AWSweeper

A tool for cleaning your AWS account

AWSweeper is able to clean out over 290 resource types in your AWS account. Resources to be deleted can be filtered by their type, ID, tags, or creation date using regular expressions declared in a YAML file (see filter.yml as an example).

To keep up supporting the continuously growing number of new resources, AWSweeper is standing upon the shoulders of delete routines provided by the Terraform AWS provider. List operations are borrowed from the awsls open-source project and are code-generated based on the model of the AWS API.

Not being fully there yet, but the goal is to support every AWS resource that is covered by Terraform (currently over 500) without adding or maintaining much code here.

If you run into issues deleting resources, please open an issue or ping me on Twitter.

Happy erasing!

New: awsrm got released! It's a Unix-like rm to simplify deleting AWS resources across multiple accounts + regions and integrates well with other Unix-like tools, such as grep for filtering resources by tags or other attributes. Go and check it out!

Example

Features

• Nothing will be deleted without your confirmation. AWSweeper always lists all resources first and then waits for

• Using the -force flag (dangerous!), AWSweeper can in run an automated fashion without human interaction and approval,

Installation

Binary Releases

You can download a specific version of AWSweeper on the releases page or install it the following way to ./bin/:

curl -sSfL https://raw.githubusercontent.com/jckuester/awsweeper/master/install.sh | sh -s v0.11.1

Homebrew

Homebrew users can install by:

brew install jckuester/tap/awsweeper

For more information on Homebrew taps please see the tap documentation.

Usage

awsweeper [options]

To see options available run awsweeper --help.

Filter

Resources are deleted via a filter declared in a YAML file.

aws_instance: # instance filter part 1 - id: ^foo.* created: before: 2018-10-14 after: 2018-06-28 12:28:39

# instance filter part 2 - tags: foo: bar NOT(owner): .*

awssecuritygroups:

The filter snippet above deletes all EC2 instances that ID matches ^foo.* and that have been created between 2018-06-28 12:28:39 and 2018-10-14 UTC (instance filter part 1); additionally, EC2 instances having a tag foo: bar AND not a tag key owner with any value are deleted (instance filter part 2); last but not least, ALL security groups are deleted by this filter.

The general filter syntax is as follows:

: - id: | NOT() tagged: bool (optional) tags: | NOT(key): | NOT() ... created: before: (optional) after: (optional) # OR - ... : ...

Here is a more detailed description of the various ways to filter resources:

1) Delete all resources of a particular type

Terraform resource type identifiers are used to delete resources by type. The following filter snippet deletes ALL security groups, IAM roles, and EC2 instances:

awssecuritygroup: awsiamrole: aws_instance:

Don't forget the : at the end of each line.

2) Delete by tags

If most of your resources have tags, this is probably the best way to filter them for deletion. Be aware: Not all resources support tags yet and can be filtered this way.

The key and the value part of the tag filter can be negated by a surrounding NOT(...). This allows for removing of all resources not matching some tag key or value. In the example below, all EC2 instances without the owner: me tag are deleted:

aws_instance: - tags: NOT(Owner): me

The flag tagged: false deletes all resources that have no tags. Contrary, resources with any tags can be deleted with tagged: true:

aws_instance: - tagged: true

3) Delete By ID

You can filter resources of a particular type based on their IDs.

To see what the IDs for a type of resource look like (sometimes it's the name, sometimes the ARN, ...), run AWSweeper first in dry-run mode. Then, use this information to create the YAML filter accordingly.

The id filter can be negated by surrounding the regex with NOT(...)

4) By creation date

You can select resources by filtering on the date they have been created using an absolute or relative date.

The supported formats are: * Relative * Nanosecond: 1ns * Microsecond: 1us * Millisecond: 1ms * Second: 1s * Minute: 1m * Hour: 1h * Day: 1d * Week: 1w * Month: 1M * Year: 1y * Absolute: * RCF3339Nano, short dates: 2006-1-2T15:4:5.999999999Z07:00 * RFC3339Nano, short date, lower-case "t": 2006-1-2t15:4:5.999999999Z07:00 * Space separated, no time zone: 2006-1-2 15:4:5.999999999 * Date only: 2006-1-2

Supported resources

The list below shows the 297 supported (Terraform) resource types, which have to be used in the YAML file to filter resources by their type.

