-
Notifications
You must be signed in to change notification settings - Fork 0
/
default-nuke-config-template.yml
executable file
·51 lines (47 loc) · 1.32 KB
/
default-nuke-config-template.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
regions:
- "global"
# DCE Principals roles are currently locked down
# to only access these two regions
# This significantly reduces the run time of nuke.
{{range .Regions}} - "{{.}}"
{{end}}
account-blacklist:
- "{{ .ParentAccountID}}" # Arbitrary production account id
presets:
sso:
filters:
IAMSAMLProvider:
- type: "regex"
value: "AWSSSO_.*_DO_NOT_DELETE"
IAMRole:
- type: "glob"
value: "AWSReservedSSO_*"
IAMRolePolicyAttachment:
- type: "glob"
value: "AWSReservedSSO_*"
resource-types:
excludes:
- S3Object # Let the S3Bucket delete all Objects instead of individual objects (optimization)
accounts:
"{{ .ID}}": # Child Account
presets:
- sso
filters:
IAMPolicy:
- type: "contains"
value: "{{ .PrincipalPolicy}}"
IAMRole:
- "{{ .AdminRole}}"
- "{{ .PrincipalRole}}"
IAMRolePolicy:
- type: "contains"
value: "{{ .AdminRole}}"
- type: "contains"
value: "{{ .PrincipalRole}}"
- type: "contains"
value: "{{ .PrincipalPolicy}}"
IAMRolePolicyAttachment:
# Do not remove the policy from the principal user role
- "{{ .PrincipalRole}} -> {{ .PrincipalPolicy}}"
- property: RoleName
value: "{{ .AdminRole}}"