fix: FGAC cleanup on destroy with Secrets Manager or --opensearch-password

Destroy now removes backend role mappings from the OpenSearch domain
before deleting the Application. Gets password from Secrets Manager
(CLI-created domains) or --opensearch-password flag (reused domains).
Skips gracefully if no password available.

Signed-off-by: Kyle Hounslow <kylhouns@amazon.com>

Author: kylehounslow

aws/cli-installer/src/cli.mjs

@@ -80,7 +80,8 @@ function parseDestroyArgs(argv) {
     .name('observability-stack-aws-cli destroy')
     .description('Tear down all AWS resources created by the CLI for a given pipeline name')
     .requiredOption('--pipeline-name <name>', 'Pipeline name used during creation')
-    .option('--region <region>', 'AWS region', process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION);
+    .option('--region <region>', 'AWS region', process.env.AWS_REGION || process.env.AWS_DEFAULT_REGION)
+    .option('--opensearch-password <password>', 'Master password (if domain was not created by CLI)');
 
   program.parse(argv.slice(1));
   return { _command: 'destroy', ...program.opts() };

aws/cli-installer/src/destroy.mjs

@@ -3,11 +3,67 @@
  * Deletes in reverse dependency order: EC2 → Application → DQS → OSIS → IAM → (preserves AOS/AMP).
  */
 import { OSISClient, DeletePipelineCommand, GetPipelineCommand } from '@aws-sdk/client-osis';
-import { OpenSearchClient, ListApplicationsCommand, DeleteApplicationCommand, DeleteDirectQueryDataSourceCommand } from '@aws-sdk/client-opensearch';
+import { OpenSearchClient, ListApplicationsCommand, DeleteApplicationCommand, DeleteDirectQueryDataSourceCommand, GetApplicationCommand, DescribeDomainCommand } from '@aws-sdk/client-opensearch';
 import { IAMClient, DeleteRolePolicyCommand, DeleteRoleCommand, ListRolePoliciesCommand } from '@aws-sdk/client-iam';
 import { printStep, printSuccess, printWarning, printInfo, createSpinner } from './ui.mjs';
 import { teardownDemoInstance } from './ec2-demo.mjs';
 
+async function cleanupFgacRoles(region, pipelineName, opensearchPassword, os) {
+  try {
+    const { ApplicationSummaries } = await os.send(new ListApplicationsCommand({}));
+    const app = (ApplicationSummaries || []).find(a => a.name === pipelineName);
+    if (!app) return;
+
+    const { dataSources } = await os.send(new GetApplicationCommand({ id: app.id }));
+    const domainArn = (dataSources || []).find(d => d.dataSourceArn?.includes(':domain/'))?.dataSourceArn;
+    if (!domainArn) return;
+
+    const domainName = domainArn.split('/').pop();
+    const { DomainStatus } = await os.send(new DescribeDomainCommand({ DomainName: domainName }));
+    if (!DomainStatus?.Endpoint) return;
+
+    // Get password from Secrets Manager or flag
+    let masterPass = opensearchPassword || '';
+    if (!masterPass) {
+      try {
+        const { SecretsManagerClient, GetSecretValueCommand } = await import('@aws-sdk/client-secrets-manager');
+        const sm = new SecretsManagerClient({ region });
+        const { SecretString } = await sm.send(new GetSecretValueCommand({
+          SecretId: `open-stack/${pipelineName}/master-password`,
+        }));
+        masterPass = SecretString;
+      } catch { /* no secret found */ }
+    }
+    if (!masterPass) {
+      printWarning('No master password available. FGAC cleanup skipped. Pass --opensearch-password to clean up role mappings.');
+      return;
+    }
+
+    const endpoint = `https://${DomainStatus.Endpoint}`;
+    const url = `${endpoint}/_plugins/_security/api/rolesmapping/all_access`;
+    const auth = Buffer.from(`admin:${masterPass}`).toString('base64');
+    const headers = { 'Content-Type': 'application/json', 'Authorization': `Basic ${auth}` };
+
+    const getResp = await fetch(url, { headers });
+    if (!getResp.ok) return;
+
+    const data = await getResp.json();
+    const existing = data?.all_access?.backend_roles || [];
+    const filtered = existing.filter(r => !r.includes(pipelineName));
+
+    if (filtered.length !== existing.length) {
+      await fetch(url, {
+        method: 'PATCH',
+        headers,
+        body: JSON.stringify([{ op: 'add', path: '/backend_roles', value: filtered }]),
+      });
+      printSuccess('FGAC backend role mappings cleaned up');
+    }
+  } catch (e) {
+    printWarning(`FGAC cleanup: ${e.message}`);
+  }
+}
+
 export async function destroy(cfg) {
   const { pipelineName, region } = cfg;
   if (!pipelineName) throw new Error('--pipeline-name is required');
@@ -18,8 +74,11 @@ export async function destroy(cfg) {
   // 1. EC2 demo instance + SG + instance profile
   await teardownDemoInstance(cfg);
 
-  // 2. OpenSearch Application
+  // 2. Clean up FGAC backend role mappings (before deleting Application)
   const os = new OpenSearchClient({ region });
+  await cleanupFgacRoles(region, pipelineName, cfg.opensearchPassword, os);
+
+  // 3. OpenSearch Application
   try {
     const { ApplicationSummaries } = await os.send(new ListApplicationsCommand({}));
     const app = (ApplicationSummaries || []).find(a => a.name === pipelineName);