cloud-mu 3.1.3 → 3.3.0

data/modules/mu/{clouds → providers}/aws/user.rb

@@ -37,7 +37,7 @@ module MU
             if !@config['use_if_exists']
               raise MuError, "IAM user #{@mu_name} already exists and use_if_exists is false"
             end
-          rescue Aws::IAM::Errors::NoSuchEntity => e
+          rescue Aws::IAM::Errors::NoSuchEntity
             @config['path'] ||= "/"+@deploy.deploy_id+"/"
             MU.log "Creating IAM user #{@config['path']}/#{@mu_name}"
             tags = get_tag_params
@@ -109,7 +109,7 @@ module MU
           # Create these if necessary, then append them to the list of
           # attachable_policies
           if @config['raw_policies']
-            pol_arns = MU::Cloud::AWS::Role.manageRawPolicies(
+            pol_arns = MU::Cloud.resourceClass("AWS", "Role").manageRawPolicies(
               @config['raw_policies'],
               basename: @deploy.getResourceName(@config['name']),
               credentials: @credentials
@@ -120,7 +120,7 @@ module MU
 
           if @config['attachable_policies']
             configured_policies = @config['attachable_policies'].map { |p|
-              id = if p.is_a?(MU::Config::Ref)
+              if p.is_a?(MU::Config::Ref)
                 p.cloud_id
               else
                 p = MU::Config::Ref.get(p)
@@ -135,7 +135,7 @@ module MU
             attached_policies.each { |a|
               if !configured_policies.include?(a.policy_arn)
                 MU.log "Removing IAM policy #{a.policy_arn} from user #{@mu_name}", MU::NOTICE
-                MU::Cloud::AWS::Role.purgePolicy(a.policy_arn, @credentials)
+                MU::Cloud.resourceClass("AWS", "Role").purgePolicy(a.policy_arn, @credentials)
               else
                 configured_policies.delete(a.policy_arn)
               end
@@ -151,7 +151,7 @@ module MU
           end
 
           if @config['inline_policies']
-            docs = MU::Cloud::AWS::Role.genPolicyDocument(@config['inline_policies'], deploy_obj: @deploy)
+            docs = MU::Cloud.resourceClass("AWS", "Role").genPolicyDocument(@config['inline_policies'], deploy_obj: @deploy)
             docs.each { |doc|
               MU.log "Putting user policy #{doc.keys.first} to user #{@cloud_id} "
               MU::Cloud::AWS.iam(credentials: @credentials).put_user_policy(
@@ -189,17 +189,17 @@ module MU
         # Remove all users associated with the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
         # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
-        # @param region [String]: The cloud provider region
         # @return [void]
-        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
+        def self.cleanup(noop: false, deploy_id: MU.deploy_id, ignoremaster: false, credentials: nil, flags: {})
+          MU.log "AWS::User.cleanup: need to support flags['known']", MU::DEBUG, details: flags
 
           # XXX this doesn't belong here; maybe under roles, maybe as its own stupid first-class resource
           resp = MU::Cloud::AWS.iam(credentials: credentials).list_policies(
-            path_prefix: "/"+MU.deploy_id+"/"
+            path_prefix: "/"+deploy_id+"/"
           )
           if resp and resp.policies
             resp.policies.each { |policy|
-              MU.log "Deleting policy /#{MU.deploy_id}/#{policy.policy_name}"
+              MU.log "Deleting policy /#{deploy_id}/#{policy.policy_name}"
               if !noop
                 attachments = begin
                   MU::Cloud::AWS.iam(credentials: credentials).list_entities_for_policy(
@@ -257,7 +257,7 @@ module MU
                   }
                   retry
                 rescue ::Aws::IAM::Errors::NoSuchEntity
-rescue Exception => e
+rescue StandardError => e
 MU.log e.inspect, MU::ERR, details: policy
                 end
               end
@@ -275,14 +275,17 @@ MU.log e.inspect, MU::ERR, details: policy
             ).tags
             has_nodelete = false
             has_ourdeploy = false
+            has_ourmaster = false
             tags.each { |tag|
-              if tag.key == "MU-ID" and tag.value == MU.deploy_id
+              if tag.key == "MU-ID" and tag.value == deploy_id
                 has_ourdeploy = true
+              elsif tag.key == "MU-MASTER-IP" and tag.value == MU.mu_public_ip
+                has_ourmaster = true
               elsif tag.key == "MU-NO-DELETE" and tag.value == "true"
                 has_nodelete = true
               end
             }
-            if has_ourdeploy and !has_nodelete
+            if has_ourdeploy and !has_nodelete and (ignoremaster or has_ourmaster)
               MU.log "Deleting IAM user #{u.path}#{u.user_name}"
               if !@noop
                 begin
@@ -296,7 +299,7 @@ MU.log e.inspect, MU::ERR, details: policy
                       group_name: g.group_name
                     )
                   }
-                  profile = MU::Cloud::AWS.iam(credentials: credentials).get_login_profile(
+                  MU::Cloud::AWS.iam(credentials: credentials).get_login_profile(
                     user_name: u.user_name
                   )
                   MU.log "Deleting IAM login profile for #{u.user_name}"
@@ -381,7 +384,7 @@ MU.log e.inspect, MU::ERR, details: policy
         # Reverse-map our cloud description into a runnable config hash.
         # We assume that any values we have in +@config+ are placeholders, and
         # calculate our own accordingly based on what's live in the cloud.
-        def toKitten(rootparent: nil, billing: nil, habitats: nil)
+        def toKitten(**_args)
           bok = {
             "cloud" => "AWS",
             "credentials" => @credentials,
@@ -428,7 +431,7 @@ MU.log e.inspect, MU::ERR, details: policy
             resp.policy_names.each { |pol_name|
               pol = MU::Cloud::AWS.iam(credentials: @credentials).get_user_policy(user_name: @cloud_id, policy_name: pol_name)
               doc = JSON.parse(URI.decode(pol.policy_document))
-              bok["inline_policies"] = MU::Cloud::AWS::Role.doc2MuPolicies(pol.policy_name, doc, bok["inline_policies"])
+              bok["inline_policies"] = MU::Cloud.resourceClass("AWS", "Role").doc2MuPolicies(pol.policy_name, doc, bok["inline_policies"])
             }
           end
 
