Skip to content

Commit b8a62d8

Browse files
author
Yuriy Bezsonov
committed
Update clean up
1 parent ba42ce3 commit b8a62d8

5 files changed

Lines changed: 144 additions & 117 deletions

File tree

‎infra/cdk/src/main/resources/lambda/cfn-pre-delete-cleanup.py‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,8 @@ def start_guardduty_endpoint_deletion(vpc_id):
6767

6868
return endpoint_ids
6969

70-
def cleanup_guardduty_security_groups(vpc_id):
71-
"""Delete GuardDuty managed security groups for the VPC."""
70+
def cleanup_guardduty_security_groups(vpc_id, max_retries=6, retry_delay=10):
71+
"""Delete GuardDuty managed security groups for the VPC with retry logic."""
7272
if not vpc_id:
7373
print("No VPC ID provided, skipping security group cleanup")
7474
return
@@ -92,11 +92,20 @@ def cleanup_guardduty_security_groups(vpc_id):
9292
sg_id = sg['GroupId']
9393
sg_name = sg['GroupName']
9494
print(f"Deleting GuardDuty security group: {sg_name} ({sg_id})")
95-
try:
96-
ec2.delete_security_group(GroupId=sg_id)
97-
print(f"Deleted security group: {sg_id}")
98-
except Exception as e:
99-
print(f"Error deleting security group {sg_id}: {e}")
95+
96+
# Retry deletion - ENIs may take time to detach after endpoint deletion
97+
for attempt in range(max_retries):
98+
try:
99+
ec2.delete_security_group(GroupId=sg_id)
100+
print(f"Deleted security group: {sg_id}")
101+
break
102+
except ec2.exceptions.ClientError as e:
103+
if 'DependencyViolation' in str(e) and attempt < max_retries - 1:
104+
print(f"Security group has dependencies, waiting {retry_delay}s (attempt {attempt + 1}/{max_retries})...")
105+
time.sleep(retry_delay)
106+
else:
107+
print(f"Error deleting security group {sg_id}: {e}")
108+
break
100109

101110
except Exception as e:
102111
print(f"Error listing GuardDuty security groups: {e}")

‎infra/cfn/base-stack.yaml‎

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -676,25 +676,6 @@ Resources:
676676
Fn::GetAtt:
677677
- IdeInstanceLauncherFunction803C5A2A
678678
- Arn
679-
VolumeSize: "50"
680-
SubnetIds:
681-
Fn::Join:
682-
- ""
683-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
684-
- ","
685-
- Ref: VpcPublicSubnet2SubnetA811849C
686-
SecurityGroupIds:
687-
Fn::Join:
688-
- ""
689-
- - Fn::GetAtt:
690-
- IdeSecurityGroup73B02454
691-
- GroupId
692-
- ","
693-
- Fn::GetAtt:
694-
- IdeInternalSecurityGroupB0A5D76B
695-
- GroupId
696-
ImageId:
697-
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61arm64C96584B6F00A464EAD1953AFF4B05118Parameter
698679
UserData:
699680
Fn::Base64:
700681
Fn::Join:
@@ -837,6 +818,25 @@ Resources:
837818
Fn::GetAtt:
838819
- IdeInstanceProfile61B92038
839820
- Arn
821+
VolumeSize: "50"
822+
SubnetIds:
823+
Fn::Join:
824+
- ""
825+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
826+
- ","
827+
- Ref: VpcPublicSubnet2SubnetA811849C
828+
SecurityGroupIds:
829+
Fn::Join:
830+
- ""
831+
- - Fn::GetAtt:
832+
- IdeSecurityGroup73B02454
833+
- GroupId
834+
- ","
835+
- Fn::GetAtt:
836+
- IdeInternalSecurityGroupB0A5D76B
837+
- GroupId
838+
ImageId:
839+
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61arm64C96584B6F00A464EAD1953AFF4B05118Parameter
840840
UpdateReplacePolicy: Delete
841841
DeletionPolicy: Delete
842842
IdeEipAssociationDFF81215:

