Support backup-vault nuke

README.md

@@ -473,6 +473,9 @@ The following resources support the Config file:
 - CodeDeploy
   - Resource type: `codedeploy-application`
   - Config key: `Codedeploy`
+- CodeDeploy
+  - Resource type: `backup-vault`
+  - Config key: `Backupvault`
 
 Notes:
   * no configuration options for KMS customer keys, since keys are created with auto-generated identifier
@@ -565,7 +568,7 @@ Be careful when nuking and append the `--dry-run` option if you're unsure. Even
 To find out what we options are supported in the config file today, consult this table. Resource types at the top level of the file that are supported are listed here.
 
 | resource type                 | names | names_regex | tags | tags_regex |
-| ----------------------------- | ----- | ----------- | ---- | ---------- |
+|-------------------------------| ----- | ----------- | ---- | ---------- |
 | s3                            | none  | ✅           | none | none       |
 | iam user                      | none  | ✅           | none | none       |
 | ecsserv                       | none  | ✅           | none | none       |
@@ -607,6 +610,7 @@ To find out what we options are supported in the config file today, consult this
 | config-rules                  | none  | ✅           | none | none       |
 | cloudwatch-alarm              | none  | ✅           | none | none       |
 | redshift                      | none  | ✅           | none | none       |
+| backup-vault                  | none  | ✅           | none | none       |
 | ... (more to come)            | none  | none        | none | none       |
 
 

aws/aws.go

@@ -905,6 +905,34 @@ func GetAllResources(targetRegions []string, excludeAfter time.Time, resourceTyp
 		}
 		// End RDS DB Clusters
 
+		// Backup Vaults
+		backupVault := BackupVault{}
+		if IsNukeable(backupVault.ResourceName(), resourceTypes) {
+			start := time.Now()
+			backupVaultNames, err := getAllBackupVault(cloudNukeSession, configObj)
+			if err != nil {
+				ge := report.GeneralError{
+					Error:        err,
+					Description:  "Unable to retrieve backup vaults",
+					ResourceType: backupVault.ResourceName(),
+				}
+				report.RecordError(ge)
+			}
+
+			telemetry.TrackEvent(commonTelemetry.EventContext{
+				EventName: "Done Listing backup vaults",
+			}, map[string]interface{}{
+				"region":      region,
+				"recordCount": len(backupVaultNames),
+				"actionTime":  time.Since(start).Seconds(),
+			})
+			if len(backupVaultNames) > 0 {
+				backupVault.Names = awsgo.StringValueSlice(backupVaultNames)
+				resourcesInRegion.Resources = append(resourcesInRegion.Resources, backupVault)
+			}
+		}
+		// End backup vaults
+
 		// Lambda Functions
 		lambdaFunctions := LambdaFunctions{}
 		if IsNukeable(lambdaFunctions.ResourceName(), resourceTypes) {

aws/backup_vault.go

@@ -0,0 +1,89 @@
+package aws
+
+import (
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/backup"
+	"github.com/gruntwork-io/cloud-nuke/config"
+	"github.com/gruntwork-io/cloud-nuke/logging"
+	"github.com/gruntwork-io/cloud-nuke/report"
+	"github.com/gruntwork-io/cloud-nuke/telemetry"
+	"github.com/gruntwork-io/go-commons/errors"
+	commonTelemetry "github.com/gruntwork-io/go-commons/telemetry"
+)
+
+func getAllBackupVault(session *session.Session, configObj config.Config) ([]*string, error) {
+	svc := backup.New(session)
+
+	names := []*string{}
+	paginator := func(output *backup.ListBackupVaultsOutput, lastPage bool) bool {
+		for _, backupVault := range output.BackupVaultList {
+			if shouldIncludeBackupVault(backupVault, configObj) {
+				names = append(names, backupVault.BackupVaultName)
+			}
+		}
+
+		return !lastPage
+	}
+
+	err := svc.ListBackupVaultsPages(&backup.ListBackupVaultsInput{}, paginator)
+	if err != nil {
+		return nil, errors.WithStackTrace(err)
+	}
+
+	return names, nil
+}
+
+func shouldIncludeBackupVault(vault *backup.VaultListMember, configObj config.Config) bool {
+	if vault == nil {
+		return false
+	}
+
+	return config.ShouldInclude(
+		aws.StringValue(vault.BackupVaultName),
+		configObj.BackupVault.IncludeRule.NamesRegExp,
+		configObj.BackupVault.ExcludeRule.NamesRegExp,
+	)
+}
+
+func nukeAllBackupVaults(session *session.Session, names []*string) error {
+	svc := backup.New(session)
+
+	if len(names) == 0 {
+		logging.Logger.Debugf("No backup vaults to nuke in region %s", *session.Config.Region)
+		return nil
+	}
+
+	logging.Logger.Debugf("Deleting all backup vaults in region %s", *session.Config.Region)
+	var deletedNames []*string
+
+	for _, name := range names {
+		_, err := svc.DeleteBackupVault(&backup.DeleteBackupVaultInput{
+			BackupVaultName: name,
+		})
+
+		// Record status of this resource
+		e := report.Entry{
+			Identifier:   aws.StringValue(name),
+			ResourceType: "Backup Vault",
+			Error:        err,
+		}
+		report.Record(e)
+
+		if err != nil {
+			logging.Logger.Debugf("[Failed] %s", err)
+			telemetry.TrackEvent(commonTelemetry.EventContext{
+				EventName: "Error Nuking BackupVault",
+			}, map[string]interface{}{
+				"region": *session.Config.Region,
+			})
+		} else {
+			deletedNames = append(deletedNames, name)
+			logging.Logger.Debugf("Deleted backup vault: %s", aws.StringValue(name))
+		}
+	}
+
+	logging.Logger.Debugf("[OK] %d backup vault deleted in %s", len(deletedNames), *session.Config.Region)
+
+	return nil
+}

