Skip to content

Commit 91a9a9e

Browse files
ekristenekristen
committed
switch for settings and config package from libnuke, improve docs (ekristen#28)
* switch for settings and config package from libnuke, improve docs * fix: tests * fix: do not upload to codeconv yet
1 parent 2846b46 commit 91a9a9e

File tree

428 files changed

+1387
-1034
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

428 files changed

+1387
-1034
lines changed

‎.github/workflows/tests.yml

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,13 @@
11
name: tests
2+
23
on:
4+
push:
5+
branches:
6+
- main
37
pull_request:
48
branches:
59
- main
10+
611
jobs:
712
test:
813
name: test
@@ -11,10 +16,10 @@ jobs:
1116
- uses: actions/checkout@v4
1217
- uses: actions/setup-go@v5
1318
with:
14-
go-version: 1.21.x
19+
go-version: '1.21.x'
1520
- name: download go mods
1621
run: |
1722
go mod download
1823
- name: run go tests
1924
run: |
20-
go test -timeout 60s -run ./...
25+
go test -timeout 60s -race -coverprofile=coverage.txt -covermode=atomic ./...

‎.golangci.yaml

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
linters-settings:
2+
dupl:
3+
threshold: 100
4+
funlen:
5+
lines: 100
6+
statements: 50
7+
goconst:
8+
min-len: 2
9+
min-occurrences: 3
10+
gocritic:
11+
enabled-tags:
12+
- diagnostic
13+
- experimental
14+
- opinionated
15+
- performance
16+
- style
17+
disabled-checks:
18+
- dupImport # https://github.com/go-critic/go-critic/issues/845
19+
- ifElseChain
20+
- octalLiteral
21+
- whyNoLint
22+
gocyclo:
23+
min-complexity: 15
24+
golint:
25+
min-confidence: 0
26+
lll:
27+
line-length: 140
28+
maligned:
29+
suggest-new: true
30+
misspell:
31+
locale: US
32+
33+
linters:
34+
# please, do not use `enable-all`: it's deprecated and will be removed soon.
35+
# inverted configuration with `enable-all` and `disable` is not scalable during updates of golangci-lint
36+
disable-all: true
37+
enable:
38+
- bodyclose
39+
- dogsled
40+
- errcheck
41+
- exportloopref
42+
- funlen
43+
- goconst
44+
- gocritic
45+
- gocyclo
46+
- gofmt
47+
- goimports
48+
- goprintffuncname
49+
- gosec
50+
- gosimple
51+
- govet
52+
- ineffassign
53+
- lll
54+
- misspell
55+
- nakedret
56+
- nilnil
57+
- noctx
58+
- nolintlint
59+
- staticcheck
60+
- stylecheck
61+
- typecheck
62+
- unconvert
63+
- unparam
64+
- unused
65+
- whitespace
66+
67+
issues:
68+
exclude-rules:
69+
- path: _test\.go
70+
linters:
71+
- funlen
72+
73+
run:
74+
timeout: 2m

‎docs/custom-endpoints.md renamed to ‎docs/config-custom-endpoints.md

File renamed without changes.

‎docs/filtering.md renamed to ‎docs/config-filtering.md

File renamed without changes.

‎docs/config-migration.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Configuration Migration
2+
3+
## Version 2.x to 3.x
4+
5+
The configuration file format has changed from version 2.x to 3.x. However, it is still 100% backward compatible with
6+
the old format. The new format is more flexible and allows for more complex configurations.
7+
8+
### Changes
9+
10+
- The `targets` key has been deprecated in favor of `includes`.
11+
- The `feature-flags` key has been deprecated in favor of `settings`.
12+
13+
### Migration
14+
15+
The migration for `targets` is very simply, simply rename the key to `includes`
16+
17+
```yaml
18+
resource-types:
19+
targets:
20+
- S3Object
21+
- S3Bucket
22+
- IAMRole
23+
```
24+
25+
Becomes
26+
27+
```yaml
28+
resource-types:
29+
includes:
30+
- S3Object
31+
- S3Bucket
32+
- IAMRole
33+
```
34+
35+
The migration for `feature-flags` takes a little more than renaming the key. The `settings` key is now used to map
36+
settings to a specific resource and that resource's definition within the tool announces the need for a setting.
37+
38+
```yaml
39+
feature-flags:
40+
disable-deletion-protection:
41+
RDSInstance: true
42+
EC2Instance: true
43+
```
44+
45+
Becomes
46+
47+
```yaml
48+
settings:
49+
EC2Instance:
50+
DisableDeletionProtection: true
51+
RDSInstance:
52+
DisableDeletionProtection: true
53+
```

