Repository navigation
AWS Resource Management: Cleanup and Destruction Utilities #95
Description
Summary
Document AWS resource cleanup utilities that should be migrated to proper infrastructure management.
Utility 1: Test Resource Cleanup
From cleanup_test_resources.py - Systematic AWS resource cleanup:
Features:
- NAT gateway deletion with Elastic IP release
- VPC cleanup with all associated resources (subnets, route tables, security groups, IGW)
- Handles resource dependencies correctly
- Cost-aware cleanup to prevent charges
Key Pattern:
def cleanup_resources():
# Delete NAT gateways first (expensive resources)
for nat in nats['NatGateways']:
ec2.delete_nat_gateway(NatGatewayId=nat_id)
# Release associated Elastic IPs
for addr in nat.get('NatGatewayAddresses', []):
if 'AllocationId' in addr:
ec2.release_address(AllocationId=addr['AllocationId'])
# Clean up VPC resources in dependency order
# subnets -> route tables -> security groups -> IGW -> VPCUtility 2: EKS Cluster Destruction
From destroy_cluster.py - Complete EKS cluster teardown:
Features:
- Node group deletion with wait conditions
- Cluster deletion with proper timing
- VPC and associated resource cleanup
- IAM role and policy cleanup
- Comprehensive error handling
Key Pattern:
def destroy_cluster(cluster_name, region):
# 1. Delete node groups first
for ng_name in nodegroups:
eks.delete_nodegroup(clusterName=cluster_name, nodegroupName=ng_name)
waiter.wait() # Critical: wait for completion
# 2. Delete cluster
eks.delete_cluster(name=cluster_name)
waiter.wait()
# 3. Clean up VPC (tagged with cluster name)
# 4. Clean up IAM rolesMigration Recommendation
These utilities should be moved to scripts/aws/ directory and enhanced:
- Move to proper location:
scripts/aws/cleanup_resources.pyandscripts/aws/destroy_cluster.py - Add safeguards: Confirmation prompts, dry-run mode
- Improve error handling: Better error messages and partial failure recovery
- Add logging: Structured logging for audit trails
- Configuration: Support for different AWS profiles/regions
Value
- Prevent AWS charges from abandoned test resources
- Provide safe cluster teardown procedures
- Handle complex AWS resource dependencies
- Support infrastructure as code practices
Source: Repository cleanup Issue #72
Activity
jeremymanning commentedon Aug 17, 2026
Status correction (audit 2026-08-17): the scripts exist locally but have never been pushed, and the requested safeguards are missing.
scripts/aws/cleanup_test_resources.pyandscripts/aws/destroy_cluster.pyexist in the working tree but are absent fromorigin/master— they are part of the 30 unpushed local commits. Nobody but this laptop has them.Safeguards requested by this issue are not implemented:
grep -rn "dry_run\|confirm\|input(" scripts/aws/*.pyreturns 0 hits. These are unguarded resource-destruction scripts — no dry-run mode, no confirmation prompt, no scoping check.Given that, this issue should stay open with its scope sharpened to: (1) push the scripts, (2) add
--dry-runas the default with an explicit--yesto actually destroy, (3) add a tag/name-prefix filter so the scripts cannot touch non-test resources, and (4) a test that asserts the default invocation destroys nothing.Fix three fabricated-result bugs, close the RCE, and overhaul the doc…
jeremymanning commentedon Aug 19, 2026
Resolved
Both utilities exist and are safe by construction.
Dry run is the default.
cleanup_resources.py:251-254deletes only when--executeis passed; without it the script prints what it would delete and exits. Both scripts take--regionand--executethroughargparseand print every resource before touching it.Ownership is checked. Neither will touch a resource that is not tagged
clustrix:managed=true. This is the thing the originals — recovered from git history — did not do: they deleted every NAT gateway and VPC in the account with no ownership check at all.Tested without mocks.
tests/unit/test_aws_cleanup_scripts.pyhas 21 tests and zero boto3 mocks.boto3is imported lazily with its own message ("boto3 is not a clustrix dependency; these AWS utilities are optional"), so these scripts stay useful without adding a dependency — which is why they survived the removal of the AWS backend in PR #149. They are operator teardown tooling, not an execution backend.