@@ -457,12 +460,12 @@ MU.log e.inspect, MU::ERR, details: policy
         end
 
         # Cloud-specific configuration properties.
-        # @param config [MU::Config]: The calling MU::Config object
+        # @param _config [MU::Config]: The calling MU::Config object
         # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
-        def self.schema(config)
+        def self.schema(_config)
           toplevel_required = []
           polschema = MU::Config::Role.schema["properties"]["policies"]
-          polschema.deep_merge!(MU::Cloud::AWS::Role.condition_schema)
+          polschema.deep_merge!(MU::Cloud.resourceClass("AWS", "Role").condition_schema)
 
           schema = {
             "inline_policies" => polschema,
@@ -514,7 +517,7 @@ style long name, like +IAMTESTS-DEV-2018112815-IS-USER-FOO+"
           # If we're attaching some managed policies, make sure all of the ones
           # that should already exist do indeed exist
           if user['attachable_policies']
-            ok = false if !MU::Cloud::AWS::Role.validateAttachablePolicies(
+            ok = false if !MU::Cloud.resourceClass("AWS", "Role").validateAttachablePolicies(
               user['attachable_policies'],
               credentials: user['credentials'],
               region: user['region']
@@ -527,7 +530,7 @@ style long name, like +IAMTESTS-DEV-2018112815-IS-USER-FOO+"
               if configurator.haveLitterMate?(group, "groups")
                 need_dependency = true
               else
-                found = MU::Cloud::AWS::Group.find(cloud_id: group)
+                found = MU::Cloud.resourceClass("AWS", "Group").find(cloud_id: group)
                 if found.nil? or found.empty? or (configurator.updating and
                    found.values.first.group.path == "/"+configurator.updating+"/")
                   groupdesc = {
@@ -539,11 +542,7 @@ style long name, like +IAMTESTS-DEV-2018112815-IS-USER-FOO+"
               end
 
               if need_dependency
-                user["dependencies"] ||= []
-                user["dependencies"] << {
-                  "type" => "group",
-                  "name" => group
-                }
+                MU::Config.addDependency(user, group, "group")
               end
             }
           end

data/modules/mu/{clouds → providers}/aws/userdata/linux.erb

@@ -42,7 +42,7 @@ if ping -c 5 8.8.8.8 > /dev/null; then
 <% if !$mu.skipApplyUpdates %>
     set +e
     if [ ! -f /.mu-installer-ran-updates ];then
-      service ssh stop
+      echo "Applying package updates" > /etc/nologin
       apt-get --fix-missing -y upgrade 
       touch /.mu-installer-ran-updates
       if [ $? -eq 0 ]
@@ -58,7 +58,7 @@ if ping -c 5 8.8.8.8 > /dev/null; then
       else
         echo "FAILED PACKAGE UPDATE" >&2
       fi
-      service ssh start
+      rm -f /etc/nologin
     fi
 <% end %>
   elif [ -x /usr/bin/yum ];then
@@ -94,7 +94,7 @@ if ping -c 5 8.8.8.8 > /dev/null; then
 <% if !$mu.skipApplyUpdates %>
     set +e
     if [ ! -f /.mu-installer-ran-updates ];then
-      service sshd stop
+      echo "Applying package updates" > /etc/nologin
       kernel_update=`yum list updates | grep kernel`
       yum -y update
       touch /.mu-installer-ran-updates
@@ -108,7 +108,7 @@ if ping -c 5 8.8.8.8 > /dev/null; then
       else
         echo "FAILED PACKAGE UPDATE" >&2
       fi
-      service sshd start
+      rm -f /etc/nologin
     fi
 <% end %>
   fi
@@ -116,6 +116,7 @@ else
   /bin/logger "***** Unable to verify internet connectivity, skipping package updates from userdata"
   touch /.mu-installer-ran-updates
 fi
+rm -f /etc/nologin
 
 AWSCLI='command -v aws'
 PIP='command -v pip'

data/modules/mu/{clouds → providers}/aws/userdata/windows.erb

@@ -23,7 +23,7 @@ function log
 }
 
 function fetchSecret([string]$file){
-  log "Fetching s3://<%= $mu.adminBucketName %>/$file to $tmp/$file"
+  log "aws.cmd --region $region s3 cp s3://<%= $mu.adminBucketName %>/$file $tmp/$file"
   aws.cmd --region $region s3 cp s3://<%= $mu.adminBucketName %>/$file $tmp/$file
 }
 
@@ -245,6 +245,7 @@ if($ingroup -ne $admin_username){
   net localgroup WinRMRemoteWMIUsers__ /add $admin_username
 }
 
+importCert "$myname-winrm.crt" "root"
 $winrmcert = importCert "$myname-winrm.crt" "TrustedPeople"
 Set-Item -Path WSMan:\localhost\Service\Auth\Certificate -Value $true
 Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name LocalAccountTokenFilterPolicy -Value 1

data/modules/mu/{clouds → providers}/aws/vpc.rb

@@ -18,6 +18,7 @@ module MU
 
       # Creation of Virtual Private Clouds and associated artifacts (routes, subnets, etc).
       class VPC < MU::Cloud::VPC
+        require 'mu/providers/aws/vpc_subnet'
 
