after writing a script there are some issues

[mdemarco1234]

Issue 1.

This one does not delete and you can see the script and the actual string that your program interprets the resource identifier to Be. Why does it not delete the Below?

problem does not delete

had SecurityHub - [Arn: "arn:aws:securityhub:us-east-2:784948981822:hub/default"]

securityhub1: filters: SecurityHub:

• type: "regex" value: "arn:aws:securityhub:us-east-2:[[:digit:]]{12}:hub/default"

  problem not removing

  CloudWatchLogsLogGroup:

• "aws-controltower/CloudTrailLogs"
• "/aws/lambda/aws-controltower-NotificationForwarder"

---

Issue 2

Both keys are not found. Why are they not in the applications of resources for Deletion?

Key not found

snssubscription:

filters:

SNSSubscription:

- type: "regex"

value: Owner: 784948981822 ARN: arn:aws:sns:eu-west-1:[[:digit:]]{12}:aws-controltower-SecurityNotifications:7414efbb-b88e-4d2e-8242-ee777646d09d # need regex for guid

Key not found

snstopic:

SNSTopic:

- type: "regex"

value: "TopicARN: arn:aws:sns:us-east-2:[[:digit:]]{12}:aws-controltower-SecurityNotifications"

---

Item 3 - On the Below I don't like the identifiers that I have to delete on because they have no name and what if we tear down our terraform stack and we have to rebuild it and those id's are different? Don't want to rebuild this script each time

GuardDutyDetector:

• "8cbfa667aaa1753bb8a18e39f72416c3"
• "18bf41c556a0dc17a400ab1ce6d2e451"
• "dabfa66b8282a36e3894d03d51bef15a"
• "3cbfa66b5f20999fe90d4e62712371ec"
• "88bfa66b71bb1289e5c1eea519c7ac00"

[der-eismann]

Hello @mdemarco1234,

first of all I have to say that I really have trouble understanding your problems because of the way you formatted your questions. Maybe you can start using code tags (```) in the future so program output and config contents are readable. It would also help to understand if you post some logs.

Issue 1) You need to apply the filter to the Arn property of the Security Hub, like this:

SecurityHub:
  - type: "regex"
    property: Arn
    value: "arn:aws:securityhub:us-east-2:[[:digit:]]{12}:hub/default"

Issue 2) Both SNSTopic and SNSSubscription are supported. Without your config I can't really help here.

Issue 3) Why don't you use a regex for that? We don't use GuardDuty, so I don't know much about it, but it looks like you can only have one per account/region. So either keep all or delete them all, not sure what you want to achieve.

Hope this helps!

[mdemarco1234]

Hello,

Thanks for the response . Below is the config file some of this needs to be refactored and would like to get your take on the file and what else you think needs to be corrected.  need a regex for the guids in the file as well as a regex the guard. 

---

regions:

• "global" # This is for all global resource types e.g. IAM
• "us-east-2"
• "us-east-1"
• "us-west-2"
• "ap-southeast-2"
• "eu-west-1" account-blocklist:

  Accounts to never touch

  • Left out for security accounts: Lett out for security presets:
    • sso
    • saml
    • cloudtrail
    • configservicerule
    • iamrolepolicyattachment
    • iamrolepolicy
    • iamrole
    • configserviceconfigurationrecorder
    • servicecatalog
    • dynamodbtableitem1

      - athenaworkgroup

      - configservicedeliverychannel

    • cloudwatcheventstarget
    • s3object1
    • s3object2

      - elasticachesubnetgroup

    • s3bucket1
    • s3bucket2
    • cloudwatcheventsrule
    • securityhub1
    • snssubscription

      - snstopic

    • dynamodbtableitem2

      - ssparameter

      - guarddutydetector

    • cloudformationstack

      - macie

      - opsworksuserprofile

      - securityhub2

      - route53resolverrule

presets: sso: filters: IAMSAMLProvider:

