run

AWSTemplateFormatVersion: 2010-09-09
Description: |
  **A single CloudFormation file** that deletes all resources in the running AWS account.
  It uses aws-nuke by rebuy-de (https://github.com/rebuy-de/aws-nuke) binary for nuking your account.

Parameters:
  LatestAmiId:
    Type: 'AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>'
    Default: '/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2'

Resources:
  WorkerVPC:
    Type: AWS::EC2::VPC
    DependsOn:
      - WorkerRole
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: nukeme-vpc

  WorkerIGW:
    Type: AWS::EC2::InternetGateway
    DependsOn:
      - WorkerRole
    Properties:
      Tags:
        - Key: Name
          Value:  nukeme-igw

  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    DependsOn:
      - WorkerRole
    Properties:
      InternetGatewayId: !Ref WorkerIGW
      VpcId: !Ref WorkerVPC

  WorkerRouteTable:
    Type: AWS::EC2::RouteTable
    DependsOn:
      - WorkerRole
    Properties:
      VpcId: !Ref WorkerVPC
      Tags:
        - Key: Name
          Value: nukeme-rtb-public

  DefaultWorkerRoute:
    Type: AWS::EC2::Route
    DependsOn:
      - WorkerRole
      - InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref WorkerRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref WorkerIGW

  WorkerSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    DependsOn:
      - WorkerRole
    Properties:
      RouteTableId: !Ref WorkerRouteTable
      SubnetId: !Ref WorkerSubnet

  WorkerSubnet:
    Type: AWS::EC2::Subnet
    DependsOn:
      - WorkerRole
    Properties:
      VpcId: !Ref WorkerVPC
      AvailabilityZone: !Select [ 0, !GetAZs '' ]
      CidrBlock: 10.0.0.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: nukeme-subnet-public-a

  WorkerSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    DependsOn:
      - WorkerRole
    Properties:
      GroupName: nukeme-sg
      GroupDescription: "Allow nukeme worker to connect aws api endpoints"
      VpcId: !Ref WorkerVPC
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: nukeme-sg-worker

  WorkerRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: nukeme-role-worker
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - ec2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: /
      Policies:
        - PolicyName: nukeme-policy-admin
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: '*'
                Resource: '*'

  WorkerInstanceProfile:
    Type: 'AWS::IAM::InstanceProfile'
    DependsOn:
      - WorkerRole
    Properties:
      Path: /
      InstanceProfileName: nukeme-role-worker
      Roles:
        - !Ref WorkerRole

  WorkerLogGroup:
    Type: AWS::Logs::LogGroup
    DependsOn:
      - WorkerRole
    Properties:
      LogGroupName: nukeme-log
      RetentionInDays: 1
  
  WorkerLogStream:
    Type: AWS::Logs::LogStream
    DependsOn:
      - WorkerRole
    Properties:
      LogGroupName: !Ref WorkerLogGroup
      LogStreamName: nukeme-worker-log

  WorkerInstance:
    Type: AWS::EC2::Instance
    DependsOn:
      - WorkerRole
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: t3.micro
      IamInstanceProfile: !Ref WorkerInstanceProfile
      PropagateTagsToVolumeOnCreation: true
      NetworkInterfaces: 
        - AssociatePublicIpAddress: "true"
          DeviceIndex: "0"
          GroupSet: 
            - !Ref WorkerSecurityGroup
          SubnetId:
            !Ref WorkerSubnet
      UserData: 
        Fn::Base64: !Sub
          - |
            #!/bin/sh
            yum install -y amazon-cloudwatch-agent

            mkdir -p /opt/aws/amazon-cloudwatch-agent/etc
            cat <<EOF > /opt/aws/amazon-cloudwatch-agent/etc/amazon-cloudwatch-agent.json
            {
              "agent": {
                "run_as_user": "root"
              },
              "logs": {
                "logs_collected": {
                  "files": {
                    "collect_list": [
                      {
                        "file_path": "/var/log/cloud-init-output.log",
                        "log_group_name": "nukeme-log",
                        "log_stream_name": "nukeme-worker-log",
                        "retention_in_days": 1
                      }
                    ]
                  }
                }
              },
              "metrics": {
                "metrics_collected": {
                  "collectd": {
                    "metrics_aggregation_interval": 60
                  }
                }
              }
            }
            EOF

            mkdir -p /usr/share/collectd
            touch /usr/share/collectd/types.db
            systemctl enable --now amazon-cloudwatch-agent.service

            wget https://github.com/rebuy-de/aws-nuke/releases/download/v2.25.0/aws-nuke-v2.25.0-linux-amd64.tar.gz
            tar xvf aws-nuke-v2.25.0-linux-amd64.tar.gz
            chmod +x aws-nuke-v2.25.0-linux-amd64

            cat <<EOF > config.yaml
            regions:
              - global
              - ${AWS::Region}

            account-blocklist:
            - "999999999999"

            resource-types:
              excludes:
                - EC2DHCPOption              

            accounts:
              "${AWS::AccountId}":
                filters:
                  CloudFormationStack:
                    - "${AWS::StackName}"
                  EC2VPC:
                    - property: tag:Name
                      value: nukeme-vpc
                  EC2InternetGateway:
                    - property: tag:Name
                      value: nukeme-igw
                  EC2InternetGatewayAttachment:
                    - property: tag:igw:Name
                      value: nukeme-igw
                  EC2RouteTable:
                    - property: tag:Name
                      value: nukeme-rtb-public
                  EC2Subnet:
                    - property: tag:Name
                      value: nukeme-subnet-public-a
                  EC2SecurityGroup:
                    - property: tag:Name
                      value: nukeme-sg-worker
                  IAMRole:
                    - "nukeme-role-worker"
                  IAMRolePolicy:
                    - "nukeme-role-worker -> nukeme-policy-admin"
                  IAMInstanceProfile:
                    - "nukeme-role-worker"
                  IAMInstanceProfileRole:
                    - "nukeme-role-worker -> nukeme-role-worker"
                  CloudWatchLogsLogGroup:
                    - "nukeme-log"
                  EC2Instance:
                    - property: tag:Name
                      value: nukeme-worker
                  EC2Volume:
                    - property: tag:Name
                      value: "nukeme-worker"
                  EC2NetworkInterface:
                    - property: VPC
                      value: ${Vpc}
            EOF

            ./aws-nuke-v2.25.0-linux-amd64 -c config.yaml --force-sleep 3 --force --no-dry-run

            echo "☢️ Nuking finished. If you have any problems: https://github.com/cloudshit/nukeme/issues/new"
            sleep 10

            aws cloudformation delete-stack --stack-name "${AWS::StackName}" --region ${AWS::Region}
          - Vpc: !Ref WorkerVPC
      Tags:
        - Key: Name
          Value: nukeme-worker

Outputs:
  Monitoring:
    Description: Monitor aws-nuke with Cloudwatch Live Tail service.
    Value: !Sub "https://${AWS::Region}.console.aws.amazon.com/cloudwatch/home?region=${AWS::Region}#logsV2:live-tail$3FlogGroupArns$3D~(~'arn*3aaws*3alogs*3a${AWS::Region}*3a${AWS::AccountId}*3alog-group*3anukeme-log*3a*2a)$26logStreamNames$3D~(~'nukeme-worker-log)"
  Notice:
    Description: Notice
    Value: DO NOT delete this CloudFormation stack manually. this will automatically destroy itself when finished.