         # Initialize this cloud resource object. Calling +super+ will invoke the initializer defined under {MU::Cloud}, which should set the attribtues listed in {MU::Cloud::PUBLIC_ATTRS} as well as applicable dependency shortcuts, like +@vpc+, for us.
         # @param args [Hash]: Hash of named arguments passed via Ruby's double-splat
@@ -35,78 +36,40 @@ module MU
         def create
           MU.log "Creating VPC #{@mu_name}", details: @config
           resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_vpc(cidr_block: @config['ip_block']).vpc
-          vpc_id = @config['vpc_id'] = resp.vpc_id
+          @cloud_id = resp.vpc_id
+          @config['vpc_id'] = @cloud_id
 
-          MU::Cloud::AWS.createStandardTags(vpc_id, region: @config['region'], credentials: @config['credentials'])
-          MU::MommaCat.createTag(vpc_id, "Name", @mu_name, region: @config['region'], credentials: @config['credentials'])
-
-          if @config['tags']
-            @config['tags'].each { |tag|
-              MU::MommaCat.createTag(vpc_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-            }
-          end
-
-          if @config['optional_tags']
-            MU::MommaCat.listOptionalTags.each { |key, value|
-              MU::MommaCat.createTag(vpc_id, key, value, region: @config['region'], credentials: @config['credentials'])
-            }
-          end
+          tag_me
 
           if resp.state != "available"
             begin
-              MU.log "Waiting for VPC #{@mu_name} (#{vpc_id}) to be available", MU::NOTICE
+              MU.log "Waiting for VPC #{@mu_name} (#{@cloud_id}) to be available", MU::NOTICE
               sleep 5
-              resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpcs(vpc_ids: [vpc_id]).vpcs.first
+              resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpcs(vpc_ids: [@cloud_id]).vpcs.first
             end while resp.state != "available"
             # There's a default route table that comes with. Let's tag it.
             resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_route_tables(
               filters: [
                 {
                   name: "vpc-id",
-                  values: [vpc_id]
+                  values: [@cloud_id]
                 }
               ]
             )
             resp.route_tables.each { |rtb|
-              MU::MommaCat.createTag(rtb.route_table_id, "Name", @mu_name+"-#DEFAULTPRIV", region: @config['region'], credentials: @config['credentials'])
-              if @config['tags']
-                @config['tags'].each { |tag|
-                  MU::MommaCat.createTag(rtb.route_table_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-                }
-              end
-
-              MU::Cloud::AWS.createStandardTags(rtb.route_table_id, region: @config['region'], credentials: @config['credentials'])
-
-              if @config['optional_tags']
-                MU::MommaCat.listOptionalTags.each { |key, value|
-                  MU::MommaCat.createTag(rtb.route_table_id, key, value, region: @config['region'], credentials: @config['credentials'])
-                }
-              end
+              tag_me(rtb.route_table_id, @mu_name+"-#DEFAULTPRIV")
             }
           end
-          @config['vpc_id'] = vpc_id
-          @cloud_id = vpc_id
 
           if @config['create_internet_gateway']
             MU.log "Creating Internet Gateway #{@mu_name}"
             resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_internet_gateway
             internet_gateway_id = resp.internet_gateway.internet_gateway_id
             sleep 5
-            MU::Cloud::AWS.createStandardTags(internet_gateway_id, region: @config['region'], credentials: @config['credentials'])
-            MU::MommaCat.createTag(internet_gateway_id, "Name", @mu_name, region: @config['region'], credentials: @config['credentials'])
-            if @config['tags']
-              @config['tags'].each { |tag|
-                MU::MommaCat.createTag(internet_gateway_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-              }
-            end
 
-            if @config['optional_tags']
-              MU::MommaCat.listOptionalTags.each { |key, value|
-                MU::MommaCat.createTag(internet_gateway_id, key, value, region: @config['region'], credentials: @config['credentials'])
-              }
-            end
+            tag_me(internet_gateway_id)
 
-            MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).attach_internet_gateway(vpc_id: vpc_id, internet_gateway_id: internet_gateway_id)
+            MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).attach_internet_gateway(vpc_id: @cloud_id, internet_gateway_id: internet_gateway_id)
             @config['internet_gateway_id'] = internet_gateway_id
           end
 
