default-nuke-config-template.yml

regions:
  - "global"
  # DCE Principals roles are currently locked down
  # to only access these two regions
  # This significantly reduces the run time of nuke.
{{range .Regions}}  - "{{.}}"
{{end}}
account-blacklist:
  - "{{ .ParentAccountID}}" # Arbitrary production account id

resource-types:
  excludes:
    - S3Object # Let the S3Bucket delete all Objects instead of individual objects (optimization)

accounts:
  "{{ .ID}}": # Child Account
    filters:
      IAMPolicy:
        - type: "contains"
          value: "{{ .PrincipalPolicy}}"
      IAMRole:
        - "{{ .AdminRole}}"
        - "{{ .PrincipalRole}}"
      IAMRolePolicy:
        - type: "contains"
          value: "{{ .AdminRole}}"
        - type: "contains"
          value: "{{ .PrincipalRole}}"
        - type: "contains"
          value: "{{ .PrincipalPolicy}}"
      IAMRolePolicyAttachment:
        # Do not remove the policy from the principal user role
        - "{{ .PrincipalRole}} -> {{ .PrincipalPolicy}}"
        - property: RoleName
          value: "{{ .AdminRole}}"