Is there a way to nuke all AWS resources in an AWS account?

Question

I have an AWS account where multiple EC2 instances, load balancers, target groups, security groups etc are setup by multiple owners. We use terraform to set this up but sometimes due to corruption, the state becomes inconsistent. Current mechanism to recover is to manually destroy all resources in that account owned by a particular owner. Is there an easy way to nuke all resources in an AWS account belonging to a particular owner?

Answer 1

There is no way to delete all resources in an account owned by a particular user but there is a way to delete all resources in an account.

You can use aws-nuke which was created somewhat out of the same use case you described.

1. At first, you need to set an account alias for your account.
2. You must create a config file.

3. Then you can list down all resources that will be deleted using the following command:

   aws-nuke -c config/nuke-config.yml --profile aws-nuke-example

4. Add --no-dry-run option to permanently delete all resources in the same command.

5. There are also multiple filter options available such as target, resource type, exclude, etc. that you can leverage to suit your needs.

Answer 2

Agree with the other answer that there is no easy way delete orphan resources.

But I see the original issue is that the terraform state is corrupted. You can checkout the terraform import feature which lets you generate state file from aws resources. In that way you can connect your config to resources again.

Answer 3

Short answer: no.

Longer answer: actually, that's also no. There's no built-in capabillity for this.

The case you're describing is not within the bounds of typical AWS usage... destroying everything in an account -- usually -- should not be easy.

Of course, you could script it, fairly trivially, by wrapping calls to aws-cli to custom code to iterate through the resources and generate additional requests to destroy them... but if you do, lock that code away, since such capability is inherently dangerous.

Answer 4

You can delete all your resources you created, you'll need to automate, see a sample here:

Creation

https://github.com/jouellnyc/AWS/tree/master/create_aws_vpc2

Deletion

https://github.com/jouellnyc/AWS/blob/master/create_aws_vpc2/delete_lb_and_vpc.sh

Other

I've had some success with cloud nuke (played around for a few min; not in depth):

https://github.com/gruntwork-io/cloud-nuke

Answer 5

if the issue is a corrupted terraform state, perhaps storing the state in a versioned S3 bucket would help reduce the impact of that.

Answer 6

Use Terraformer to import all resources into terraform configuration then do whatever you want:

terraformer import aws --resources="*"

https://github.com/GoogleCloudPlatform/terraformer

Take care of your state file lock f.e. by using dynamodb & enable s3 versioning.

Answer 7

I dont think there is any state forward way to do it but to check if you have any active resources in your account, do the following:

1. Open the Billing and Cost Management console.
2. Choose Bills in the navigation pane.
3. You can see the charges incurred by different services in the Bill details by service section.
4. You can see the charges incurred in different AWS Regions in the Bill details by account section.

For each service, identify the Regions where the services have incurred charges. To terminate the identified active resources under different services, do the following:

1. Open the AWS Management Console.
2. For Find services, enter the service name.
3. After opening the service console, terminate all your active resources. Be sure to check each Region where you have allocated resources.