| Service / Resource Type | Delete by tag | Delete by creation date | :----------------------------- |:-------------:|:-----------------------: | accessanalyzer | | awsaccessanalyzeranalyzer | x | | | acm | | awsacmcertificate | x | | | apigateway | | awsapigatewayapikey | x | | | awsapigatewayclientcertificate | x | | | awsapigatewaydomainname | x | | | awsapigatewayrestapi | x | | | awsapigatewayusageplan | x | | | awsapigatewayvpclink | x | | | apigatewayv2 | | awsapigatewayv2api | x | | | awsapigatewayv2domain_name | x | | | awsapigatewayv2vpc_link | x | | | appmesh | | awsappmeshmesh | x | | | appsync | | awsappsyncgraphql_api | x | | | athena | | awsathenanamed_query | | | | awsathenaworkgroup | x | x | | autoscaling | | awsautoscalinggroup | x | x | | awslaunchconfiguration | | x | | backup | | awsbackupplan | x | x | | awsbackupvault | x | x | | batch | | awsbatchcompute_environment | x | | | awsbatchjob_definition | x | | | cloudformation | | awscloudformationstack | x | x | | awscloudformationstack_set | x | | | awscloudformationtype | | | | cloudhsmv2 | | awscloudhsmv2_cluster | x | | | cloudtrail | | aws_cloudtrail | x | | | cloudwatch | | awscloudwatchdashboard | | | | cloudwatchevents | | awscloudwatchevent_archive | | x | | awscloudwatchevent_bus | x | | | cloudwatchlogs | | awscloudwatchlog_destination | | x | | awscloudwatchlog_group | x | x | | awscloudwatchlogresourcepolicy | | | | awscloudwatchquery_definition | | | | codeartifact | | awscodeartifactdomain | x | x | | awscodeartifactrepository | x | | | codebuild | | awscodebuildproject | x | | | awscodebuildreport_group | x | | | awscodebuildsource_credential | | | | codecommit | | awscodecommitrepository | x | | | codedeploy | | awscodedeploydeployment_config | | | | codepipeline | | awscodepipelinewebhook | x | | | codestarconnections | | awscodestarconnectionsconnection | x | | | awscodestarconnectionshost | | | | codestarnotifications | | awscodestarnotificationsnotification_rule | x | | | configservice | | awsconfigconfig_rule | x | | | awsconfigconfiguration_aggregator | x | x | | awsconfigconfiguration_recorder | | | | awsconfigconformance_pack | | | | awsconfigdelivery_channel | | | | costandusagereportservice | | awscurreport_definition | | | | databasemigrationservice | | awsdmscertificate | x | | | awsdmsendpoint | x | | | awsdmsreplicationsubnetgroup | x | | | awsdmsreplication_task | x | | | datasync | | awsdatasyncagent | x | | | awsdatasynctask | x | | | dax | | awsdaxparameter_group | | | | awsdaxsubnet_group | | | | devicefarm | | awsdevicefarmproject | | | | directconnect | | awsdxconnection | x | | | awsdxhostedprivatevirtual_interface | | | | awsdxhostedpublicvirtual_interface | | | | awsdxhostedtransitvirtual_interface | | | | awsdxlag | x | | | awsdxprivatevirtualinterface | x | | | awsdxpublicvirtualinterface | x | | | awsdxtransitvirtualinterface | x | | | dlm | | awsdlmlifecycle_policy | x | | | dynamodb | | awsdynamodbglobal_table | | | | awsdynamodbtable | x | | | ec2 | | aws_ami | x | x | | awsebssnapshot | x | x | | awsebsvolume | x | x | | awsec2capacity_reservation | x | x | | awsec2carrier_gateway | x | | | awsec2clientvpnendpoint | x | x | | awsec2fleet | x | x | | awsec2localgatewayroutetablevpc_association | x | | | awsec2managedprefixlist | x | | | awsec2trafficmirrorfilter | x | | | awsec2trafficmirrorsession | x | | | awsec2trafficmirrortarget | x | | | awsec2transit_gateway | x | x | | awsec2transitgatewaypeering_attachment | x | x | | awsec2transitgatewayroute_table | x | x | | awsec2transitgatewayvpc_attachment | x | x | | awsegressonlyinternetgateway | x | | | aws_eip | x | | | aws_instance | x | x | | awsinternetgateway | x | | | awskeypair | x | | | awslaunchtemplate | x | x | | awsnatgateway | x | x | | awsnetworkacl | x | | | awsnetworkinterface | x | | | awsplacementgroup | x | | | awsroutetable | x | | | awssecuritygroup | x | | | awsspotfleet_request | x | x | | awsspotinstance_request | x | x | | aws_subnet | x | | | aws_vpc | x | | | awsvpcendpoint | x | x | | awsvpcendpointconnectionnotification | | | | awsvpcendpoint_service | x | | | awsvpcpeering_connection | x | | | awsvpngateway | x | | | ecr | | awsecrrepository | x | | | ecrpublic | | awsecrpublicrepository | | | | ecs | | awsecscluster | x | | | awsecstask_definition | x | | | efs | | awsefsaccess_point | x | | | awsefsfile_system | x | x | | eks | | awsekscluster | x | | | elasticache | | awselasticacheglobalreplicationgroup | | | | awselasticachereplication_group | x | | | elasticbeanstalk | | awselasticbeanstalk_application | x | | | awselasticbeanstalkapplicationversion | x | | | awselasticbeanstalk_environment | x | | | elastictranscoder | | awselastictranscoderpipeline | | | | awselastictranscoderpreset | | | | elb | | aws_elb | x | x | | elbv2 | | awsalbtarget_group | x | | | aws_lb | x | x | | awslbtarget_group | x | | | emr | | awsemrsecurity_configuration | | | | firehose | | awskinesisfirehosedeliverystream | x | | | fms | | awsfmspolicy | | | | fsx | | awsfsxlustrefilesystem | x | x | | awsfsxwindowsfilesystem | x | x | | gamelift | | awsgameliftalias | x | x | | awsgameliftbuild | x | x | | awsgameliftfleet | x | | | awsgameliftgamesessionqueue | x | | | globalaccelerator | | awsglobalacceleratoraccelerator | x | x | | glue | | awsgluecrawler | x | x | | awsgluedev_endpoint | x | | | awsgluejob | x | | | awsglueml_transform | x | | | awsglueregistry | x | x | | awsglueschema | x | x | | awsgluesecurity_configuration | | | | awsgluetrigger | x | | | awsglueworkflow | x | | | guardduty | | awsguarddutydetector | x | | | iam | | awsiamaccess_key | | x | | awsiamaccount_alias | | | | awsiamgroup | | x | | awsiaminstance_profile | x | x | | awsiampolicy | x | x | | awsiamrole | x | x | | awsiamserver_certificate | x | | | awsiamservicelinkedrole | | x | | awsiamuser | x | x | | imagebuilder | | awsimagebuildercomponent | x | | | awsimagebuilderdistribution_configuration | x | | | awsimagebuilderimage | x | | | awsimagebuilderimage_pipeline | x | | | awsimagebuilderimage_recipe | x | | | awsimagebuilderinfrastructure_configuration | x | | | iot | | awsiotcertificate | | x | | awsiotpolicy | | | | awsiotrole_alias | | | | awsiotthing | | | | awsiotthing_type | | | | awsiottopic_rule | x | | | kafka | | awsmskcluster | x | x | | awsmskconfiguration | | x | | kinesis | | awskinesisstream | x | | | kinesisanalytics | | awskinesisanalytics_application | x | | | kinesisanalyticsv2 | | awskinesisanalyticsv2application | x | | | kms | | awskmsexternal_key | x | | | awskmskey | x | | | lambda | | awslambdacodesigningconfig | | | | awslambdaeventsourcemapping | | | | awslambdafunction | x | | | lexmodelbuildingservice | | awslexbot | | | | awslexintent | | | | awslexslot_type | | | | licensemanager | | awslicensemanagerlicense_configuration | x | | | lightsail | | awslightsaildomain | | | | awslightsailinstance | x | | | awslightsailkey_pair | | | | awslightsailstatic_ip | | | | macie2 | | awsmacie2classification_job | x | | | awsmacie2customdataidentifier | x | | | awsmacie2findings_filter | x | | | mediaconvert | | awsmediaconvert_queue | x | | | mediapackage | | awsmediapackage_channel | x | | | mediastore | | awsmediastore_container | x | x | | mq | | awsmqbroker | x | | | awsmqconfiguration | x | | | mwaa | | awsmwaaenvironment | x | | | neptune | | awsneptuneevent_subscription | x | | | networkfirewall | | awsnetworkfirewallfirewall | x | | | awsnetworkfirewallfirewall_policy | x | | | awsnetworkfirewallrule_group | x | | | opsworks | | awsopsworksstack | x | | | awsopsworksuser_profile | | | | qldb | | awsqldbledger | x | | | rds | | awsdbevent_subscription | x | | | awsdbinstance | x | x | | awsdbparameter_group | x | | | awsdbproxy | x | | | awsdbsecurity_group | x | | | awsdbsnapshot | x | x | | awsdbsubnet_group | x | | | awsrdscluster | x | | | awsrdscluster_endpoint | x | | | awsrdsclusterparametergroup | x | | | awsrdsglobal_cluster | | | | redshift | | awsredshiftcluster | x | | | awsredshiftevent_subscription | x | | | awsredshiftparameter_group | x | | | awsredshiftsecurity_group | | | | awsredshiftsnapshotcopygrant | x | | | awsredshiftsnapshot_schedule | x | | | awsredshiftsubnet_group | x | | | route53 | | awsroute53health_check | x | | | awsroute53zone | x | | | route53resolver | | awsroute53resolver_endpoint | x | x | | awsroute53resolverquerylog_config | x | x | | awsroute53resolverquerylogconfigassociation | | x | | awsroute53resolver_rule | x | x | | awsroute53resolverruleassociation | | | | s3 | | awss3bucket | x | x | | s3outposts | | awss3outpostsendpoint | | x | | sagemaker | | awssagemakerappimageconfig | | x | | awssagemakercode_repository | | x | | awssagemakerendpoint | x | x | | awssagemakerfeature_group | x | x | | awssagemakermodel | x | x | | awssagemakermodelpackagegroup | x | x | | secretsmanager | | awssecretsmanagersecret | x | | | securityhub | | awssecurityhubaction_target | | | | awssecurityhubinsight | | | | servicecatalog | | awsservicecatalogportfolio | x | x | | awsservicecatalogservice_action | | | | awsservicecatalogtag_option | | | | servicediscovery | | awsservicediscovery_service | x | x | | ses | | awssesactivereceiptrule_set | | | | awssesconfiguration_set | | | | awssesdomain_identity | | | | awssesemail_identity | | | | awssesreceipt_filter | | | | awssesreceiptruleset | | | | awssestemplate | | | | sfn | | awssfnactivity | x | x | | awssfnstate_machine | x | x | | signer | | awssignersigning_job | | | | awssignersigning_profile | x | | | sns | | awssnsplatform_application | | | | awssnstopic | x | | | awssnstopic_subscription | | | | sqs | | awssqsqueue | x | | | ssm | | awsssmactivation | x | | | awsssmassociation | | | | awsssmdocument | x | | | awsssmmaintenance_window | x | | | awsssmparameter | x | | | awsssmpatch_baseline | x | | | awsssmresourcedatasync | | | | storagegateway | | awsstoragegatewaygateway | x | | | awsstoragegatewaytape_pool | x | | | synthetics | | awssyntheticscanary | x | | | timestreamwrite | | awstimestreamwritedatabase | x | x | | transfer | | awstransferserver | x | | | waf | | awswafbytematchset | | | | awswafgeomatchset | | | | awswafipset | | | | awswafratebasedrule | x | | | awswafregexmatchset | | | | awswafregexpatternset | | | | awswafrule | x | | | awswafrule_group | x | | | awswafsizeconstraintset | | | | awswafsqlinjectionmatch_set | | | | awswafweb_acl | x | | | awswafxssmatchset | | | | wafregional | | awswafregionalbytematchset | | | | awswafregionalgeomatchset | | | | awswafregionalipset | | | | awswafregionalratebasedrule | x | | | awswafregionalregexmatchset | | | | awswafregionalregexpatternset | | | | awswafregionalrule | x | | | awswafregionalrule_group | x | | | awswafregionalsizeconstraintset | | | | awswafregionalsqlinjectionmatch_set | | | | awswafregionalweb_acl | x | | | awswafregionalxssmatchset | | | | wafv2 | | awswafv2webacllogging_configuration | | | | worklink | | awsworklinkfleet | | x | | workspaces | | awsworkspacesdirectory | x | | | awsworkspacesip_group | x | | | awsworkspacesworkspace | x | | | xray | | awsxraygroup | x | |

Acceptance tests

IMPORTANT: Acceptance tests create real resources that might cost you money. Also, note that if you contribute a PR, the Travis build will always fail since AWS credentials are not injected into the PR build coming from forks for security reasons. You can either run tests locally against your personal AWS account or ask me to run them for you instead.

Run all acceptance tests with

AWSPROFILE= AWSDEFAULT_REGION=us-west-2 make test-all

or to test the working of AWSweeper for a just single resource, such as aws_vpc, use

AWSPROFILE= AWSDEFAULTREGION=us-west-2 make test-all TESTARGS='-run=TestAccVpc*'

Disclaimer

You are using this tool at your own risk! I will not take responsibility if you delete any critical resources in your production environments.