DOCSEARCHbyAlgolia
Submit Docs

cloud-nuke

repository·master·Indexed 25 days ago

https://github.com/gruntwork-io/cloud-nuke

A CLI tool designed to delete all resources in a cloud account, primarily used for cleaning up test accounts and removing unnecessary defaults. It supports destructive operations and non-destructive inspections for AWS and GCP, with granular filtering by region, resource type, tags, and age.

Tokens
9.1K
Snippets
27
Records
63
Agent score
85%

What's inside cloud-nuke

  2. Verify permissions for AWS resources using IsNukable check

    master

    For several AWS resource types, cloud-nuke can perform a permission check before attempting deletion to ensure you have sufficient rights. This check utilizes the AWS DryRun feature where available.

    If the check fails, cloud-nuke will raise error: INSUFFICIENT_PERMISSION.

    Supported resources for this check:

    • AMI, EBS, DHCP Option, Egress Only Internet Gateway, Endpoints, Internet Gateway, IPAM (including BYOASN, Custom Allocation, Pool, Resource Discovery, and Scope), Key Pair, Network ACL, Network Interface, Subnet, VPC, Elastic IP, Launch Template, NAT Gateway, Network Firewall, Security Group, Snapshot, and Transit Gateway.

  3. Use a YAML configuration file with cloud-nuke

    master

    You can use a YAML configuration file to perform granular resource filtering during a cloud-nuke run. Use the --config flag to specify the path to your YAML file.

    Top-level keys in the YAML file must correspond to the resource type's config key found in the cloud-nuke config support matrix.

    cloud-nuke aws --config path/to/file.yaml

  4. Quick Start with cloud-nuke AWS

    master

    Use these commands to manage and clean up AWS resources.

    WARNING: Running cloud-nuke aws is HIGHLY DESTRUCTIVE and deletes all resources in your account. Never use this in a production environment.

    • Delete all resources (requires confirmation): cloud-nuke aws
    • Inspect resources without deleting: cloud-nuke inspect-aws
    • Preview what would be deleted (Dry Run): cloud-nuke aws --dry-run
    • Delete resources in specific regions: Use multiple --region flags.
    • Delete specific resource types: Use multiple --resource-type flags.
    • Use a configuration file: Use the --config flag for granular filtering.
    # Delete all resources (with confirmation prompt)
cloud-nuke aws

# Inspect resources without deleting
cloud-nuke inspect-aws

# Delete resources in specific regions only
cloud-nuke aws --region us-east-1 --region us-west-2

# Delete only specific resource types
cloud-nuke aws --resource-type ec2 --resource-type s3

# Preview what would be deleted
cloud-nuke aws --dry-run

# Use a config file for granular filtering
cloud-nuke aws --config path/to/config.yaml

  6. Set up local static analysis with pre-commit hooks

    master

    To ensure code quality and prevent nil pointer dereferences during local development, it is recommended to use pre-commit hooks. This will automatically run linters before you commit code.

    1. Install pre-commit using pip.
    2. Install the hooks into your git repository.
    3. Run the hooks against all files to ensure the current state is clean.
    pip install pre-commit
pre-commit install
pre-commit run --all-files

  8. Handle AWS SDK nil responses safely

    master

    When working with the AWS SDK, always check that both the output and the specific fields within the output are not nil before accessing them. This prevents nil pointer dereference panics if an error is not returned but the response object is incomplete.

    // ✅ Good
output, err := client.DescribeResourcePolicy(ctx, input)
if err != nil {
    return err
}
if output != nil && output.Policy != nil {
    policy := output.Policy
}

  9. Install cloud-nuke

    master

    You can install cloud-nuke by downloading the binary directly or using a package manager.

    Download from releases page

    1. Download the latest binary for your OS from the releases page.
    2. Move the binary to a folder on your PATH (e.g., /usr/local/bin/cloud-nuke).
    3. Add execute permissions: chmod u+x /usr/local/bin/cloud-nuke.
    4. Verify installation: cloud-nuke --help.

    Install via package manager

    • macOS: brew install cloud-nuke
    • Linux: brew install cloud-nuke (via Homebrew on Linux)
    • Windows: winget install cloud-nuke
    brew install cloud-nuke

  10. Protect resources using the cloud-nuke-after tag

    master

    Cloud-nuke features global time-based protection via the cloud-nuke-after tag. Any resource with this tag and a future RFC 3339 timestamp is automatically excluded from deletion until that time passes.

    Requirement: The resource must support tag-based filtering.

    cloud-nuke-after = 2026-06-01T00:00:00Z

  11. Release new versions of cloud-nuke

    master

    Choosing a Release Tag

    When releasing new versions, follow these versioning rules:

    • Bump the minor version (X in v0.X.Y) if the release includes new resource types.
    • Reasoning: Since v0.2.0, cloud-nuke uses an opt-out model for new resources, meaning new resource types are inherently backward-incompatible for users with CI pipelines relying on cloud-nuke.