@@ -165,237 +128,35 @@ module MU
             )
           end
 
-          nat_gateways = []
-          if !@config['subnets'].nil?
-            allocation_ids = []
-            subnet_semaphore = Mutex.new
-            subnetthreads = Array.new
-            parent_thread_id = Thread.current.object_id
-            azs = []
-            @config['subnets'].each { |subnet|
-              subnet_name = @config['name']+"-"+subnet['name']
-              MU.log "Creating Subnet #{subnet_name} (#{subnet['ip_block']})", details: subnet
-              azs = MU::Cloud::AWS.listAZs(region: @config['region'], credentials: @config['credentials']) if azs.size == 0
-              if !subnet['availability_zone'].nil?
-                az = subnet['availability_zone']
-              else
-                az = azs.pop
-              end
-
-              subnetthreads << Thread.new {
-                MU.dupGlobals(parent_thread_id)
-                resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_subnet(
-                    vpc_id: vpc_id,
-                    cidr_block: subnet['ip_block'],
-                    availability_zone: az
-                ).subnet
-                subnet_id = subnet['subnet_id'] = resp.subnet_id
-                MU::Cloud::AWS.createStandardTags(subnet_id, region: @config['region'], credentials: @config['credentials'])
-                MU::MommaCat.createTag(subnet_id, "Name", @mu_name+"-"+subnet['name'], region: @config['region'], credentials: @config['credentials'])
-                if @config['tags']
-                  @config['tags'].each { |tag|
-                    MU::MommaCat.createTag(subnet_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-                  }
-                end
-
-                if @config['optional_tags']
-                  MU::MommaCat.listOptionalTags.each { |key, value|
-                    MU::MommaCat.createTag(subnet_id, key, value, region: @config['region'], credentials: @config['credentials'])
-                  }
-                end
-
-                retries = 0
-                begin
-                  if resp.state != "available"
-                    begin
-                      MU.log "Waiting for Subnet #{subnet_name} (#{subnet_id}) to be available", MU::NOTICE if retries > 0 and (retries % 3) == 0
-                      sleep 5
-                      resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_subnets(subnet_ids: [subnet_id]).subnets.first
-                    rescue Aws::EC2::Errors::InvalidSubnetIDNotFound => e
-                      sleep 10
-                      retry
-                    end while resp.state != "available"
-                  end
-                rescue NoMethodError => e
-                  if retries <= 3
-                    MU.log "Got bogus Aws::EmptyResponse error on #{subnet_id} (retries used: #{retries}/3)", MU::WARN
-                    retries = retries + 1
-                    sleep 5
-                    resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_subnets(subnet_ids: [subnet_id]).subnets.first
-                    retry
-                  else
-                    raise e
-                  end
-                end
-
-                if !subnet['route_table'].nil?
-                  routes = {}
-                  @config['route_tables'].each { |tbl|
-                    routes[tbl['name']] = tbl
-                  }
-                  if routes.nil? or routes[subnet['route_table']].nil?
-                    MU.log "Subnet #{subnet_name} references non-existent route #{subnet['route_table']}", MU::ERR, details: @deploy.deployment['vpcs']
-                    raise MuError, "deploy failure"
-                  end
-                  MU.log "Associating Route Table '#{subnet['route_table']}' (#{routes[subnet['route_table']]['route_table_id']}) with #{subnet_name}"
-                  retries = 0
-                  begin
-                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).associate_route_table(
-                        route_table_id: routes[subnet['route_table']]['route_table_id'],
-                        subnet_id: subnet_id
-                    )
-                  rescue Aws::EC2::Errors::InvalidRouteTableIDNotFound => e
-                    retries = retries + 1
-                    if retries < 10
-                      sleep 10
-                      retry
-                    else
-                      raise MuError, e.inspect
-                    end
-                  end
-                end
-                retries = 0
-                begin
-                  resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_subnets(subnet_ids: [subnet_id]).subnets.first
-                rescue Aws::EC2::Errors::InvalidSubnetIDNotFound => e
-                  if retries < 10
-                    MU.log "Got #{e.inspect}, waiting and retrying", MU::WARN
-                    sleep 10
-                    retries = retries + 1
-                    retry
-                  end
-                  raise MuError, e.inspect, e.backtrace
-                end
-
-                if subnet['is_public'] && subnet['create_nat_gateway']
-                  MU::MommaCat.lock("nat-gateway-eipalloc")
-                  filters = [{name: "domain", values: ["vpc"]}]
-                  eips = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_addresses(filters: filters).addresses
-                  allocation_id = nil
-                  eips.each { |eip|
-                    next if !eip.association_id.nil? and !eip.association_id.empty?
-                    if (eip.private_ip_address.nil? || eip.private_ip_address.empty?) and MU::MommaCat.lock(eip.allocation_id, true, true)
-                      if !allocation_ids.include?(eip.allocation_id)
-                        allocation_id = eip.allocation_id
-                        break
-                      end
-                    end
-                  }
+          nat_gateways = create_subnets
 
-                  if allocation_id.nil?
-                    allocation_id = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).allocate_address(domain: "vpc").allocation_id
-                    MU::MommaCat.lock(allocation_id, false, true)
-                  end
-
-                  allocation_ids << allocation_id
-                  resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_nat_gateway(
-                    subnet_id: subnet['subnet_id'],
-                    allocation_id: allocation_id,
-                  ).nat_gateway
-
-                  nat_gateway_id = resp.nat_gateway_id
-                  attempts = 0
-                  MU::MommaCat.unlock("nat-gateway-eipalloc")
-                  while resp.class.name != "Aws::EC2::Types::NatGateway" or resp.state == "pending"
-                    MU.log "Waiting for nat gateway #{nat_gateway_id} () to become available (EIP allocation: #{allocation_id})" if attempts % 5 == 0
-                    sleep 30
-                    begin
-                      resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_nat_gateways(nat_gateway_ids: [nat_gateway_id]).nat_gateways.first
-                    rescue Aws::EmptyStructure, NoMethodError
-                      sleep 5
-                      retry
-                    end
-                    if attempts > 30
-                      MU::MommaCat.unlock(allocation_id, true)
-                      raise MuError, "Timed out while waiting for NAT Gateway #{nat_gateway_id}: #{resp}"
-                    end
-                    attempts += 1
-                  end
-                  MU::MommaCat.unlock(allocation_id, true)
-
-                  raise MuError, "NAT Gateway failed #{nat_gateway_id}: #{resp}" if resp.state == "failed"
-                  nat_gateways << {'id' => nat_gateway_id, 'availability_zone' => subnet['availability_zone']}
-                  @tags.each_pair { |k, v|
-                    MU::MommaCat.createTag(nat_gateway_id, k, v, region: @config['region'], credentials: @config['credentials'])
-                  }
-                end
-
-                if subnet.has_key?("map_public_ips")
-                  retries = 0
-                  begin
-                    resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).modify_subnet_attribute(
-                      subnet_id: subnet_id,
-                      map_public_ip_on_launch: {
-                        value: subnet['map_public_ips'],
-                      }
-                    )
-                  rescue Aws::EC2::Errors::InvalidSubnetIDNotFound => e
-                    if retries < 10
-                      MU.log "Got #{e.inspect} while trying to enable map_public_ips on subnet, waiting and retrying", MU::WARN
-                      sleep 10
-                      retries += 1
-                      retry
-                    end
-                    raise MuError, "Got #{e.inspect}, #{e.backtrace} while trying to enable map_public_ips on subnet"
-                  end
-                end
-
-                if subnet["enable_traffic_logging"]
-                  loggroup = @deploy.findLitterMate(name: @config['name']+"loggroup", type: "logs")
-                  logrole = @deploy.findLitterMate(name: @config['name']+"logrole", type: "roles")
-                  MU.log "Enabling traffic logging on Subnet #{subnet_name} in VPC #{@mu_name} to log group #{loggroup.mu_name}"
-                  MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_flow_logs(
-                    resource_ids: [subnet_id],
-                    resource_type: "Subnet",
-                    traffic_type: subnet["traffic_type_to_log"],
-                    log_group_name: loggroup.mu_name,
-                    deliver_logs_permission_arn: logrole.cloudobj.arn
-                  )
-                end
-              }
-            }
-
-            subnetthreads.each { |t|
-              t.join
-            }
-
-            notify
-          end
+          notify
 