aws/backup_vault_test.go

@@ -0,0 +1,45 @@
+package aws
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/backup"
+	"github.com/gruntwork-io/cloud-nuke/config"
+	"github.com/gruntwork-io/cloud-nuke/telemetry"
+	"github.com/gruntwork-io/cloud-nuke/util"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBackupVaultNuke(t *testing.T) {
+	telemetry.InitTelemetry("cloud-nuke", "")
+	t.Parallel()
+
+	region, err := getRandomRegion()
+	require.NoError(t, err)
+
+	session, err := session.NewSession(&aws.Config{Region: aws.String(region)})
+	require.NoError(t, err)
+
+	backupVaultName := createBackupVault(t, session)
+	err = nukeAllBackupVaults(session, []*string{backupVaultName})
+	require.NoError(t, err)
+
+	backupVaultNames, err := getAllBackupVault(session, config.Config{})
+	require.NoError(t, err)
+
+	assert.NotContains(t, aws.StringValueSlice(backupVaultNames), aws.StringValue(backupVaultName))
+}
+
+func createBackupVault(t *testing.T, session *session.Session) *string {
+	svc := backup.New(session)
+	output, err := svc.CreateBackupVault(&backup.CreateBackupVaultInput{
+		BackupVaultName: aws.String(fmt.Sprintf("test-backup-vault-%s", util.UniqueID())),
+	})
+	require.NoError(t, err)
+
+	return output.BackupVaultName
+}

aws/backup_vault_types.go

@@ -0,0 +1,34 @@
+package aws
+
+import (
+	awsgo "github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/gruntwork-io/go-commons/errors"
+)
+
+type BackupVault struct {
+	Names []string
+}
+
+// ResourceName - the simple name of the aws resource
+func (ct BackupVault) ResourceName() string {
+	return "backup-vault"
+}
+
+// ResourceIdentifiers - The instance ids of the ec2 instances
+func (ct BackupVault) ResourceIdentifiers() []string {
+	return ct.Names
+}
+
+func (ct BackupVault) MaxBatchSize() int {
+	return 50
+}
+
+// Nuke - nuke 'em all!!!
+func (ct BackupVault) Nuke(session *session.Session, identifiers []string) error {
+	if err := nukeAllBackupVaults(session, awsgo.StringSlice(identifiers)); err != nil {
+		return errors.WithStackTrace(err)
+	}
+
+	return nil
+}

config/config.go

@@ -58,6 +58,7 @@ type Config struct {
 	CodeDeployApplications     ResourceType `yaml:"CodeDeployApplications"`
 	ACM                        ResourceType `yaml:"ACM"`
 	SNS                        ResourceType `yaml:"SNS"`
+	BackupVault                ResourceType `yaml:"BackupVault"`
 }
 
 type ResourceType struct {

config/config_test.go

@@ -59,6 +59,7 @@ func emptyConfig() *Config {
 		ResourceType{FilterRule{}, FilterRule{}},
 		ResourceType{FilterRule{}, FilterRule{}},
 		ResourceType{FilterRule{}, FilterRule{}},
+		ResourceType{FilterRule{}, FilterRule{}},
 	}
 }