Skip to content

Commit

Permalink
feat: adding a filters for aws managed resources
Browse files Browse the repository at this point in the history
  • Loading branch information
@gambol99
gambol99 committed Nov 10, 2024
1 parent 7f8392e commit 33b2709
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 1 deletion.
2 changes: 1 addition & 1 deletion modules/configuration/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ No resources.
| <a name="input_blocklist"></a> [blocklist](#input\_blocklist) | A collection of resources to block from deletion | `list(string)` | <pre>[<br/> "123456789012"<br/>]</pre> | no |
| <a name="input_excluded"></a> [excluded](#input\_excluded) | A collection of resources to exclude from the nuke | <pre>object({<br/> add = optional(list(string), [])<br/> # Additional resources to exclude from the nuke configuration on top of the default ones below<br/> remove = optional(list(string), [])<br/> # Resources to exclude from the nuke configuration <br/> all = optional(list(string), [<br/> "Cloud9Environment",<br/> "CloudSearchDomain",<br/> "CodeStarConnection",<br/> "CodeStarNotification",<br/> "CodeStarProject",<br/> "EC2DHCPOption",<br/> "EC2NetworkACL",<br/> "EC2NetworkInterface",<br/> "ECSCluster",<br/> "ECSClusterInstance",<br/> "ECSService",<br/> "ECSTaskDefinition",<br/> "FMSNotificationChannel",<br/> "FMSPolicy",<br/> "IAMUser",<br/> "MachineLearningBranchPrediction",<br/> "MachineLearningDataSource",<br/> "MachineLearningEvaluation",<br/> "MachineLearningMLModel",<br/> "OpsWorksApp",<br/> "OpsWorksCMBackup",<br/> "OpsWorksCMServer",<br/> "OpsWorksCMServerState",<br/> "OpsWorksInstance",<br/> "OpsWorksLayer",<br/> "OpsWorksUserProfile",<br/> "RedshiftServerlessNamespace",<br/> "RedshiftServerlessSnapshot",<br/> "RedshiftServerlessWorkgroup",<br/> "RoboMakerDeploymentJob",<br/> "RoboMakerFleet",<br/> "RoboMakerRobot",<br/> "RoboMakerRobotApplication",<br/> "RoboMakerSimulationApplication",<br/> "RoboMakerSimulationJob",<br/> "S3Object",<br/> "ServiceCatalogTagOption",<br/> "ServiceCatalogTagOptionPortfolioAttachment",<br/> ])<br/> ## Default resources to exclude from the nuke configuration <br/> })</pre> | `{}` | no |
| <a name="input_filters"></a> [filters](#input\_filters) | A collection of global filters are applied to all resources | <pre>list(object({<br/> invert = optional(bool, null)<br/> property = string<br/> type = string<br/> value = string<br/> }))</pre> | `[]` | no |
| <a name="input_include_filters"></a> [include\_filters](#input\_include\_filters) | A collection of predefined filters to use for nuke | <pre>object({<br/> enable_control_tower = optional(bool, true)<br/> enable_cost_intelligence = optional(bool, true)<br/> enable_landing_zone = optional(bool, true)<br/> })</pre> | <pre>{<br/> "enable_control_tower": true,<br/> "enable_cost_intelligence": true,<br/> "enable_landing_zone": true<br/>}</pre> | no |
| <a name="input_include_filters"></a> [include\_filters](#input\_include\_filters) | A collection of predefined filters to use for nuke | <pre>object({<br/> enable_aws_managed = optional(bool, true)<br/> enable_control_tower = optional(bool, true)<br/> enable_cost_intelligence = optional(bool, true)<br/> enable_landing_zone = optional(bool, true)<br/> })</pre> | <pre>{<br/> "enable_aws_managed": true,<br/> "enable_control_tower": true,<br/> "enable_cost_intelligence": true,<br/> "enable_landing_zone": true<br/>}</pre> | no |
