ekristen/aws-nuke

package resources

import (
    "context"
    "fmt"
    "strings"

    "github.com/sirupsen/logrus"

    "github.com/aws/aws-sdk-go/service/iam"
    "github.com/aws/aws-sdk-go/service/iam/iamiface"

    "github.com/ekristen/libnuke/pkg/registry"
    "github.com/ekristen/libnuke/pkg/resource"
    "github.com/ekristen/libnuke/pkg/types"

    "github.com/ekristen/aws-nuke/v3/pkg/nuke"
)

const IAMRolePolicyResource = "IAMRolePolicy"

func init() {
    registry.Register(&registry.Registration{
        Name:     IAMRolePolicyResource,
        Scope:    nuke.Account,
        Resource: &IAMRolePolicy{},
        Lister:   &IAMRolePolicyLister{},
    })
}

type IAMRolePolicy struct {
    svc        iamiface.IAMAPI
    roleID     string
    rolePath   string
    roleName   string
    policyName string
    roleTags   []*iam.Tag
}

func (e *IAMRolePolicy) Filter() error {
    if strings.HasPrefix(e.rolePath, "/aws-service-role/") {
        return fmt.Errorf("cannot alter service roles")
    }
    if strings.HasPrefix(e.rolePath, "/aws-reserved/sso.amazonaws.com/") {
        return fmt.Errorf("cannot alter sso roles")
    }
    return nil
}

func (e *IAMRolePolicy) Remove(_ context.Context) error {
    _, err := e.svc.DeleteRolePolicy(
        &iam.DeleteRolePolicyInput{
            RoleName:   &e.roleName,
            PolicyName: &e.policyName,
        })
    if err != nil {
        return err
    }

    return nil
}

func (e *IAMRolePolicy) Properties() types.Properties {
    properties := types.NewProperties()
    properties.Set("PolicyName", e.policyName)
    properties.Set("role:RoleName", e.roleName)
    properties.Set("role:RoleID", e.roleID)
    properties.Set("role:Path", e.rolePath)

    for _, tagValue := range e.roleTags {
        properties.SetTagWithPrefix("role", tagValue.Key, tagValue.Value)
    }
    return properties
}

func (e *IAMRolePolicy) String() string {
    return fmt.Sprintf("%s -> %s", e.roleName, e.policyName)
}

// ----------------------

type IAMRolePolicyLister struct{}

func (l *IAMRolePolicyLister) List(_ context.Context, o interface{}) ([]resource.Resource, error) {
    opts := o.(*nuke.ListerOpts)

    svc := iam.New(opts.Session)
    roleParams := &iam.ListRolesInput{}
    resources := make([]resource.Resource, 0)

    for {
        roles, err := svc.ListRoles(roleParams)
        if err != nil {
            return nil, err
        }

        for _, listedRole := range roles.Roles {
            role, err := GetIAMRole(svc, listedRole.RoleName)
            if err != nil {
                logrus.Errorf("Failed to get listed role %s: %v", *listedRole.RoleName, err)
                continue
            }

            polParams := &iam.ListRolePoliciesInput{
                RoleName: role.RoleName,
            }

            for {
                policies, err := svc.ListRolePolicies(polParams)
                if err != nil {
                    logrus.
                        WithError(err).
                        WithField("roleName", *role.RoleName).
                        Error("Failed to list policies")
                    break
                }

                for _, policyName := range policies.PolicyNames {
                    resources = append(resources, &IAMRolePolicy{
                        svc:        svc,
                        roleID:     *role.RoleId,
                        roleName:   *role.RoleName,
                        rolePath:   *role.Path,
                        policyName: *policyName,
                        roleTags:   role.Tags,
                    })
                }

                if !*policies.IsTruncated {
                    break
                }

                polParams.Marker = policies.Marker
            }
        }

        if !*roles.IsTruncated {
            break
        }

        roleParams.Marker = roles.Marker
    }

    return resources, nil
}