Nuke NAT Gateways

.circleci/config.yml

@@ -8,8 +8,19 @@ jobs:
     steps:
       - checkout
       - run:
-          command: run-go-tests --timeout 45m
+          command: |
+            mkdir -p /tmp/logs
+            run-go-tests --timeout 45m | tee /tmp/logs/all.log
           no_output_timeout: 45m
+      - run:
+          name: parse test output
+          command: terratest_log_parser --testlog /tmp/logs/all.log --outputdir /tmp/logs
+          when: always
+      - store_artifacts:
+          path: /tmp/logs
+      - store_test_results:
+          path: /tmp/logs
+
   build:
     <<: *defaults
     steps:

.circleci/nuke_config.yml

@@ -24,3 +24,13 @@ SecretsManager:
       - "^RDSDBConfig[a-zA-Z0-9]{6}$"
       - "ECRDeployRunnerTestSSHKey-[a-zA-Z0-9]{6}$"
       - "ECRDeployRunnerTestGitPAT-[a-zA-Z0-9]{6}$"
+
+NatGateway:
+  # There is a bug in the cloud-nuke config where exclude does not work by itself, so we add a null include rule that
+  # includes everything.
+  include:
+    names_regex:
+      - ".*"
+  exclude:
+    names_regex:
+      - "^ecs-deploy-runner-v2-nat-gateway-0$"

README.md

@@ -26,6 +26,8 @@ The currently supported functionality includes:
 - Deleting all S3 buckets in an AWS account - except for buckets tagged with Key=cloud-nuke-excluded Value=true
 - Deleting all default VPCs in an AWS account
 - Deleting all IAM users in an AWS account
+- Deleting all Secrets Manager Secrets in an AWS account
+- Deleting all NAT Gateways in an AWS account
 - Revoking the default rules in the un-deletable default security group of a VPC
 
 ### BEWARE!
@@ -147,6 +149,9 @@ The following resources support the Config file:
 - Secrets Manager Secrets
     - Resource type: `secretsmanager`
     - Config key: `SecretsManager`
+- NAT Gateways
+    - Resource type: `nat-gateway`
+    - Config key: `NATGateway`
 
 
 #### Example
@@ -232,45 +237,16 @@ Be careful when nuking and append the `--dry-run` option if you're unsure. Even
 
 To find out what we options are supported in the config file today, consult this table. Resource types at the top level of the file that are supported are listed here.
 
-| resource type  | support |
-|----------------|---------|
-| s3             | partial |
-| iam            | partial |
-| secretsmanager | partial |
-| ec2 instance   | none    |
-| iam role       | none    |
-| ... (more to come) | none |
-
-
-##### s3 resource type:
-_Note: the fields without `_regex` suffixes refer to support for plain-text matching against those fields._
-
-| field       | include | exclude |
-|-------------|---------|---------|
-| names       | none    | none    |
-| names_regex | ✅      | ✅      |
-| tags        | none    | none    |
-| tags_regex  | none    | none    |
-
-##### iam resource type:
-_Note: the fields without `_regex` suffixes refer to support for plain-text matching against those fields._
-
-| field       | include | exclude |
-|-------------|---------|---------|
-| names       | none    | none    |
-| names_regex | ✅      | ✅      |
-| tags        | none    | none    |
-| tags_regex  | none    | none    |
-
-##### secretsmanager resource type:
-_Note: the fields without `_regex` suffixes refer to support for plain-text matching against those fields._
-
-| field       | include | exclude |
-|-------------|---------|---------|
-| names       | none    | none    |
-| names_regex | ✅      | ✅      |
-| tags        | none    | none    |
-| tags_regex  | none    | none    |
+| resource type      | names | names_regex | tags | tags_regex |
+|--------------------|-------|-------------|------|------------|
+| s3                 | none  | ✅          | none | none       |
+| iam                | none  | ✅          | none | none       |
+| secretsmanager     | none  | ✅          | none | none       |
+| nat-gateway        | none  | ✅          | none | none       |
+| ec2 instance       | none  | none        | none | none       |
+| iam role           | none  | none        | none | none       |
+| ... (more to come) | none  | none        | none | none       |
+
 
 
 ### Log level

aws/aws.go

@@ -336,6 +336,20 @@ func GetAllResources(targetRegions []string, excludeAfter time.Time, resourceTyp
 		}
 		// End TransitGateway
 
+		// NATGateway
+		natGateways := NatGateways{}
+		if IsNukeable(natGateways.ResourceName(), resourceTypes) {
+			ngwIDs, err := getAllNatGateways(session, excludeAfter, configObj)
+			if err != nil {
+				return nil, errors.WithStackTrace(err)
+			}
+			if len(ngwIDs) > 0 {
+				natGateways.NatGatewayIDs = awsgo.StringValueSlice(ngwIDs)
+				resourcesInRegion.Resources = append(resourcesInRegion.Resources, natGateways)
+			}
+		}
+		// End NATGateway
+
 		// EC2 Instances
 		ec2Instances := EC2Instances{}
 		if IsNukeable(ec2Instances.ResourceName(), resourceTypes) {
@@ -627,6 +641,7 @@ func ListResourceTypes() []string {
 		S3Buckets{}.ResourceName(),
 		IAMUsers{}.ResourceName(),
 		SecretsManagerSecrets{}.ResourceName(),
+		NatGateways{}.ResourceName(),
 	}
 	sort.Strings(resourceTypes)
 	return resourceTypes