Protect an S3Bucket and all its contents about aws-nuke HOT 7 CLOSED

@evanread Thanks for your issue. We already thought about this, but we are still looking for a neat way to configure that.

We could just use a * as wildcard, but what if someone has a * in their resource name? We could just create a possibility to escape the wildcard, but this might break existing configs.

Maybe a regex just would work, but there we also need to make sure not to break existing configs.

from aws-nuke.

That's a good point. AWS use * as a wildcard too, so I wasn't aware you could have it in the name: http://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html

I would also be happy of there was an option (maybe at the CLI?) where protecting an S3Bucket resource also protects the S3Object contents of the bucket.

from aws-nuke.

I would prefer a generic solution. This feature is also interesting for other resource; eg filtering all access keys of a specific user would be great.

The identifiers in the config are not ARNs. So I am still not sure if we can rely on this for non-S3 resources. IMO the root problem here is, that these filters are just a list of strings, which limits us here very much.

Nevertheless, not having any kind of wildcard is very annoying and we hopefully will fix this soon.

from aws-nuke.

I proposed a generic solution in #150.

from aws-nuke.

The filters are great, however it would be ideal to have an option to skip a bucket altogether. In our case we have the CloudTrail bucket which contains quite a lot of files and scanning this takes ages (like 10 Minutes) even though all files are excluded by filters.

As all of the files are skipped anyway, there should be an option to exclude a bucket in the first place. Though i have currently no idea how to implement this in a nice and reusable way.

from aws-nuke.

Doing something like this would be quite hard currently, because this would mean that we need to tell the list function for S3 Object what Buckets to skip. Also I do not want to add S3 specific code to the resource handling, so we would need a generic solution.

I guess this is worth a separate issue.

from aws-nuke.

This is already solved with having multiple filter types. See README and this example configuration:

S3Object:
- type: regex
  value: "s3://my-bucket/.*"

from aws-nuke.