• type: "regex" value: "AWSSSO_.*_DO_NOT_DELETE" IAMRole:
• type: "glob" value: "AWSReservedSSO_*" IAMRolePolicyAttachment:
• type: "glob" value: "AWSReservedSSO_*" saml: filters: IAMSAMLProvider:
• type: "glob" value: "*saml-provider/AzureAD" IAMRole:
• "IdPLambdaExecutionRole"
• "Azure-AD-PowerUser-Role"
• "Azure-AD-Read-Only-Role"
• "Azure-AD-DBA-Role"
• "Azure-AD-Admin-Role"
• "AWS_IAM_AAD_UpdateTask_CrossAccountRole"
• "AWSCloudFormationStackSetExecutionRole"
• "awscontroltower.*" IAMPolicy:
• type: "regex" value: "arn:aws:iam::[[:digit:]]{12}:policy/IdPLambdaExecutionPolicy"
• type: "regex" value: "arn:aws:iam::[[:digit:]]{12}:policy/CloudFormationStackSetExecutionRolePolicies"
• type: "regex" value: arn:aws:iam::[[:digit:]]{12}:policy/service-role/AWSLambdaBasicExecutionRole-d8e86192-8fa0-458f-8044-1e87679d1208 #need regex for guid
  IAMRolePolicyAttachment:
• "IdPLambdaExecutionRole -> IdPLambdaExecutionPolicy"
• "Azure-AD-Admin-Role -> AdministratorAccess"
• "Azure-AD-DBA-Role -> DatabaseAdministrator"
• "Azure-AD-PowerUser-Role -> PowerUserAccess"
• "Azure-AD-Read-Only-Role -> ViewOnlyAccess"
• "AWS_IAM_AAD_UpdateTask_CrossAccountRole -> IAMReadOnlyAccess"
• "AWSCloudFormationStackSetExecutionRole -> IAMFullAccess"
• "AWSCloudFormationStackSetExecutionRole -> AWSLambdaExecute"
• "AWSCloudFormationStackSetExecutionRole -> CloudFormationStackSetExecutionRolePolicies"
• "IAMRolePolicyAttachment - AWS-QuickSetup-StackSet-Local-ExecutionRole -> AdministratorAccess"
• "IAMRolePolicyAttachment - AWSAFTExecution -> AdministratorAccess"
• "AWSAFTExecution -> AdministratorAccess"
• "AWS-QuickSetup-StackSet-Local-ExecutionRole -> AdministratorAccess" LambdaFunction:
• type: "regex" value: "aws-controltower.*" CloudFormationStack:
• "AzureADFederationCrossAccountRoles"
• type: "glob" value: "StackSet-IdpAndSamlRolesForAzureAdFederatedLogin*" GuardDutyDetector:
• "8cbfa667aaa1753bb8a18e39f72416c3"
• "18bf41c556a0dc17a400ab1ce6d2e451"
• "dabfa66b8282a36e3894d03d51bef15a"
• "3cbfa66b5f20999fe90d4e62712371ec"
• "88bfa66b71bb1289e5c1eea519c7ac00" ConfigServiceDeliveryChannel:
• "aws-controltower-BaselineConfigDeliveryChannel" Macie:
• "macie" ElasticacheSubnetGroup:
• "dl-aws-sbtrng-sboxtrng-dublue" CloudWatchEventsRule:
• "aws-controltower-ConfigComplianceChangeEventRule"

  problem not removing

  CloudWatchLogsLogGroup:

• "aws-controltower/CloudTrailLogs"
• "/aws/lambda/aws-controltower-NotificationForwarder" SSMParameter:
• "/aft/account-request/custom-fields/availability"
• "/aft/account-request/custom-fields/code_owners"
• "/aft/account-request/custom-fields/confidentiality"
• "/aft/account-request/custom-fields/data_owners"
• "/aft/account-request/custom-fields/display_name"
• "/aft/account-request/custom-fields/env_subtype"
• "/aft/account-request/custom-fields/environment"
• "/aft/account-request/custom-fields/full_id"
• "/aft/account-request/custom-fields/name"
• "/aft/account-request/custom-fields/namespace"
• "/aft/account-request/custom-fields/project"
• "/aft/account-request/custom-fields/project_owners"
• "/aft/account-request/custom-fields/project_type"
• "/aft/account-request/custom-fields/subdomain"
• "/dbs/naming/accountname"
• "/dbs/naming/displayname"
• "/dbs/naming/environment"
• "/dbs/naming/namespace"
• "/dbs/naming/organization"
• "/dbs/tagging/availability"
• "/dbs/tagging/codeowners"
• "/dbs/tagging/dataowners"
• "/dbs/tagging/environment"
• "/dbs/tagging/project"
• "/dbs/tagging/projectowners"

