aws-sandbox-nuke

AWS sandbox cleanup helpers for test accounts: Terraform destroy wrapper and aws-nuke configuration.

Warning: aws-nuke permanently deletes AWS resources. Use only in disposable sandbox accounts. Never point this at production.

Requirements

• AWS sandbox account (not production)
• AWS CLI
• Terraform
• aws-nuke
• Python 3.8+

pip install -r requirements.txt

Configuration

Copy the example env file and edit values:

cp .env.example .env

Variable	Purpose
AWS_ACCESS_KEY_ID	Sandbox account access key (optional if using profile)
AWS_SECRET_ACCESS_KEY	Sandbox secret key
AWS_PROFILE	Named AWS CLI profile
AWS_PROD_ACCOUNT	Production account ID listed in nuke-config.yml blocklist
ALIAS_PREFIX	Prefix for temporary IAM account alias tests
TERRAFORM_FOLDER	Terraform module directory name (default: terraform)

Edit nuke-config.yml before any real run:

• Replace <account_to_nuke> with the sandbox account ID
• Replace <prod_account> in account-blocklist with your production account ID

Usage

Destroy Terraform-managed test resources:

python run_nuke_test.py

Dry-run aws-nuke (uncomment flows in run_nuke_test.py and set flags in config.py):

aws-nuke -c nuke-config.yml --profile your-sandbox-profile

Add --no-dry-run only when you intend to delete resources.

Layout

File	Role
run_nuke_test.py	Terraform destroy and optional nuke orchestration
config.py	Loads settings from .env
nuke-config.yml	aws-nuke resource filters and account blocklist
alll_services.txt	Reference list of AWS service types for nuke config tuning

License

MIT - see LICENSE.