Add resource filters to config about aws-nuke HOT 4 CLOSED

Since #66 is done, we can start implementing this. Now we need to figure out how the configuration should look like.

Some questions which pop up for me:

• Do we only need include? Or only exclude? Or both?
  • If both, does it make sense to disallow specifying both?
• Where should we attach the include/exclude config?
  • For a specific account?
  • For the whole config?
  • Both?
    • If so, how should it behave when specifying on both levels?
• Do we still need the --target command line flag?
  • If so, should we somehow streamline it with the config behaviour?

I already have some ideas about this questions, but I want to hear other opinions first. So, please discuss.

/cc @rebuy-de/prp-aws-nuke

from aws-nuke.

Here is my proposal.

We add include and exclude configurations as:

• CLI arguments which can be used multiple times (--include and --exclude)
• account specific parameter (.accounts,*.resource-types.include and .accounts.*.resource-types.exclude)
• global parameter for the whole config (.resource-types.include and .resource-types.exclude)

In general exclude has precedence over include. This means that a resource type must not get deleted, if it is specified in any configuration type (ie, cli arg, account-specific, global). Also, if an include is defined anywhere, only the specified resources types are allowed to get nuked. Specifying no include in any configuration type mean that all, but the excluded resources should get nuked.

I don't see a clear way for handling multiple includes. Assuming we have three sets A, B and C for the configuration via global parameters, account specific parameters of CLI arguments, we could generate the final include set like:

• the intersection of all non-empty sets A, B, C
• or the union of all sets A, B, C.

For example we could define this config:

---
regions:
  - "eu-west-1"
account-blacklist:
- 1234567890
resource-types:
  include:
    - S3Bucket
    - S3Object
accounts:
  421337:
    resources-types:
      include:
        - S3Bucket
        - IAMRole

And would nuke it with this command:

aws-nuke --config nuke.yaml --include S3Bucket --include EC2Instance

So when using the intersection method, the resulting nuke target would be S3Bucket and when using the union method the result would be S3Bucket, S3Object, IAMRole and EC2Instance. Both somehow make sense, but I don't see a clear winner.

What are your opinions on this?

from aws-nuke.

I created a PR: #74

from aws-nuke.

This change will be included in v1.4.0. I already created a release candidate and would be happy about any feedback: https://github.com/rebuy-de/aws-nuke/releases/tag/v1.4.0-rc1

from aws-nuke.