| <a name="input_included"></a> [included](#input\_included) | A collection of resources to include in the nuke | <pre>object({<br/> add = optional(list(string), [])<br/> # Resources to remove from the nuke configuration<br/> all = optional(list(string), [<br/> "AWSBackupRecoveryPoint",<br/> "AWSBackupSelection",<br/> "BackupVault",<br/> "AppStreamDirectoryConfig",<br/> "AppStreamFleet",<br/> "AppStreamFleetState",<br/> "AppStreamImage",<br/> "AppStreamImageBuilder",<br/> "AppStreamImageBuilderWaiter",<br/> "AppStreamStack",<br/> "AppStreamStackFleetAttachment",<br/> "AutoScalingGroup",<br/> "AutoScalingPlansScalingPlan",<br/> "BatchComputeEnvironment",<br/> "BatchComputeEnvironmentState",<br/> "BatchJobQueue",<br/> "BatchJobQueueState",<br/> "Cloud9Environment",<br/> "CloudDirectoryDirectory",<br/> "CloudDirectorySchema",<br/> "CloudFrontDistribution",<br/> "CloudFrontDistributionDeployment",<br/> "CloudHSMV2Cluster",<br/> "CloudHSMV2ClusterHSM",<br/> "CloudSearchDomain",<br/> "CloudWatchAlarm",<br/> "CloudWatchDashboard",<br/> "CloudWatchLogsDestination",<br/> "CloudWatchLogsLogGroup",<br/> "CodeBuildProject",<br/> "CodeCommitRepository",<br/> "CodeDeployApplication",<br/> "CodePipelinePipeline",<br/> "CodeStarProject",<br/> "CognitoIdentityPool",<br/> "CognitoUserPool",<br/> "CognitoUserPoolDomain",<br/> "DAXCluster",<br/> "DAXParameterGroup",<br/> "DAXSubnetGroup",<br/> "DataPipelinePipeline",<br/> "DatabaseMigrationServiceCertificate",<br/> "DatabaseMigrationServiceEndpoint",<br/> "DatabaseMigrationServiceEventSubscription",<br/> "DatabaseMigrationServiceReplicationInstance",<br/> "DatabaseMigrationServiceReplicationTask",<br/> "DatabaseMigrationServiceSubnetGroup",<br/> "DeviceFarmProject",<br/> "DirectoryServiceDirectory",<br/> "DynamoDBTable",<br/> "EC2Address",<br/> "EC2ClientVpnEndpoint",<br/> "EC2ClientVpnEndpointAttachment",<br/> "EC2CustomerGateway",<br/> "EC2Image",<br/> "EC2Instance",<br/> "EC2InternetGateway",<br/> "EC2InternetGatewayAttachment",<br/> "EC2KeyPair",<br/> "EC2LaunchTemplate",<br/> "EC2NATGateway",<br/> "EC2NetworkACL",<br/> "EC2PlacementGroup",<br/> "EC2RouteTable",<br/> "EC2SecurityGroup",<br/> "EC2Snapshot",<br/> "EC2SpotFleetRequest",<br/> "EC2Subnet",<br/> "EC2TGW",<br/> "EC2TGWAttachment",<br/> "EC2VPC",<br/> "EC2VPCEndpoint",<br/> "EC2VPCEndpointServiceConfiguration",<br/> "EC2VPCPeeringConnection",<br/> "EC2VPNConnection",<br/> "EC2VPNGatewayAttachment",<br/> "EC2Volume",<br/> "ECRRepository",<br/> "EFSFileSystem",<br/> "EFSMountTarget",<br/> "EKSCluster",<br/> "ELB",<br/> "ELBv2",<br/> "ELBv2TargetGroup",<br/> "EMRCluster",<br/> "EMRSecurityConfiguration",<br/> "ESDomain",<br/> "ElasticBeanstalkApplication",<br/> "ElasticBeanstalkEnvironment",<br/> "ElasticTranscoderPipeline",<br/> "ElasticacheCacheCluster",<br/> "ElasticacheReplicationGroup",<br/> "ElasticacheSubnetGroup",<br/> "FSxBackup",<br/> "FSxFileSystem",<br/> "FirehoseDeliveryStream",<br/> "GlueClassifier",<br/> "GlueConnection",<br/> "GlueCrawler",<br/> "GlueDatabase",<br/> "GlueDevEndpoint",<br/> "GlueJob",<br/> "GlueTrigger",<br/> "IAMGroup",<br/> "IAMGroupPolicy",<br/> "IAMGroupPolicyAttachment",<br/> "IAMInstanceProfile",<br/> "IAMInstanceProfileRole",<br/> "IAMLoginProfile",<br/> "IAMOpenIDConnectProvider",<br/> "IAMRole",<br/> "IAMServerCertificate",<br/> "IAMServiceSpecificCredential",<br/> "IAMUser",<br/> "IAMUserAccessKey",<br/> "IAMUserGroupAttachment",<br/> "IAMUserPolicy",<br/> "IAMUserPolicyAttachment",<br/> "IAMVirtualMFADevice",<br/> "IoTAuthorizer",<br/> "IoTCACertificate",<br/> "IoTCertificate",<br/> "IoTJob",<br/> "IoTOTAUpdate",<br/> "IoTPolicy",<br/> "IoTRoleAlias",<br/> "IoTStream",<br/> "IoTThing",<br/> "IoTThingGroup",<br/> "IoTThingType",<br/> "IoTThingTypeState",<br/> "IoTTopicRule",<br/> "KMSAlias",<br/> "KMSKey",<br/> "KinesisAnalyticsApplication",<br/> "KinesisStream