From aafe050a6ee7991ebe645dc56aa3ac4077661b37 Mon Sep 17 00:00:00 2001 From: james00012 Date: Thu, 16 Jul 2026 22:47:25 -0400 Subject: [PATCH] fix: clean up leaked IAM groups in scheduled nuke jobs IAM groups do not support tags, so the per-repo CircleCI cleanup jobs that filter by the gw:repo tag exclude them for safety and never delete them. The account-wide guardrail did not delete them either: nuke_config.yml declared 'IAMGroups: delete all groups' but COMMON_EXCLUDES passed --exclude-resource-type iam-group, which excludes the type at the CLI and made that config block dead. As a result nothing cleaned up IAM groups in any account, and they accumulated until ConfigTests hit the GroupsPerAccount quota, failing CreateGroup and blocking the terraform-aws-security test suite (OSS-4024). Drop iam-group from COMMON_EXCLUDES so the type is processed, and scope IAMGroups with an allowlist rather than the previously declared delete-all. Only groups matching a known test naming convention are deleted, so any real group is protected by default. Deleting all groups was not safe to rely on: the 'no infrastructure groups to protect' claim had never been exercised, and it could not be verified for ConfigTests or Sandbox. Verified against the phxdevops account with the real guardrail config: of four IAM groups, only the two matching test-group were deleted, and oss4024-real-admins and circle-ci-test-perms were left intact. --- .github/nuke_config.yml | 13 ++++++++++++- .github/workflows/nuke-account.yml | 1 - 2 files changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/nuke_config.yml b/.github/nuke_config.yml index 7abdb5d6..d370692d 100644 --- a/.github/nuke_config.yml +++ b/.github/nuke_config.yml @@ -67,7 +67,18 @@ IAMUsers: - "^circle-ci-test$" IAMGroups: - # Delete all groups - no infrastructure groups to protect + # IAM groups do not support tags, so the per-repo CircleCI cleanup jobs (which + # filter by the gw:repo tag) skip them and they leak until the account hits the + # GroupsPerAccount quota (OSS-4024). They are cleaned up here instead. + # + # Unlike the other resource types in this file, this is an allowlist rather than + # a blocklist: only groups matching a known test naming convention are deleted, + # so any real group is protected by default. Broaden this list as other repos' + # test group names are confirmed. + include: + names_regex: + # terraform-aws-security: "-test-group-number-N", "test-group-" + - "test-group" IAMRoles: exclude: diff --git a/.github/workflows/nuke-account.yml b/.github/workflows/nuke-account.yml index 32cee3ac..b0784410 100644 --- a/.github/workflows/nuke-account.yml +++ b/.github/workflows/nuke-account.yml @@ -28,7 +28,6 @@ env: # Resources excluded across all accounts to prevent breaking infrastructure COMMON_EXCLUDES: >- --exclude-resource-type iam-user - --exclude-resource-type iam-group --exclude-resource-type iam-role --exclude-resource-type iam-service-linked-role --exclude-resource-type oidc-provider