api-gateway remove the attached client certs

aws/resources/apigateway.go

@@ -78,12 +78,54 @@ func (gateway *ApiGateway) nukeAll(identifiers []*string) error {
 	return nil
 }
 
+func (gateway *ApiGateway) getAttachedStageClientCerts(apigwID *string) ([]*string, error) {
+	var clientCerts []*string
+
+	// remove the client certificate attached with the stages
+	stages, err := gateway.Client.GetStages(&apigateway.GetStagesInput{
+		RestApiId: apigwID,
+	})
+
+	if err != nil {
+		return clientCerts, err
+	}
+	// get the stages attached client certificates
+	for _, stage := range stages.Item {
+		clientCerts = append(clientCerts, stage.ClientCertificateId)
+	}
+	return clientCerts, nil
+}
+
+func (gateway *ApiGateway) removeAttachedClientCertificates(clientCerts []*string) error {
+
+	for _, cert := range clientCerts {
+		logging.Debugf("Deleting Client Certificate %s", *cert)
+		_, err := gateway.Client.DeleteClientCertificate(&apigateway.DeleteClientCertificateInput{
+			ClientCertificateId: cert,
+		})
+		if err != nil {
+			logging.Errorf("[Failed] Error deleting Client Certificate %s", *cert)
+			return err
+		}
+	}
+	return nil
+}
 func (gateway *ApiGateway) nukeAsync(
 	wg *sync.WaitGroup, errChan chan error, apigwID *string) {
 	defer wg.Done()
 
+	// get the attached client certificates
+	clientCerts, err := gateway.getAttachedStageClientCerts(apigwID)
+
 	input := &apigateway.DeleteRestApiInput{RestApiId: apigwID}
-	_, err := gateway.Client.DeleteRestApi(input)
+	_, err = gateway.Client.DeleteRestApi(input)
+
+	// When the rest-api endpoint delete successfully, then remove attached client certs
+	if err == nil {
+		err = gateway.removeAttachedClientCertificates(clientCerts)
+	}
+
+	// send the error data to channel
 	errChan <- err
 
 	// Record status of this resource

aws/resources/apigateway_test.go

@@ -18,8 +18,10 @@ import (
 
 type mockedApiGateway struct {
 	apigatewayiface.APIGatewayAPI
-	GetRestApisResp   apigateway.GetRestApisOutput
-	DeleteRestApiResp apigateway.DeleteRestApiOutput
+	GetRestApisResp               apigateway.GetRestApisOutput
+	DeleteRestApiResp             apigateway.DeleteRestApiOutput
+	GetStagesOutput               apigateway.GetStagesOutput
+	DeleteClientCertificateOutput apigateway.DeleteClientCertificateOutput
 }
 
 func (m mockedApiGateway) GetRestApis(*apigateway.GetRestApisInput) (*apigateway.GetRestApisOutput, error) {
@@ -31,6 +33,13 @@ func (m mockedApiGateway) DeleteRestApi(*apigateway.DeleteRestApiInput) (*apigat
 	// Only need to return mocked response output
 	return &m.DeleteRestApiResp, nil
 }
+func (m mockedApiGateway) GetStages(*apigateway.GetStagesInput) (*apigateway.GetStagesOutput, error) {
+	return &m.GetStagesOutput, nil
+}
+
+func (m mockedApiGateway) DeleteClientCertificate(*apigateway.DeleteClientCertificateInput) (*apigateway.DeleteClientCertificateOutput, error) {
+	return &m.DeleteClientCertificateOutput, nil
+}
 
 func TestAPIGatewayGetAllAndNukeAll(t *testing.T) {
 	telemetry.InitTelemetry("cloud-nuke", "")
@@ -122,3 +131,40 @@ func TestNukeAPIGatewayMoreThanOne(t *testing.T) {
 	err = apiGateway.nukeAll([]*string{aws.String(testApiID1), aws.String(testApiID2)})
 	require.NoError(t, err)
 }
+
+func TestNukeAPIGatewayWithCertificates(t *testing.T) {
+	telemetry.InitTelemetry("cloud-nuke", "")
+	t.Parallel()
+
+	testApiID1 := "aws-nuke-test-" + util.UniqueID()
+	testApiID2 := "aws-nuke-test-" + util.UniqueID()
+
+	clientCertID := "aws-client-cert" + util.UniqueID()
+	apiGateway := ApiGateway{
+		Client: mockedApiGateway{
+			GetRestApisResp: apigateway.GetRestApisOutput{
+				Items: []*apigateway.RestApi{
+					{Id: aws.String(testApiID1)},
+					{Id: aws.String(testApiID2)},
+				},
+			},
+			GetStagesOutput: apigateway.GetStagesOutput{
+				Item: []*apigateway.Stage{
+					{
+						ClientCertificateId: aws.String(clientCertID),
+					},
+				},
+			},
+			DeleteClientCertificateOutput: apigateway.DeleteClientCertificateOutput{},
+			DeleteRestApiResp:             apigateway.DeleteRestApiOutput{},
+		},
+	}
+
+	apis, err := apiGateway.getAll(context.Background(), config.Config{})
+	require.NoError(t, err)
+	require.Contains(t, awsgo.StringValueSlice(apis), testApiID1)
+	require.Contains(t, awsgo.StringValueSlice(apis), testApiID2)
+
+	err = apiGateway.nukeAll([]*string{aws.String(testApiID1), aws.String(testApiID2)})
+	require.NoError(t, err)
+}