",<br/> "KinesisVideoProject",<br/> "LambdaEventSourceMapping",<br/> "LambdaFunction",<br/> "LaunchConfiguration",<br/> "LifecycleHook",<br/> "LightsailDisk",<br/> "LightsailDomain",<br/> "LightsailInstance",<br/> "LightsailKeyPair",<br/> "LightsailLoadBalancer",<br/> "LightsailStaticIP",<br/> "MQBroker",<br/> "MSKCluster",<br/> "MediaConvertJobTemplate",<br/> "MediaConvertPreset",<br/> "MediaConvertQueue",<br/> "MediaLiveChannel",<br/> "MediaLiveInput",<br/> "MediaLiveInputSecurityGroup",<br/> "MediaPackageChannel",<br/> "MediaPackageOriginEndpoint",<br/> "MediaStoreContainer",<br/> "MediaStoreDataItems",<br/> "MediaTailorConfiguration",<br/> "MobileProject",<br/> "NeptuneCluster",<br/> "NeptuneInstance",<br/> "NetpuneSnapshot",<br/> "OpsWorksApp",<br/> "OpsWorksCMBackup",<br/> "OpsWorksCMServer",<br/> "OpsWorksCMServerState",<br/> "OpsWorksInstance",<br/> "OpsWorksLayer",<br/> "OpsWorksUserProfile",<br/> "RDSDBCluster",<br/> "RDSDBClusterParameterGroup",<br/> "RDSDBParameterGroup",<br/> "RDSDBSubnetGroup",<br/> "RDSInstance",<br/> "RDSSnapshot",<br/> "RedshiftCluster",<br/> "RedshiftParameterGroup",<br/> "RedshiftSnapshot",<br/> "RedshiftSubnetGroup",<br/> "RekognitionCollection",<br/> "ResourceGroupGroup",<br/> "RoboMakerDeploymentJob",<br/> "RoboMakerFleet",<br/> "RoboMakerRobot",<br/> "RoboMakerRobotApplication",<br/> "RoboMakerSimulationApplication",<br/> "RoboMakerSimulationJob",<br/> "Route53HostedZone",<br/> "Route53ResourceRecordSet",<br/> "S3Bucket",<br/> "S3MultipartUpload",<br/> "S3Object",<br/> "SESConfigurationSet",<br/> "SESIdentity",<br/> "SESReceiptFilter",<br/> "SESReceiptRuleSet",<br/> "SESTemplate",<br/> "SFNStateMachine",<br/> "SNSEndpoint",<br/> "SNSPlatformApplication",<br/> "SNSSubscription",<br/> "SNSTopic",<br/> "SQSQueue",<br/> "SSMActivation",<br/> "SSMAssociation",<br/> "SSMDocument",<br/> "SSMMaintenanceWindow",<br/> "SSMParameter",<br/> "SSMPatchBaseline",<br/> "SSMResourceDataSync",<br/> "SageMakerEndpoint",<br/> "SageMakerEndpointConfig",<br/> "SageMakerModel",<br/> "SageMakerNotebookInstance",<br/> "SageMakerNotebookInstanceState",<br/> "SecretsManagerSecret",<br/> "ServiceCatalogConstraintPortfolioAttachment",<br/> "ServiceCatalogPortfolio",<br/> "ServiceCatalogPortfolioProductAttachment",<br/> "ServiceCatalogPortfolioShareAttachment",<br/> "ServiceCatalogPrincipalPortfolioAttachment",<br/> "ServiceCatalogProduct",<br/> "ServiceCatalogProvisionedProduct",<br/> "ServiceCatalogTagOption",<br/> "ServiceCatalogTagOptionPortfolioAttachment",<br/> "ServiceDiscoveryInstance",<br/> "ServiceDiscoveryNamespace",<br/> "ServiceDiscoveryService",<br/> "SimpleDBDomain",<br/> "StorageGatewayFileShare",<br/> "StorageGatewayGateway",<br/> "StorageGatewayTape",<br/> "StorageGatewayVolume",<br/> "WAFRegionalByteMatchSet",<br/> "WAFRegionalByteMatchSetIP",<br/> "WAFRegionalIPSet",<br/> "WAFRegionalIPSetIP",<br/> "WAFRegionalRateBasedRule",<br/> "WAFRegionalRateBasedRulePredicate",<br/> "WAFRegionalRegexMatchSet",<br/> "WAFRegionalRegexMatchTuple",<br/> "WAFRegionalRegexPatternSet",<br/> "WAFRegionalRegexPatternString",<br/> "WAFRegionalRule",<br/> "WAFRegionalRulePredicate",<br/> "WAFRegionalWebACL",<br/> "WAFRegionalWebACLRuleAttachment",<br/> "WAFRule",<br/> "WAFWebACL",<br/> "WAFWebACLRuleAttachment",<br/> "WorkLinkFleet",<br/> "WorkSpacesWorkspace",<br/> ])<br/> # A collection of resources to include in the nuke <br/> })</pre> | `{}` | no |
| <a name="input_presets"></a> [presets](#input\_presets) | A collection of presets used in the nuke | <pre>map(map(list(object({<br/> property = string<br/> type = string<br/> value = string<br/> }))))</pre> | `{}` | no |