           if !nat_gateways.empty?
             nat_gateways.each { |gateway|
               @config['subnets'].each { |subnet|
-                if subnet['is_public'] == false && subnet['availability_zone'] == gateway['availability_zone']
-                  @config['route_tables'].each { |rtb|
-                    if rtb['name'] == subnet['route_table']
-                      rtb['routes'].each { |route|
-                        if route['gateway'] == '#NAT'
-                          route_config = {
-                            :route_table_id => rtb['route_table_id'],
-                            :destination_cidr_block => route['destination_network'],
-                            :nat_gateway_id => gateway['id']
-                          }
-
-                          MU.log "Creating route for #{route['destination_network']} through NAT gatway #{gateway['id']}", details: route_config
-                          nat_retries = 0
-                          begin
-                            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_route(route_config)
-                          rescue Aws::EC2::Errors::InvalidNatGatewayIDNotFound => e
-                            if nat_retries < 5
-                              nat_retries += 1 
-                              sleep 10
-                              retry
-                            else
-                              raise e
-                            end
-                          rescue Aws::EC2::Errors::RouteAlreadyExists => e
-                            MU.log "Attempt to create duplicate route to #{route['destination_network']} for #{gateway['id']} in #{rtb['route_table_id']}", MU::WARN
-                          end
-                        end
-                      }
-                    end
+                next if subnet['is_public'] != false or subnet['availability_zone'] != gateway['availability_zone']
+
+                @config['route_tables'].each { |rtb|
+                  next if rtb['name'] != subnet['route_table']
+                  rtb['routes'].each { |route|
+                    next if route['gateway'] != '#NAT'
+                    route_config = {
+                      :route_table_id => rtb['route_table_id'],
+                      :destination_cidr_block => route['destination_network'],
+                      :nat_gateway_id => gateway['id']
+                    }
+
+                    MU.log "Creating route for #{route['destination_network']} through NAT gatway #{gateway['id']}", details: route_config
+                    MU.retrier([Aws::EC2::Errors::InvalidNatGatewayIDNotFound], wait: 10, max: 5) {
+                      begin
+                        resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_route(route_config)
+                      rescue Aws::EC2::Errors::RouteAlreadyExists
+                        MU.log "Attempt to create duplicate route to #{route['destination_network']} for #{gateway['id']} in #{rtb['route_table_id']}", MU::WARN
+                      end
+                    }
                   }
-                end
+                }
               }
             }
           end
@@ -403,14 +164,14 @@ module MU
           if @config['enable_dns_support']
             MU.log "Enabling DNS support in #{@mu_name}"
             MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).modify_vpc_attribute(
-                vpc_id: vpc_id,
+                vpc_id: @cloud_id,
                 enable_dns_support: {value: @config['enable_dns_support']}
             )
           end
           if @config['enable_dns_hostnames']
             MU.log "Enabling DNS hostnames in #{@mu_name}"
             MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).modify_vpc_attribute(
-                vpc_id: vpc_id,
+                vpc_id: @cloud_id,
                 enable_dns_hostnames: {value: @config['enable_dns_hostnames']}
             )
           end
@@ -439,29 +200,16 @@ module MU
                 dhcp_configurations: dhcpopts
             )
             dhcpopt_id = resp.dhcp_options.dhcp_options_id
-            MU::Cloud::AWS.createStandardTags(dhcpopt_id, region: @config['region'], credentials: @config['credentials'])
-            MU::MommaCat.createTag(dhcpopt_id, "Name", @mu_name, region: @config['region'], credentials: @config['credentials'])
-
-            if @config['tags']
-              @config['tags'].each { |tag|
-                MU::MommaCat.createTag(dhcpopt_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-              }
-            end
+            tag_me(dhcpopt_id)
 
