.

It’s like you didn’t even read what I wrote. That way sucks, especially if you have hundreds of allocated resources. Cascade delete is not a realistic option here either. Imagine someone leaves the company without notice. All their resources need to be deleted?

When someone leaves a company you look at their resources and assigned new people to them or delete them. But you should prefer teams and projects over individuals anyway.

Re: AWS Nuke – delete all resources associated with AWS account

#99

Post by dotancohen »

Marazan wrote: post #25
OJFord wrote: post #12

Earlier quoted context omitted.

That's a weird one, but surely an aws-nuke bug? It must already use a deliberate order - there's plenty of resources that need anything linked/constituent deleted first - so that order is/was just not correct for those?

No, Batch's interaction with IAM roles and permission is super weird and not at all documented. It is easy to screw it up.

I've never used AWS Batch but heard only good things about it. If you could elaborate - i.e. warn me - I would very much appreciate it. What should I know before using AWS Batch?

Re: AWS Nuke – delete all resources associated with AWS account

#100

Post by qwerty1793 »

Aeolun wrote: post #35
dhess wrote: post #32

Earlier quoted context omitted.

I'm in the process of doing this now. You can close accounts from Control Tower without needing to log in as root to each separate account, adding a credit card, removing it from the org, and then closing it manually. However, you can only close them from Control Tower at the rate of 2 to 3 per month, due to a hard limit quota which cannot be changed, even if you request it. Needless to say, this sucks when you've fo…

It seems to me this cannot possibly be a hard limit. If it’s a hard limit it’s only because AWS wants to milk you dry.

To be exact, the hard limit is: you cannot delete more than 10% of your organization's accounts (capped at 200) via AWS Organization within a 30 day rolling window. You can always delete an account by going into it as the root user.

https://docs.aws.amazon.com/organizations/latest/userguide/o...

Post reply on HN