Skip to content

Automated cleanup process should include deleting S3 resources (i.e. TF state files) #500

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
theipster wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Automated cleanup process should include deleting S3 resources (i.e. TF state files) #500

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ea16dbc
Include deletion of S3 resources on cleanup
theipster Oct 5, 2024
c8914ac
Don't forget about optional account customizations
theipster Oct 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 42 additions & 1 deletion src/aft_lambda/aft_account_request_framework/aft_cleanup_resources.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,12 +6,17 @@
from typing import TYPE_CHECKING, Any, Dict

from aft_common import codepipeline, ddb
from aft_common.aft_utils import sanitize_input_for_logging
from aft_common.auth import AuthClient
from aft_common.constants import SSM_PARAM_AFT_DDB_META_TABLE
from aft_common.constants import (
SSM_PARAM_ACCOUNT_AFT_MANAGEMENT_ACCOUNT_ID,
SSM_PARAM_AFT_DDB_META_TABLE,
)
from aft_common.logger import configure_aft_logger
from aft_common.notifications import send_lambda_failure_sns_message
from aft_common.organizations import OrganizationsAgent
from aft_common.ssm import get_ssm_parameter_value
from boto3.session import Session

if TYPE_CHECKING:
from aws_lambda_powertools.utilities.typing import LambdaContext
Expand Down Expand Up @@ -62,6 +67,19 @@ def lambda_handler(event: Dict[str, Any], context: LambdaContext) -> None:
)
logger.info(f"Account metadata record deleted")

aft_management_account_id = get_ssm_parameter_value(
aft_management_session,
SSM_PARAM_ACCOUNT_AFT_MANAGEMENT_ACCOUNT_ID,
)

logger.info(f"Deleting Terraform state files for {account_id}")
s3_delete_objects(
session=aft_management_session,
aft_management_account_id=aft_management_account_id,
account_id=account_id,
)
logger.info(f"Terraform state files deleted")

logger.info(f"Cleanup for {account_id} complete ")

except Exception as error:
Expand All @@ -78,3 +96,26 @@ def lambda_handler(event: Dict[str, Any], context: LambdaContext) -> None:
}
logger.exception(message)
raise


def s3_delete_objects(session: Session, aft_management_account_id: str, account_id: str) -> None:
s3 = session.client("s3")

dirs_to_remove = [
(f"aft-backend-{aft_management_account_id}-primary-region", f"{account_id}-aft-account-customizations"),
(f"aft-backend-{aft_management_account_id}-primary-region", f"{account_id}-aft-global-customizations"),
(f"aft-backend-{aft_management_account_id}-primary-region", f"{account_id}-customizations-pipeline"),
(f"aft-backend-{aft_management_account_id}-secondary-region", f"{account_id}-aft-account-customizations"),
(f"aft-backend-{aft_management_account_id}-secondary-region", f"{account_id}-aft-global-customizations"),
(f"aft-backend-{aft_management_account_id}-secondary-region", f"{account_id}-customizations-pipeline"),
(f"aft-customizations-pipeline-{aft_management_account_id}", f"{account_id}-customi"),
]

for bucket, dir in dirs_to_remove:
logger.info(f"Deleting {bucket} {dir} (recursively)")
list_objs_response = s3.list_objects_v2(Bucket=bucket, Prefix=dir)
delete_objs_request_keys = [{"Key": obj["Key"]} for obj in list_objs_response["Contents"]]
if len(delete_objs_request_keys) > 0:
delete_objs_response = s3.delete_objects(Bucket=bucket, Delete={"Objects": delete_objs_request_keys})
sanitized_response = sanitize_input_for_logging(delete_objs_response)
logger.info(sanitized_response)