-            if @config['optional_tags']
-              MU::MommaCat.listOptionalTags.each { |key, value|
-                MU::MommaCat.createTag(dhcpopt_id, key, value, region: @config['region'], credentials: @config['credentials'])
-              }
-            end
-
-            MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).associate_dhcp_options(dhcp_options_id: dhcpopt_id, vpc_id: vpc_id)
+            MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).associate_dhcp_options(dhcp_options_id: dhcpopt_id, vpc_id: @cloud_id)
           end
           notify
 
           if !MU::Cloud::AWS.isGovCloud?(@config['region'])
             mu_zone = MU::Cloud::DNSZone.find(cloud_id: "platform-mu", credentials: @config['credentials']).values.first
             if !mu_zone.nil?
-              MU::Cloud::AWS::DNSZone.toggleVPCAccess(id: mu_zone.id, vpc_id: vpc_id, region: @config['region'], credentials: @config['credentials'])
+              MU::Cloud.resourceClass("AWS", "DNSZone").toggleVPCAccess(id: mu_zone.id, vpc_id: @cloud_id, region: @config['region'], credentials: @config['credentials'])
             end
           end
 					loadSubnets
@@ -472,9 +220,6 @@ module MU
         # Canonical Amazon Resource Number for this resource
         # @return [String]
         def arn
-          puts @config['region']
-          puts MU::Cloud::AWS.credToAcct(@config['credentials'])
-          puts @cloud_id
           "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":ec2:"+@config['region']+":"+MU::Cloud::AWS.credToAcct(@config['credentials'])+":vpc/"+@cloud_id
         end
 