• "/dbs/tagging/projecttype"

  Says it cannot find the key

  APIGatewayRestAPI:

  - "ifwd8d4s92"

  Route53ResolverRule:

  - "rslvr-autodefined-rr-internet-resolver"

  RDSDBSubnetGroup:

  cloudtrail: filters: CloudTrailTrail:

• type: "regex" value: "aws.*" configservicerule: filters: ConfigServiceConfigRule:
• type: "regex" value: "securityhub.*"
  iamrolepolicyattachment: filters: IAMRolePolicyAttachment:
• type: "regex" value: "aws.*" iamrolepolicy: filters: IAMRolePolicy:
• type: "regex" value: "(AWS|aws).*" iamrole: filters: IAMRole:
• type: "regex" value: "(AWS|aws).*" configserviceconfigurationrecorder: filters: ConfigServiceConfigurationRecorder:
• type: "regex" value: "(AWS|aws).*" servicecatalog: filters: ServiceCatalog:
• type: "regex" value: "dl-(AWS|aws).*" dynamotableitem1: filters: DynamoDBTableItem:
• type: "regex" value: (AWS|aws).*" cloudwatcheventstarget: filters: CloudWatchEventsTarget:
• type: "regex" value: "aws.*" s3object1: filters: S3Object:
• type: "regex" value: "s3://du-spark.*" s3object2: filters: S3Object:
• type: "regex"
  value: "s3://dl-aws.*" s3bucket1:
  filters: S3Bucket:
• type: "regex" value: "s3://dl-aws.*" s3bucket2: filters: S3Bucket:
• type: "regex" value: "s3://du-spark.*"

  problem does not delete

  had SecurityHub - [Arn: "arn:aws:securityhub:us-east-2:784948981822:hub/default"]

  securityhub1: filters: SecurityHub:

• type: "regex" value: "arn:aws:securityhub:us-east-2:[[:digit:]]{12}:hub/default" snssubscription: filters: SNSSubscription:
• type: "regex" value: "arn:aws:sns:us-east-2:[[:digit:]]{12}:aws-controltower-SecurityNotifications:ebc14329-4fc3-4b3a-9f21-69ccf3f2e343" cloudformationstack: filters: CloudFormationStack:
• type: "regex" value: "StackSet-AWSControlTower.*" dynamodbtableitem1: filters: DynamoDBTableItem:
• type: "regex" value: "dl-aws-sbtrng-tfstate-*" dynamodbtableitem2: filters: DynamoDBTable:
• type: "regex" value: "dl-aws-sbtrng-tfstate-*" cloudwatcheventsrule: filters: CloudWatchEventsRule:

• type: "regex" value: (AWS|aws)-controltower.*

  Key not found

  snssubscription:

  filters:

  SNSSubscription:

  - type: "regex"

  value: Owner: 784948981822 ARN: arn:aws:sns:eu-west-1:[[:digit:]]{12}:aws-controltower-SecurityNotifications:7414efbb-b88e-4d2e-8242-ee777646d09d # need regex for guid

  Key not found

  snstopic:

  SNSTopic:

  - type: "regex"

  value: "TopicARN: arn:aws:sns:us-east-2:[[:digit:]]{12}:aws-controltower-SecurityNotifications"

[ekristen]

Please test the fork https://github.com/ekristen/aws-nuke, if this is still a problem, please open an issue there. Please be sure to use codefences and proper formatting of your configs and content to make help easier. Thank you.

---

Please see the copy of the notice from the README about the deprecation of this project. Sven was kind enough to grant me access to help triage and close issues and pull requests that have already been addressed in the actively maintained fork. Some additional information is located in the welcome issue for more information.

[!CAUTION] This repository for aws-nuke is no longer being actively maintained. We recommend users to switch to the actively maintained fork of this project at ekristen/aws-nuke. We appreciate all the support and contributions we've received throughout the life of this project. We believe that the fork will continue to provide the functionality and support that you have come to expect from aws-nuke. Please note that this deprecation means we will not be addressing issues, accepting pull requests, or making future releases from this repository. Thank you for your understanding and support.