‎docs/config-presets.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Presets
2+
3+
It might be the case that some filters are the same across multiple accounts. This especially could happen, if
4+
provisioning tools like Terraform are used or if IAM resources follow the same pattern.
5+
6+
For this case *aws-nuke* supports presets of filters, that can applied on multiple accounts.
7+
8+
`Presets` are defined globally. They can then be referenced in the `accounts` section of the configuration.
9+
10+
A preset configuration could look like this:
11+
12+
```yaml
13+
presets:
14+
common:
15+
filters:
16+
IAMAccountSettingPasswordPolicy:
17+
- custom
18+
IAMRole:
19+
- "OrganizationAccountAccessRole"
20+
```
21+
22+
An account referencing a preset would then look something like this:
23+
24+
```yaml
25+
accounts:
26+
1234567890:
27+
presets:
28+
- common
29+
```
30+
31+
Putting it all together it would look something like this:
32+
33+
```yaml
34+
blocklist:
35+
- 0012345678
36+
37+
regions:
38+
- global
39+
- us-east-1
40+
41+
accounts:
42+
1234567890:
43+
presets:
44+
- common
45+
46+
presets:
47+
common:
48+
filters:
49+
IAMAccountSettingPasswordPolicy:
50+
- custom
51+
IAMRole:
52+
- OrganizationAccountAccessRole
53+
```

‎docs/config.md

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
# Config
2+
3+
The configuration is the user supplied configuration that is used to drive the nuke process. The configuration is a YAML file that is loaded from the path specified by the --config flag.
4+
5+
## Sections
6+
7+
The configuration is broken down into the following sections:
8+
9+
- [blocklist](#blocklist)
10+
- [regions](#regions)
11+
- [accounts](#accounts)
12+
- [presets](#presets)
13+
- [filters](#filters)
14+
- [resource-types](#resource-types)
15+
- [includes](#includes)
16+
- [excludes](#excludes)
17+
- [cloud-control](#cloud-control)
18+
- targets (deprecated, use includes)
19+
- [resource-types](#resource-types)
20+
- [includes](#includes)
21+
- [excludes](#excludes)
22+
- [cloud-control](#cloud-control)
23+
- targets (deprecated, use includes)
24+
- [feature-flags](#feature-flags) (deprecated, use settings instead)
25+
- [settings](#settings)
26+
- [presets](#global-presets)
27+
28+
## Simple Example
29+
30+
```yaml
31+
blocklist:
32+
- 1234567890
33+
34+
regions:
35+
- global
36+
- us-east-1
37+
38+
accounts:
39+
0987654321:
40+
filters:
41+
IAMUser:
42+
- "admin"
43+
IAMUserPolicyAttachment:
44+
- "admin -> AdministratorAccess"
45+
IAMUserAccessKey:
46+
- "admin -> AKSDAFRETERSDF"
47+
- "admin -> AFGDSGRTEWSFEY"
48+
49+
resource-types:
50+
includes:
51+
- IAMUser
52+
- IAMUserPolicyAttachment
53+
- IAMUserAccessKey
54+
55+
settings:
56+
EC2Instance:
57+
DisableDeletionProtection: true
58+
RDSInstance:
59+
DisableDeletionProtection: true
60+
```
61+
62+
## Blocklist
63+
64+
The blocklist is simply a list of Accounts that the tool cannot run against. This is to protect the user from accidentally
65+
running the tool against the wrong account. The blocklist must always be populated with at least one entry.
66+
67+
## Regions
68+
69+
The regions is a list of AWS regions that the tool will run against. The tool will run against all regions specified in the
70+
configuration. If no regions are listed, then the tool will **NOT** run against any region. Regions must be explicitly
71+
provided.
72+
73+
## Accounts
74+
75+
The accounts section is a map of AWS Account IDs to their configuration. The account ID is the key and the value is the
76+
configuration for that account.
77+
78+
The configuration for each account is broken down into the following sections:
79+
80+
- presets
81+
- filters
82+
- resource-types
83+
- targets (deprecated, use includes)
84+
- includes
85+
- excludes
86+
- cloud-control
87+
88+
### Presets
89+
90+
Presets under an account entry is a list of strings that must map to a globally defined preset in the configuration.
91+
92+
### Filters
93+
94+
Filters is a map of filters against resource types. To learn more about filters, see the [Filtering](./config-filtering.md)
95+
96+
**Note:** filters can be defined at the account level and at the preset level.
97+
98+
## Resource Types
99+
100+
Resource types is a map of resource types to their configuration. The resource type is the key and the value is the
101+
configuration for that resource type.
102+
103+
The configuration for each resource type is broken down into the following sections:
104+
105+
- includes
106+
- excludes
107+
- cloud-control
108+
- targets (deprecated, use includes)
109+
110+
### Includes
111+
112+
Includes are a list of resource types the tool will run against. If no includes are specified, then the tool will run against
113+
all resource types.
114+
115+
### Excludes
116+
117+
Excludes are a list of resource types the tool will not run against. If no excludes are specified, then the tool will run
118+
against all resource types unless Includes is specified.
119+
120+
### Cloud Control
121+
122+
Cloud Control is a map of resource types to their cloud control configuration. This allows for alternative behavior when
123+
removing resources. If a resource has a Cloud Control alternative, and you'd like to use its behavior, then you can specify
124+
the resource type in the `cloud-control` section.
125+
126+
## Feature Flags
127+
128+
!!! warning
129+
Deprecated. Please use settings instead.
130+
131+
Feature flags are a map of resource types to their feature flag configuration. This allows for alternative behavior when
132+
removing resources. If a resource has a feature flag alternative, and you'd like to use its behavior, then you can specify
133+
the resource type in the `feature-flags` section.
134+
135+
## Settings
136+
137+
Settings are a map of resource types to their settings configuration. This allows for alternative behavior when removing
138+
resources. If a resource has a setting alternative, and you'd like to use its behavior, then you can specify the resource
139+
type in the `settings` section.
140+
141+
## Global Presets
142+
143+
To read more on global presets, see the [Presets](./config-presets.md) documentation.

