aws-nuke

To give this a slightly different spin: --> "The best optimization is simply not spinning things up!" At least for local development and testing, as made possible by LocalStack (https://localstack.cloud), among other local testing solutions and emulators. We've seen so many teams fall into the trap of "someone forgot to shut down dev resource X for a week and now we've racked up a $$$ bill on AWS". What is everyone's strategy to avoid this kind of situation? Tools like `aws-nuke` (https://github.com/rebuy-de/aws-nuke) are awesome (!) to clean up unused resources, but frankly they should not be necessary in the first place...

After you've manage to back it up, you might have still trouble finding and terminating everything. While I don't have an answer to your question, you might find this tool handy for cleanups - https://github.com/rebuy-de/aws-nuke

Yep, the only way to do this is using aws-nuke [0], and the billing is such a mess for small use cases. https://github.com/rebuy-de/aws-nuke

> I'm terrified of the literally infinite bill that might show up from a typo a month down the line Whilst this might sound funny, we were surprised to see it as a common use-cases with users putting https://github.com/infracost/infracost in their CI/CD pipelines to act as safety net. Currently it only works for Terraform users, but we plan to add other infra-as-code tools in the future. We're also discussing how we can do this for people who don't use infra-as-code in https://github.com/infracost/infracost/issues/840 but it's not clear what the workflow could look like for them. Perhaps having separate AWS accounts with a budget alert that emails you to run https://github.com/rebuy-de/aws-nuke is a work-around just now. (I'm co-founder of Infracost)

yes. there are tools out there that can wipe away everything: https://github.com/rebuy-de/aws-nuke My money is that this guy was just negligent an did not remove his old credentials + used whatever thing he was using before without doublechecking. It's extremely plausible he had this setup for a test account and ran it with the wrong credentials. On Cisco side this bad all around. Revoke the credentials. Audit the credentials periodically. Don't allow direct production access even for engineers that work there unless it's a live production issue or a deployment that's going on (and even then you allow them access to the tooling that does the deployment not to run whatever they want with : permissions)

Open source CLI to do the same for free without passing AWS keys to third-party: https://github.com/rebuy-de/aws-nuke