Nuke NAT Gateways (#197)

* Bump package versions * Run secrets manager nuke in parallel * Add ability to nuke NAT gateways * Add config support for nuking NAT gateways * Fix build error * Hook up terratest log parser * Add comments requested from PR * Add guard for failed batching
gruntwork-io · Jun 30, 2021 · 922a488 · 922a488
1 parent 8eb2ba4
commit 922a488
Show file tree

Hide file tree

Showing 13 changed files with 2,558 additions and 216 deletions.
diff --git a/.circleci/config.yml b/.circleci/config.yml
@@ -8,8 +8,19 @@ jobs:
     steps:
       - checkout
       - run:
-          command: run-go-tests --timeout 45m
+          command: |
+            mkdir -p /tmp/logs
+            run-go-tests --timeout 45m | tee /tmp/logs/all.log
           no_output_timeout: 45m
+      - run:
+          name: parse test output
+          command: terratest_log_parser --testlog /tmp/logs/all.log --outputdir /tmp/logs
+          when: always
+      - store_artifacts:
+          path: /tmp/logs
+      - store_test_results:
+          path: /tmp/logs
+
   build:
     <<: *defaults
     steps:

diff --git a/.circleci/nuke_config.yml b/.circleci/nuke_config.yml
@@ -24,3 +24,16 @@ SecretsManager:
       - "^RDSDBConfig[a-zA-Z0-9]{6}$"
       - "ECRDeployRunnerTestSSHKey-[a-zA-Z0-9]{6}$"
       - "ECRDeployRunnerTestGitPAT-[a-zA-Z0-9]{6}$"
+
+NatGateway:
+  # There is a bug in the cloud-nuke config where exclude does not work by itself, so we add a null include rule that
+  # includes everything.
+  # See https://github.com/gruntwork-io/cloud-nuke/issues/198 for more info.
+  include:
+    names_regex:
+      - ".*"
+  exclude:
+    names_regex:
+      # We have an active ECS Deploy Runner running in the sandbox environment for sales demos, and this NAT gateway is
+      # critical for that.
+      - "^ecs-deploy-runner-v2-nat-gateway-0$"
diff --git a/README.md b/README.md
@@ -26,6 +26,8 @@ The currently supported functionality includes:
 - Deleting all S3 buckets in an AWS account - except for buckets tagged with Key=cloud-nuke-excluded Value=true
 - Deleting all default VPCs in an AWS account
 - Deleting all IAM users in an AWS account
+- Deleting all Secrets Manager Secrets in an AWS account
+- Deleting all NAT Gateways in an AWS account
 - Revoking the default rules in the un-deletable default security group of a VPC
 
 ### BEWARE!
@@ -147,6 +149,9 @@ The following resources support the Config file:
 - Secrets Manager Secrets
     - Resource type: `secretsmanager`
     - Config key: `SecretsManager`
+- NAT Gateways
+    - Resource type: `nat-gateway`
+    - Config key: `NATGateway`
 
 
 #### Example
@@ -232,45 +237,16 @@ Be careful when nuking and append the `--dry-run` option if you're unsure. Even
 
 To find out what we options are supported in the config file today, consult this table. Resource types at the top level of the file that are supported are listed here.
 
-| resource type  | support |
-|----------------|---------|
-| s3             | partial |
-| iam            | partial |
-| secretsmanager | partial |
-| ec2 instance   | none    |
-| iam role       | none    |
-| ... (more to come) | none |
-
-
-##### s3 resource type:
-_Note: the fields without `_regex` suffixes refer to support for plain-text matching against those fields._
-
-| field       | include | exclude |
-|-------------|---------|---------|
-| names       | none    | none    |
-| names_regex | ✅      | ✅      |
-| tags        | none    | none    |
-| tags_regex  | none    | none    |
-
-##### iam resource type:
-_Note: the fields without `_regex` suffixes refer to support for plain-text matching against those fields._
-
-| field       | include | exclude |
-|-------------|---------|---------|
-| names       | none    | none    |
-| names_regex | ✅      | ✅      |
-| tags        | none    | none    |
-| tags_regex  | none    | none    |
-
-##### secretsmanager resource type:
-_Note: the fields without `_regex` suffixes refer to support for plain-text matching against those fields._
-
-| field       | include | exclude |
-|-------------|---------|---------|
-| names       | none    | none    |
-| names_regex | ✅      | ✅      |
-| tags        | none    | none    |
-| tags_regex  | none    | none    |
+| resource type      | names | names_regex | tags | tags_regex |
+|--------------------|-------|-------------|------|------------|
+| s3                 | none  | ✅          | none | none       |
+| iam                | none  | ✅          | none | none       |
+| secretsmanager     | none  | ✅          | none | none       |
+| nat-gateway        | none  | ✅          | none | none       |
+| ec2 instance       | none  | none        | none | none       |
+| iam role           | none  | none        | none | none       |
+| ... (more to come) | none  | none        | none | none       |
+
 
 
 ### Log level

diff --git a/aws/aws.go b/aws/aws.go
@@ -336,6 +336,20 @@ func GetAllResources(targetRegions []string, excludeAfter time.Time, resourceTyp
 		}
 		// End TransitGateway
 
+		// NATGateway
+		natGateways := NatGateways{}
+		if IsNukeable(natGateways.ResourceName(), resourceTypes) {
+			ngwIDs, err := getAllNatGateways(session, excludeAfter, configObj)
+			if err != nil {
+				return nil, errors.WithStackTrace(err)
+			}
+			if len(ngwIDs) > 0 {
+				natGateways.NatGatewayIDs = awsgo.StringValueSlice(ngwIDs)
+				resourcesInRegion.Resources = append(resourcesInRegion.Resources, natGateways)
+			}
+		}
+		// End NATGateway
+
 		// EC2 Instances
 		ec2Instances := EC2Instances{}
 		if IsNukeable(ec2Instances.ResourceName(), resourceTypes) {
@@ -627,6 +641,7 @@ func ListResourceTypes() []string {
 		S3Buckets{}.ResourceName(),
 		IAMUsers{}.ResourceName(),
 		SecretsManagerSecrets{}.ResourceName(),
+		NatGateways{}.ResourceName(),
 	}
 	sort.Strings(resourceTypes)
 	return resourceTypes