‎docs/index.md

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,19 @@ aws-nuke, and [azure-nuke](https://github.com/ekristen/azure-nuke) and soon [gcp
2525
I also needed a version of this tool for Azure and GCP, and initially I just copied and altered the code I needed for
2626
Azure, but I didn't want to have to maintain multiple copies of the same code, so I decided to create
2727
[libnuke](https://github.com/ekristen/libnuke) to abstract all the code that was common between the two tools and write proper unit tests for it.
28+
29+
## Why a rewrite?
30+
31+
I decided to rewrite this tool for a few reasons:
32+
33+
- [x] I wanted to improve the build process by using `goreleaser`
34+
- [x] I wanted to improve the release process by using `goreleaser` and publishing multi-architecture images
35+
- [x] I also wanted to start signing all the releases
36+
- [x] I wanted to add additional tests and improve the test coverage, more tests on the way for individual resources.
37+
- [libnuke](https://github.com/ekristen/libnuke) is at 94%+ overall test coverage.
38+
- [x] I wanted to reduce the maintenance burden by abstracting the core code into a library
39+
- [x] I wanted to make adding additional resources more easy and lowering the barrier to entry
40+
- [x] I wanted to add a lot more documentation and examples
41+
- [x] I wanted to take steps to make way for AWS SDK Version 2
42+
- [ ] I wanted to add a DAG for dependencies between resource types and individual resources (this is still a work in progress)
43+
- This will improve the process of deleting resources that have dependencies on other resources and reduce errors and unnecessary API calls.

‎go.mod

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ go 1.21.6
44

55
require (
66
github.com/aws/aws-sdk-go v1.49.21
7-
github.com/ekristen/libnuke v0.0.0-20240116165357-96b399754078
7+
github.com/ekristen/libnuke v0.0.0-20240122232527-922a9af6ba13
88
github.com/fatih/color v1.16.0
99
github.com/golang/mock v1.6.0
1010
github.com/google/uuid v1.5.0
@@ -29,10 +29,7 @@ require (
2929
github.com/russross/blackfriday/v2 v2.1.0 // indirect
3030
github.com/stevenle/topsort v0.2.0 // indirect
3131
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
32-
golang.org/x/mod v0.4.2 // indirect
3332
golang.org/x/sync v0.6.0 // indirect
34-
golang.org/x/sys v0.14.0 // indirect
35-
golang.org/x/tools v0.1.1 // indirect
36-
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
33+
golang.org/x/sys v0.16.0 // indirect
3734
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
3835
)

0 commit comments

Comments
 (0)