Add SSM Support

[tomvachon]

No description provided.

[bethge]

?

[tomvachon]

Whoops I was testing something. Let me double check the results but I dont think it was a mandatory flag

[bethge]

To filter resources I would generally recommend the Filter() function. E.g.:

aws-nuke/resources/iam-role-policy-attachments.go

Lines 53 to 58 in f9a3a63

	func (e *IAMRolePolicyAttachment) Filter() error {
	if strings.HasPrefix(e.policyArn, "arn:aws:iam::aws:policy/aws-service-role/") {
	return fmt.Errorf("cannot detach from service roles")
	}
	return nil
	}

In this case, I actually think your approach in SSMDocument is really great. It reduces the number of resources returned and let's AWS do the filter work. I tried it briefly with aws ssm describe-patch-baselines --filters="Key=OWNER,Values=Self" and it looks promising. Wdyt?

[tomvachon]

I have an issue with Patch Baselines, which I am not sure will be easy to resolve, you can't delete the default. So either we accept that, or we make a ton of conditional coding to find the right AWS provided one which matches the right OS. Thoughts?

Its a bit irrelevant to this, but I wanted to mention it

[bethge]

Wouldn't filtering by Owner=Self resolve that issue?

[tomvachon]

Moving this to a top level question:

I have an issue with Patch Baselines, which I am not sure will be easy to resolve, you can't delete the default. So either we accept that, or we make a ton of conditional coding to find the right AWS provided one which matches the right OS. Thoughts?

Its a bit irrelevant to this, but I wanted to mention it

[tomvachon]

@bethge moving this to Top level, no, it doesnt. You can make your own a default. Then you need to make a non-nuked resource one, it might be a "put a pin in it" issue and see how often it creeps up

[tomvachon]

I removed the comment after a test to ensure that was proper

[bethge]

Ah ok, I see the problem now.

Looking at Terraform's implementation of PatchBaseline, they also do not handle deleting the default PatchBaseline deletion.

I would suggest we gracefully handle this case by filtering PatchBaseline resources with DefaultBaseline=true via the Filter() function. That would allow us to tell the user why we cannot delete that particular PatchBaseline resource.

[tomvachon]

@bethge resolved