dce VS aws-nuke

I set up my own disposable cloud environment and have all my sandbox / workshops in those accounts. they get reset automatically and it watches my costs too.

Have you looked at DCE? I have covered a few projects that do similar things to Isenguard in my newsletter but can’t remember the specifics https://github.com/Optum/dce

I really wish something like https://github.com/Optum/dce got more attention or general love and care but it seems the principals have frittered away from my LinkedIn stalking.

To improve this process, I use aws-nuke, which automatically deletes all AWS resources in an AWS account. Be careful with this tool. The first time I used it, it also deleted the configurations required for IAM Identity Center. So I couldn't login anymore.

wget https://github.com/rebuy-de/aws-nuke/releases/download/v2.25.0/aws-nuke-v2.25.0-linux-amd64.tar.gz tar -zxf aws-nuke-v2.25.0-linux-amd64.tar.gz mv aws-nuke-v2.25.0-linux-amd64 aws-nuke chmod u+x aws-nuke

To give this a slightly different spin:

--> "The best optimization is simply not spinning things up."

At least for local development and testing, as made possible by LocalStack (https://localstack.cloud), among other local testing solutions and emulators.

We've seen so many teams fall into the trap of "someone forgot to shut down dev resource X for a week and now we've racked up a $$$ bill on AWS".

What is everyone's strategy to avoid this kind of situation? Tools like `aws-nuke` (https://github.com/rebuy-de/aws-nuke) are awesome (!) to clean up unused resources, but frankly they should not be necessary in the first place.

We use nuke aws at work to remove any leftovers: https://github.com/rebuy-de/aws-nuke

You can use this tool on github to nuke all resources.

There's this. I haven't used it myself, but it looks to be pretty effective: https://github.com/rebuy-de/aws-nuke

At this scale, operations can take a lot of time, because there are multiple operational tasks that we need to do when AWS accounts are leaving the AWS Organization or Teams are nuking the AWS account, StackSets Instances get drifted, because not all required resources for compliance can be secured ( SCP Limitations ), existing AWS accounts are joining the AWS Organization and all mandatory StackSets needs to be deployed, and manual steps should be reduced to a minimum. Furthermore, there is no feature from the Service itself to gain an overview of the status of drifted Instances and the general health of your StackSet health and compliance.

Since you're using CDK already, have a way to configure the deployment of the whole thing to a per-developer test account; that's still gonna cost you, but you can bundle everything in an organization / organizational unit for billing purposes, and you can also schedule https://github.com/rebuy-de/aws-nuke to run nightly to clean these accounts from longer-running resources.

And by extension, https://github.com/rebuy-de/aws-nuke as well.