Skip to content

Latest commit

 

History

History
105 lines (83 loc) · 5.94 KB

README.md

File metadata and controls

105 lines (83 loc) · 5.94 KB
Raw

Masterpoint Logo

terraform-aws-nuke-bomber

✈️ 💣 ☁️

This terraform module deploys a VPC, ECS Cluster, and Scheduled ECS Fargate Task to repeatedly execute aws-nuke, which removes all resources in the given AWS Account. This is intended for usage in "Test Accounts" where developers or CI / CD are typically deploying infrastructure that needs to be cleaned up often, otherwise it would incur unnecessary costs.

NOTE: As is stated multiple times on the aws-nuke repo, this project should similarly be used with extreme caution for obvious reasons. You should explicitly add all AWS Account IDs that you don't want nuked to the exclude section of your nuke-config.yml file and be sure to properly configure the filters in that same file to keep around any resources which you don't want removed. Always run this project in dry-run mode first (on by default) and only override the terraform command variable to use --no-dry-run once you've ensured everything is running properly. This project and its maintainers are not responsible for not following those steps.

Big shout out to the following projects which this project uses/depends on!

  1. rebuy-de/aws-nuke
  2. cloudposse/terraform-null-label
  3. cloudposse/terraform-aws-vpc
  4. cloudposse/terraform-aws-dynamic-subnets
  5. cloudposse/terraform-aws-ecs-container-definition

Usage

First, deploy the module:

provider "aws" {
  region = "us-east-1"
}

module "nuke_bomber" {
  source    = "git::https://github.com/masterpointio/terraform-aws-nuke-bomber.git?ref=tags/0.1.0"
  namespace = var.namespace

  # NOTE: 5 minutes is way too often. This is just for testing / example purposes.
  # Change this once you're not running drills!
  schedule_expression = "rate(5 minutes)"
}

Next, to get the ECS Task running, you need to do the following:

  1. Clone this repo and change into this directory:
    • git clone [email protected]:masterpointio/terraform-aws-nuke-bomber.git && cd terraform-aws-nuke-bomber
  2. Copy nuke-config example:
    • cp nuke-config.yml.example nuke-config.yml
  3. Replace your nuke-config.yml TODO_ fields with your Account ID, Region, and Production Account ID(s).
  4. Check over the config. Make sure to exclude or filter out anything you don't want removed from your account!
  5. From your terraform project direct, grab the ECR Repo URL from the terraform output:
    • export ECR_REPO=$(terraform output ecr_repo_url)
  6. Make sure you've got an ECR Push token via:
    • eval $(aws ecr get-login --region us-east-1 --no-include-email)
  7. Build, tag, and push the Docker image:
    • make
  8. Check out your logs in CloudWatch to watch the bomb drop!

Noticed that nothing got deleted even though your bomber should've nuked the account? That was just a drill... update your nuke_bomber module with the following and terraform apply the change to fire for effect:

module "nuke_bomber" {
  source    = "git::https://github.com/masterpointio/terraform-aws-nuke-bomber.git?ref=tags/0.1.0"
  namespace = var.namespace
  command   = ["-c", "/home/aws-nuke/nuke-config.yml", "--force", "--force-sleep", "3", "--no-dry-run"]
  schedule_expression = "rate(48 hours)"
}

Requirements

Name Version
terraform >= 0.12
aws ~> 2.0

Providers

Name Version
aws ~> 2.0

Inputs

Name Description Type Default Required
attributes Additional attributes (e.g. 1) list(string) [] no
availability_zones List of Availability Zones where subnets will be created. list(string) n/a yes
command The CMD to execute on the ECS container. Override this to actually execute the nuke. list(string) 
[
  "-c",
  "/home/aws-nuke/nuke-config.yml",
  "--force",
  "--force-sleep",
  "3"
]
 no
container_cpu The container's CPU for the bomber task. number 256 no
container_memory The container's memory for the bomber task. number 512 no
container_memory_reservation The container's memory reservation for the bomber task. number 512 no
delimiter Delimiter to be used between namespace, stage, name and attributes string "-" no
environment Environment, e.g. 'prod', 'staging', 'dev', 'pre-prod', 'UAT' string "" no
log_retention_in_days The number of days to retain the bomber task logs. number 30 no
name Solution name, e.g. 'app' or 'jenkins' string "bomber" no
namespace Namespace, which could be your organization name or abbreviation, e.g. 'eg' or 'cp' string n/a yes
nat_gateway_enabled Whether to enable NAT Gateways. If false, then the application uses NAT Instances, which are much cheaper. bool false no
region The AWS Region to deploy these resources to. string n/a yes
schedule_expression The expression to determine the schedule on which to invoke the bomber. Useful information @ https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html. string "rate(24 hours)" no
stage The environment that this infrastrcuture is being deployed to e.g. dev, stage, or prod string "nuke" no
tags Additional tags (e.g. map('BusinessUnit','XYZ') map(string) {} no
vpc_cidr_block The CIDR block used for the VPC network. string "10.0.0.0/16" no

Outputs

Name Description
ecr_repo_url The URL of the ECR Repo to push your docker image to.