search

rebuy-de / aws-nuke

Nuke a whole AWS account and delete all its resources.
https://github.com/ekristen/aws-nuke
MIT License
5.76k stars 723 forks source link

Deletion of SecretsManager secret with replica #1127

Closed npellegrin closed 1 month ago

npellegrin commented 12 months ago

The deletion of a secret stored in AWS SecretsManager fails when replication is enabled. aws-nuke must delete all the replicas before attempting to delete the secret

Error in CloudTrail:

You can't delete secret arn:aws:secretsmanager:eu-west-3:000000000000:secret:myvault/mysecret-AbCd that still has replica regions [eu-west-2, eu-south-1, eu-west-1, eu-central-1, us-east-1, us-east-2, us-west-1, us-west-2, eu-north-1].
imduchy commented 2 months ago

Running into exactly same issue

eu-central-1 - SecretsManagerSecret - arn:aws:secretsmanager:eu-central-1:123456789012:secret:my-secret - [] - failed
time="2024-07-19T19:17:47Z" level=error msg="InvalidParameterException: You can't delete secret arn:aws:secretsmanager:eu-central-1:123456789012:secret:my-secret that still has replica regions [eu-north-1]."

...

eu-north-1 - SecretsManagerSecret - arn:aws:secretsmanager:eu-north-1:123456789012:secret:my-secret - [] - failed
time="2024-07-19T19:17:47Z" level=error msg="InvalidParameterException: Operation not permitted on a replica secret. Call must be made in primary secret's region."
imduchy commented 2 months ago

It looks like secrets with replication enabled returned by ListSecrets contain an extra key called PrimaryRegion. The key is only present in secrets with replication enabled.

The remove-regions-from-replication action can be used to remove these replicas before removing the secret itself but regions have to be provided explicitly via --remove-replica-regions. With describe-secret, we can get a list of all regions where the secret is replicated.

ekristen commented 1 month ago

@npellegrin and @imduchy this feature has been implemented over on the now active fork via the PR https://github.com/ekristen/aws-nuke/pull/210 and has been in the fork of aws-nuke since version 3.3.1.

--

Please see a copy of the notice from the README about the deprecation of this project. Sven was kind enough to grant me access to help triage and close issues and pull requests that have already been addressed in the actively maintained fork. Some additional information is located in the welcome issue for more information.

[!CAUTION] This repository for aws-nuke is no longer being actively maintained. We recommend users to switch to the actively maintained fork of this project at ekristen/aws-nuke. We appreciate all the support and contributions we've received throughout the life of this project. We believe that the fork will continue to provide the functionality and support that you have come to expect from aws-nuke. Please note that this deprecation means we will not be addressing issues, accepting pull requests, or making future releases from this repository. Thank you for your understanding and support.