@@ -491,202 +236,7 @@ module MU
           # Generate peering connections
           if !@config['peers'].nil? and @config['peers'].size > 0
             @config['peers'].each { |peer|
-              peer_obj = nil
-              peer_id = nil
-              peer['name'] ||= peer['vpc_name']
-              peer['id'] ||= peer['vpc_id']
-
-              # If we know this to be a sibling VPC elsewhere in our stack,
-              # go fetch it, and fix it if we've been misconfigured with a
-              # duplicate peering connection
-              if peer['vpc']['name'] and !peer['account']
-                peer_obj = @deploy.findLitterMate(name: peer['vpc']['name'], type: "vpcs")
-                if peer_obj
-                  if peer_obj.config['peers']
-                    skipme = false
-                    peer_obj.config['peers'].each { |peerpeer|
-                      if peerpeer['vpc']['name'] == @config['name'] and
-                         (peer['vpc']['name'] <=> @config['name']) == -1
-                        skipme = true
-                        MU.log "VPCs #{peer['vpc']['name']} and #{@config['name']} both declare mutual peering connection, ignoring #{@config['name']}'s redundant declaration", MU::DEBUG
-# XXX and if deploy_id matches or is unset
-                      end
-                    }
-                  end
-                  next if skipme
-                  peer['account'] = MU::Cloud::AWS.credToAcct(peer_obj.credentials)
-                  peer['vpc']['id'] = peer_obj.cloud_id
-                  peer['vpc']['region'] ||= peer_obj.config['region']
-                end
-              end
-
-              # If we still don't know our peer's vpc identifier, go fishing
-              if !peer_obj
-                tag_key, tag_value = peer['vpc']['tag'].split(/=/, 2) if !peer['vpc']['tag'].nil?
-                if peer['vpc']['deploy_id'].nil? and peer['vpc']['id'].nil? and tag_key.nil?
-                  peer['vpc']['deploy_id'] = @deploy.deploy_id
-                end
-                peer_obj = MU::MommaCat.findStray(
-                  "AWS",
-                  "vpcs",
-                  deploy_id: peer['vpc']['deploy_id'],
-                  cloud_id: peer['vpc']['id'],
-# XXX we need a credentials argument here... maybe
-                  name: peer['vpc']['name'],
-                  tag_key: tag_key,
-                  tag_value: tag_value,
-                  dummy_ok: true,
-                  region: peer['vpc']['region']
-                )
-MU.log "wtf", MU::ERR, details: peer if peer_obj.nil? or peer_obj.first.nil?
-                raise MuError, "No result looking for #{@mu_name}'s peer VPCs (#{peer['vpc']})" if peer_obj.nil? or peer_obj.first.nil?
-                peer_obj = peer_obj.first
-                peer['account'] ||= MU::Cloud::AWS.credToAcct(peer_obj.credentials)
-                peer['vpc']['id'] ||= peer_obj.cloud_id
-                peer['vpc']['region'] ||= peer_obj.config['region']
-              end
-
-              peer_id = peer['vpc']['id']
-              peer['account'] ||= MU::Cloud::AWS.account_number
-
-              # See if the peering connection exists before we bother
-              # creating it.
-              resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpc_peering_connections(
-                filters: [
-                  {
-                    name: "requester-vpc-info.vpc-id",
-                    values: [@cloud_id]
-                  },
-                  {
-                    name: "accepter-vpc-info.vpc-id",
-                    values: [peer_id.to_s]
-                  }
-                ]
-              )
-
-              peering_id = if !resp or !resp.vpc_peering_connections or
-                 resp.vpc_peering_connections.empty?
-
-                MU.log "Setting peering connection from VPC #{@config['name']} (#{@cloud_id} in account #{MU::Cloud::AWS.credToAcct(@config['credentials'])}) to #{peer_id} in account #{peer['account']}", details: peer
-                resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_vpc_peering_connection(
-                  vpc_id: @cloud_id,
-                  peer_vpc_id: peer_id,
-                  peer_owner_id: peer['account'],
-                  peer_region: peer['vpc']['region']
-                )
-                resp.vpc_peering_connection.vpc_peering_connection_id
-              else
-                resp.vpc_peering_connections.first.vpc_peering_connection_id
-              end
-
-              peering_name = @deploy.getResourceName(@config['name']+"-PEER-"+peer['vpc']['id'])
-
-              MU::Cloud::AWS.createStandardTags(peering_id, region: @config['region'], credentials: @config['credentials'])
-              MU::MommaCat.createTag(peering_id, "Name", peering_name, region: @config['region'], credentials: @config['credentials'])
-
-              if @config['optional_tags']
-                MU::MommaCat.listOptionalTags.each { |key, value|
-                  MU::MommaCat.createTag(peering_id, key, value, region: @config['region'], credentials: @config['credentials'])
-                }
-              end
-
-              if @config['tags']
-                @config['tags'].each { |tag|
-                  MU::MommaCat.createTag(peering_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
-                }
-              end
-
-              # Create routes to our new friend.
-              MU::Cloud::AWS::VPC.listAllSubnetRouteTables(@cloud_id, region: @config['region'], credentials: @config['credentials']).each { |rtb_id|
-                my_route_config = {
-                  :route_table_id => rtb_id,
-                  :destination_cidr_block => peer_obj.cloud_desc.cidr_block,
-                  :vpc_peering_connection_id => peering_id
-                }
-                rtbdesc = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_route_tables(
-                  route_table_ids: [rtb_id]
-                ).route_tables.first
-                already_exists = false
-                rtbdesc.routes.each { |r|
-                  if r.destination_cidr_block == peer_obj.cloud_desc.cidr_block
-                    if r.vpc_peering_connection_id != peering_id
-                      MU.log "Attempt to create duplicate route to #{peer_obj.cloud_desc.cidr_block} from VPC #{@config['name']}", MU::ERR, details: r
-                      raise MuError, "Can't create route via #{peering_id}, a route to #{peer_obj.cloud_desc.cidr_block} already exists"
-                    else
-                      already_exists = true
-                    end
-                  end
-                }
-                next if already_exists
-
-                MU.log "Creating peering route to #{peer_obj.cloud_desc.cidr_block} in #{peer['vpc']['region']} from VPC #{@config['name']} in #{@config['region']}"
-                resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_route(my_route_config)
-              } # MU::Cloud::AWS::VPC.listAllSubnetRouteTables
-
-              begin
-                cnxn = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpc_peering_connections(
-                  vpc_peering_connection_ids: [peering_id]
-                ).vpc_peering_connections.first
-
-                if cnxn.status.code == "pending-acceptance"
-                  if ((!peer_obj.nil? and !peer_obj.deploydata.nil? and peer_obj.deploydata['auto_accept_peers']) or $MU_CFG['allow_invade_foreign_vpcs'])
-                    MU.log "Auto-accepting peering connection from VPC #{@config['name']} (#{@cloud_id}) to #{peer_id}", MU::NOTICE
-                    begin
-                      MU::Cloud::AWS.ec2(region: peer['vpc']['region'], credentials: peer['account']).accept_vpc_peering_connection(
-                        vpc_peering_connection_id: peering_id,
-                      )
-                      if peer['account'] != MU::Cloud::AWS.credToAcct(@config['credentials'])
-                        # this seems to take a while across accounts
-                        sleep 5
-                      end
-                      cnxn = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpc_peering_connections(
-                        vpc_peering_connection_ids: [peering_id]
-                      ).vpc_peering_connections.first
-                    rescue Aws::EC2::Errors::VpcPeeringConnectionAlreadyExists => e
-                      MU.log "Attempt to create duplicate peering connection to #{peer_id} from VPC #{@config['name']}", MU::WARN
-                    end
-
-                    # Create routes back from our new friend to us.
-                    MU::Cloud::AWS::VPC.listAllSubnetRouteTables(peer_id, region: peer['vpc']['region'], credentials: peer['account']).uniq.each { |rtb_id|
-                      peer_route_config = {
-                        :route_table_id => rtb_id,
-                        :destination_cidr_block => @config['ip_block'],
-                        :vpc_peering_connection_id => peering_id
-                      }
-                      begin
-                        resp = MU::Cloud::AWS.ec2(region: peer['vpc']['region'], credentials: peer['account']).create_route(peer_route_config)
-                      rescue Aws::EC2::Errors::RouteAlreadyExists => e
-                        rtbdesc = MU::Cloud::AWS.ec2(region: peer['vpc']['region'], credentials: peer['account']).describe_route_tables(
-                          route_table_ids: [rtb_id]
-                        ).route_tables.first
-                        rtbdesc.routes.each { |r|
-                          if r.destination_cidr_block == @config['ip_block']
-                            if r.vpc_peering_connection_id != peering_id
-                              MU.log "Attempt to create duplicate route to VPC #{@config['name']} (#{@config['ip_block']}) from peer VPC #{peer_id}'s route table #{rtb_id}", MU::ERR
-                            end
-                          end
-                        }
-                      end
-                    }
-                  else
-                    MU.log "VPC #{peer_id} is not managed by this Mu server or is not configured to auto-accept peering requests. You must accept the peering request for '#{@config['name']}' (#{@cloud_id}) by hand.", MU::WARN, details: "In the AWS Console, go to VPC => Peering Connections and look in the Actions drop-down. You can also set 'Invade Foreign VPCs' to 'true' using mu-configure to auto-accept all peering connections within this account, regardless of whether this Mu server owns the VPCs. This setting is per-user."
-                  end
-                end
-
-                if cnxn.status.code == "failed" or cnxn.status.code == "rejected" or cnxn.status.code == "expired" or cnxn.status.code == "deleted"
-                  MU.log "VPC peering connection from VPC #{@config['name']} (#{@cloud_id} in #{@config['region']}) to #{peer_id} in #{peer['vpc']['region']} #{cnxn.status.code}: #{cnxn.status.message}", MU::ERR
-                  begin
-                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).delete_vpc_peering_connection(
-                      vpc_peering_connection_id: peering_id
-                    )
-                  rescue Aws::EC2::Errors::InvalidStateTransition => e
-                    # XXX apparently this is normal?
-                  end
-                  raise MuError, "VPC peering connection from VPC #{@config['name']} (#{@cloud_id}) to #{peer_id} #{cnxn.status.code}: #{cnxn.status.message}"
-                end
-
-              end while cnxn.status.code != "active" and !((peer_obj.nil? or peer_obj.deploydata.nil? or !peer_obj.deploydata['auto_accept_peers']) and cnxn.status.code == "pending-acceptance")
-
+              peerWith(peer)
             }
           end
 