Expand Down
10 changes: 10 additions & 0 deletions modules/configuration/locals.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ locals {
var.include_filters.enable_control_tower ? local.control_tower_filters : [],
var.include_filters.enable_cost_intelligence ? local.cost_intelligence_filters : [],
var.include_filters.enable_landing_zone ? local.landing_zone_filters : [],
var.include_filters.enable_aws_managed_services ? local.aws_managed_services_filters : [],
var.filters
)

Expand Down Expand Up @@ -67,6 +68,15 @@ locals {
}
]

## AWS managed services filters
aws_managed_services_filters = [
{
property = "Name"
type = "regex"
value = "^(AWSService|AWSReservedSSO_).*"
},
]

## Cost Intelligence filters
cost_intelligence_filters = [
{
Expand Down
2 changes: 2 additions & 0 deletions modules/configuration/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,11 +28,13 @@ variable "presets" {
variable "include_filters" {
description = "A collection of predefined filters to use for nuke"
type = object({
enable_aws_managed = optional(bool, true)
enable_control_tower = optional(bool, true)
enable_cost_intelligence = optional(bool, true)
enable_landing_zone = optional(bool, true)
})
default = {
enable_aws_managed = true
enable_control_tower = true
enable_cost_intelligence = true
enable_landing_zone = true
Expand Down

0 comments on commit 33b2709

Please sign in to comment.