feat(iam-role): allow removal of service-linked roles

resources/iam-roles.go → resources/iam-role.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/ekristen/libnuke/pkg/registry"
 	"github.com/ekristen/libnuke/pkg/resource"
+	libsettings "github.com/ekristen/libnuke/pkg/settings"
 	"github.com/ekristen/libnuke/pkg/types"
 
 	"github.com/ekristen/aws-nuke/v3/pkg/nuke"
@@ -32,20 +33,28 @@ func init() {
 		DeprecatedAliases: []string{
 			"IamRole",
 		},
+		Settings: []string{
+			"IncludeServiceLinkedRoles",
+		},
 	})
 }
 
 type IAMRole struct {
 	svc          iamiface.IAMAPI
+	settings     *libsettings.Setting
 	Name         *string
 	Path         *string
 	CreateDate   *time.Time
 	LastUsedDate *time.Time
 	Tags         []*iam.Tag
 }
 
+func (r *IAMRole) Settings(settings *libsettings.Setting) {
+	r.settings = settings
+}
+
 func (r *IAMRole) Filter() error {
-	if strings.HasPrefix(*r.Path, "/aws-service-role/") {
+	if strings.HasPrefix(*r.Path, "/aws-service-role/") && !r.settings.GetBool("IncludeServiceLinkedRoles") {
 		return fmt.Errorf("cannot delete service roles")
 	}
 	if strings.HasPrefix(*r.Path, "/aws-reserved/sso.amazonaws.com/") {

resources/iam-roles_mock_test.go → resources/iam-role_mock_test.go

@@ -13,6 +13,8 @@ import (
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/iam"
 
+	libsettings "github.com/ekristen/libnuke/pkg/settings"
+
 	"github.com/ekristen/aws-nuke/v3/mocks/mock_iamiface"
 	"github.com/ekristen/aws-nuke/v3/pkg/nuke"
 )
@@ -67,6 +69,10 @@ func Test_Mock_IAMRole_List(t *testing.T) {
 	a.Equal("/", *iamRole.Path)
 	a.Equal(createDate.Format(time.RFC3339), iamRole.Properties().Get("CreateDate"))
 	a.Equal(lastUsedDate.Format(time.RFC3339), iamRole.Properties().Get("LastUsedDate"))
+
+	err = iamRole.Filter()
+	a.Nil(err)
+
 }
 
 func Test_Mock_IAMRole_Remove(t *testing.T) {
@@ -91,6 +97,37 @@ func Test_Mock_IAMRole_Remove(t *testing.T) {
 	a.Nil(err)
 }
 
+func Test_Mock_IAMRole_Filter_ServiceLinked(t *testing.T) {
+	a := assert.New(t)
+	ctrl := gomock.NewController(t)
+	defer ctrl.Finish()
+
+	mockIAM := mock_iamiface.NewMockIAMAPI(ctrl)
+
+	settings := &libsettings.Setting{}
+
+	iamRole := IAMRole{
+		svc:      mockIAM,
+		settings: settings,
+		Name:     ptr.String("test"),
+		Path:     ptr.String("/aws-service-role/"),
+		Tags:     []*iam.Tag{},
+	}
+
+	err := iamRole.Filter()
+	a.NotNil(err, "should not be able to delete service linked roles")
+
+	iamRole.settings.Set("IncludeServiceLinkedRoles", false)
+
+	err = iamRole.Filter()
+	a.NotNil(err, "should not be able to delete service linked roles")
+
+	iamRole.settings.Set("IncludeServiceLinkedRoles", true)
+
+	err = iamRole.Filter()
+	a.Nil(err, "should be able to delete service linked roles")
+}
+
 func Test_Mock_IAMRole_Properties(t *testing.T) {
 	a := assert.New(t)
 	ctrl := gomock.NewController(t)