‎infra/cfn/java-ai-agents-stack.yaml‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -757,30 +757,7 @@ Resources:
757757
Fn::GetAtt:
758758
- IdeInstanceLauncherFunction803C5A2A
759759
- Arn
760-
InstanceName: ide
761-
IamInstanceProfileArn:
762-
Fn::GetAtt:
763-
- IdeInstanceProfile61B92038
764-
- Arn
765-
VolumeSize: "50"
766-
SubnetIds:
767-
Fn::Join:
768-
- ""
769-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
770-
- ","
771-
- Ref: VpcPublicSubnet2SubnetA811849C
772-
SecurityGroupIds:
773-
Fn::Join:
774-
- ""
775-
- - Fn::GetAtt:
776-
- IdeSecurityGroup73B02454
777-
- GroupId
778-
- ","
779-
- Fn::GetAtt:
780-
- IdeInternalSecurityGroupB0A5D76B
781-
- GroupId
782-
ImageId:
783-
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61arm64C96584B6F00A464EAD1953AFF4B05118Parameter
760+
InstanceTypes: m7g.xlarge,m6g.xlarge,c7g.xlarge,t4g.xlarge
784761
UserData:
785762
Fn::Base64:
786763
Fn::Join:
@@ -917,7 +894,30 @@ Resources:
917894
"
918895
exit 1
919896
fi
920-
InstanceTypes: m7g.xlarge,m6g.xlarge,c7g.xlarge,t4g.xlarge
897+
ImageId:
898+
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61arm64C96584B6F00A464EAD1953AFF4B05118Parameter
899+
SecurityGroupIds:
900+
Fn::Join:
901+
- ""
902+
- - Fn::GetAtt:
903+
- IdeSecurityGroup73B02454
904+
- GroupId
905+
- ","
906+
- Fn::GetAtt:
907+
- IdeInternalSecurityGroupB0A5D76B
908+
- GroupId
909+
SubnetIds:
910+
Fn::Join:
911+
- ""
912+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
913+
- ","
914+
- Ref: VpcPublicSubnet2SubnetA811849C
915+
VolumeSize: "50"
916+
IamInstanceProfileArn:
917+
Fn::GetAtt:
918+
- IdeInstanceProfile61B92038
919+
- Arn
920+
InstanceName: ide
921921
UpdateReplacePolicy: Delete
922922
DeletionPolicy: Delete
923923
IdeEipAssociationDFF81215:

‎infra/cfn/java-on-amazon-eks-stack.yaml‎

Lines changed: 43 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -777,12 +777,8 @@ Resources:
777777
Fn::GetAtt:
778778
- IdeInstanceLauncherFunction803C5A2A
779779
- Arn
780-
IamInstanceProfileArn:
781-
Fn::GetAtt:
782-
- IdeInstanceProfile61B92038
783-
- Arn
784-
InstanceName: ide
785-
InstanceTypes: m7g.xlarge,m6g.xlarge,c7g.xlarge,t4g.xlarge
780+
ImageId:
781+
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61arm64C96584B6F00A464EAD1953AFF4B05118Parameter
786782
UserData:
787783
Fn::Base64:
788784
Fn::Join:
@@ -919,8 +915,19 @@ Resources:
919915
"
920916
exit 1
921917
fi
922-
ImageId:
923-
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61arm64C96584B6F00A464EAD1953AFF4B05118Parameter
918+
InstanceTypes: m7g.xlarge,m6g.xlarge,c7g.xlarge,t4g.xlarge
919+
InstanceName: ide
920+
IamInstanceProfileArn:
921+
Fn::GetAtt:
922+
- IdeInstanceProfile61B92038
923+
- Arn
924+
VolumeSize: "50"
925+
SubnetIds:
926+
Fn::Join:
927+
- ""
928+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
929+
- ","
930+
- Ref: VpcPublicSubnet2SubnetA811849C
924931
SecurityGroupIds:
925932
Fn::Join:
926933
- ""
@@ -931,13 +938,6 @@ Resources:
931938
- Fn::GetAtt:
932939
- IdeInternalSecurityGroupB0A5D76B
933940
- GroupId
934-
SubnetIds:
935-
Fn::Join:
936-
- ""
937-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
938-
- ","
939-
- Ref: VpcPublicSubnet2SubnetA811849C
940-
VolumeSize: "50"
941941
UpdateReplacePolicy: Delete
942942
DeletionPolicy: Delete
943943
IdeEipAssociationDFF81215:
@@ -1563,13 +1563,13 @@ Resources:
15631563
Fn::GetAtt:
15641564
- CodeBuildStartLambdaFunction8349284F
15651565
- Arn
1566-
ContentHash: "1766254404082"
1566+
ContentHash: "1766259269788"
1567+
ProjectName:
1568+
Ref: CodeBuildProjectA0FF5539
15671569
CodeBuildIamRoleArn:
15681570
Fn::GetAtt:
15691571
- CodeBuildRoleE9A44575
15701572
- Arn
1571-
ProjectName:
1572-
Ref: CodeBuildProjectA0FF5539
15731573
DependsOn:
15741574
- CodeBuildCompleteRuleAllowEventRuleWorkshopStackCodeBuildReportLambdaFunctionD77C60919E0B0C89
15751575
- CodeBuildCompleteRuleEE9277E8
@@ -1921,7 +1921,7 @@ Resources:
19211921
- Ref: AWS::AccountId
19221922
- "-"
19231923
- Ref: AWS::Region
1924-
- "-20251220191324"
1924+
- "-20251220203430"
19251925
PublicAccessBlockConfiguration:
19261926
BlockPublicAcls: true
19271927
BlockPublicPolicy: true
@@ -2157,13 +2157,13 @@ Resources:
21572157
}
21582158
Environment:
21592159
Variables:
2160-
S3_THREAD_DUMPS_PREFIX: thread-dumps/
2161-
K8S_NAMESPACE: unicorn-store-spring
2162-
APP_LABEL: unicorn-store-spring
2163-
KUBERNETES_AUTH_TYPE: aws
2164-
SECRET_NAME: workshop-ide-password
21652160
S3_BUCKET_NAME:
21662161
Ref: WorkshopBucketFD5BC43F
2162+
SECRET_NAME: workshop-ide-password
2163+
KUBERNETES_AUTH_TYPE: aws
2164+
APP_LABEL: unicorn-store-spring
2165+
K8S_NAMESPACE: unicorn-store-spring
2166+
S3_THREAD_DUMPS_PREFIX: thread-dumps/
21672167
EKS_CLUSTER_NAME:
21682168
Ref: EksClusterB2BDED5B
21692169
FunctionName: workshop-thread-dump-lambda
@@ -2709,9 +2709,6 @@ Resources:
27092709
Fn::GetAtt:
27102710
- UnicornUnicornStoreDatabaseSetupFunction04E12F8B
27112711
- Arn
2712-
SqlStatements: |
2713-
CREATE TABLE IF NOT EXISTS unicorns(id TEXT DEFAULT gen_random_uuid() PRIMARY KEY, name TEXT, age TEXT, size TEXT, type TEXT);
2714-
CREATE EXTENSION IF NOT EXISTS vector;
27152712
SecretName:
27162713
Fn::Join:
27172714
- "-"
@@ -2742,6 +2739,9 @@ Resources:
27422739
- Fn::Split:
27432740
- ":"
27442741
- Ref: DatabaseSecret3B817195
2742+
SqlStatements: |
2743+
CREATE TABLE IF NOT EXISTS unicorns(id TEXT DEFAULT gen_random_uuid() PRIMARY KEY, name TEXT, age TEXT, size TEXT, type TEXT);
2744+
CREATE EXTENSION IF NOT EXISTS vector;
27452745
DependsOn:
27462746
- DatabaseClusterDatabaseWriterF4C0B9A6
27472747
- DatabaseCluster5B53A178
@@ -2859,8 +2859,8 @@ Resources:
28592859
28602860
return endpoint_ids
28612861
2862-
def cleanup_guardduty_security_groups(vpc_id):
2863-
"""Delete GuardDuty managed security groups for the VPC."""
2862+
def cleanup_guardduty_security_groups(vpc_id, max_retries=6, retry_delay=10):
2863+
"""Delete GuardDuty managed security groups for the VPC with retry logic."""
28642864
if not vpc_id:
28652865
print("No VPC ID provided, skipping security group cleanup")
28662866
return
@@ -2884,11 +2884,20 @@ Resources:
28842884
sg_id = sg['GroupId']
28852885
sg_name = sg['GroupName']
28862886
print(f"Deleting GuardDuty security group: {sg_name} ({sg_id})")
2887-
try:
2888-
ec2.delete_security_group(GroupId=sg_id)
2889-
print(f"Deleted security group: {sg_id}")
2890-
except Exception as e:
2891-
print(f"Error deleting security group {sg_id}: {e}")
2887+
2888+
# Retry deletion - ENIs may take time to detach after endpoint deletion
2889+
for attempt in range(max_retries):
2890+
try:
2891+
ec2.delete_security_group(GroupId=sg_id)
2892+
print(f"Deleted security group: {sg_id}")
2893+
break
2894+
except ec2.exceptions.ClientError as e:
2895+
if 'DependencyViolation' in str(e) and attempt < max_retries - 1:
2896+
print(f"Security group has dependencies, waiting {retry_delay}s (attempt {attempt + 1}/{max_retries})...")
2897+
time.sleep(retry_delay)
2898+
else:
2899+
print(f"Error deleting security group {sg_id}: {e}")
2900+
break
28922901
28932902
except Exception as e:
28942903
print(f"Error listing GuardDuty security groups: {e}")

0 commit comments

Comments
 (0)