@@ -713,7 +263,7 @@ MU.log "wtf", MU::ERR, details: peer if peer_obj.nil? or peer_obj.first.nil?
                   route_config[:instance_id] = nat_instance.cloud_id
 
                   MU.log "Creating route for #{route['destination_network']} through NAT host #{nat_instance.cloud_id}", details: route_config
-                  resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_route(route_config)
+                  MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_route(route_config)
                 end
               }
 
@@ -756,7 +306,7 @@ MU.log "wtf", MU::ERR, details: peer if peer_obj.nil? or peer_obj.first.nil?
                   map[vpc.vpc_id] = vpc
                 }
                 return map
-              rescue Aws::EC2::Errors::InvalidVpcIDNotFound => e
+              rescue Aws::EC2::Errors::InvalidVpcIDNotFound
               end
             else
               resp = MU::Cloud::AWS.ec2(region: args[:region], credentials: args[:credentials]).describe_vpcs
@@ -774,7 +324,7 @@ MU.log "wtf", MU::ERR, details: peer if peer_obj.nil? or peer_obj.first.nil?
         # Reverse-map our cloud description into a runnable config hash.
         # We assume that any values we have in +@config+ are placeholders, and
         # calculate our own accordingly based on what's live in the cloud.
-        def toKitten(rootparent: nil, billing: nil, habitats: nil)
+        def toKitten(**_args)
           bok = {
             "cloud" => "AWS",
             "credentials" => @config['credentials'],
@@ -838,12 +388,9 @@ MU.log "wtf", MU::ERR, details: peer if peer_obj.nil? or peer_obj.first.nil?
               if rtb_desc.associations
                 rtb_desc.associations.each { |assoc|
                   if assoc.subnet_id
-if associations[assoc.subnet_id] and associations[assoc.subnet_id] != rtb['name']
-  MU.log "wait more than one route table association for #{assoc.subnet_id} what", MU::WARN, details: associations[assoc.subnet_id]+" => "+rtb['name']
-end
                     associations[assoc.subnet_id] = rtb['name']
                   elsif assoc.gateway_id
-MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_desc
+                    MU.log " Saw a route table association I don't know how to adopt in #{@cloud_id}", MU::WARN, details: rtb_desc
                   end
                 }
               end
@@ -903,20 +450,18 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
         # Describe subnets associated with this VPC. We'll compose identifying
         # information similar to what MU::Cloud.describe builds for first-class
         # resources.
-        # XXX this is weaksauce. Subnets should be objects with their own methods
-        # that work like first-class objects. How would we enforce that?
-        # @return [Array<Hash>]: A list of cloud provider identifiers of subnets associated with this VPC.
+        # @return [Array<MU::Cloud::AWS::VPC::Subnet>]
         def loadSubnets
-          if @cloud_id
-            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_subnets(
-              filters: [
-                { name: "vpc-id", values: [@cloud_id] }
-              ]
-            )
-            if resp.nil? or resp.subnets.nil? or resp.subnets.size == 0
-              MU.log "Got empty results when trying to list subnets in #{@cloud_id}", MU::WARN
-              return []
-            end
+          return [] if !@cloud_id
+
+          resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_subnets(
+            filters: [
+              { name: "vpc-id", values: [@cloud_id] }
+            ]
+          )
+          if resp.nil? or resp.subnets.nil? or resp.subnets.empty?
+            MU.log "Got empty results when trying to list subnets in #{@cloud_id}", MU::WARN
+            return []
           end
 
           @subnetcachesemaphore.synchronize {
@@ -927,23 +472,21 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
             # metadata. Like ya do.
             if !@config.nil? and @config.has_key?("subnets")
               @config['subnets'].each { |subnet|
-                subnet['mu_name'] = @mu_name+"-"+subnet['name'] if !subnet.has_key?("mu_name")
+                subnet['mu_name'] ||= @mu_name+"-"+subnet['name']
                 subnet['region'] = @config['region']
                 subnet['credentials'] = @config['credentials']
-                if !resp.nil? and !resp.data.nil? and !resp.data.subnets.nil?
-                  resp.data.subnets.each { |desc|
-                    if desc.cidr_block == subnet["ip_block"]
-                      subnet["tags"] = MU.structToHash(desc.tags)
-                      subnet["cloud_id"] = desc.subnet_id
-                      break
-                    end
-                  }
-                end
+                resp.subnets.each { |desc|
+                  if desc.cidr_block == subnet["ip_block"]
+                    subnet["tags"] = MU.structToHash(desc.tags)
+                    subnet["cloud_id"] = desc.subnet_id
+                    break
+                  end
+                }
 
                 if subnet["cloud_id"] and !ext_ids.include?(subnet["cloud_id"])
                   @subnets << MU::Cloud::AWS::VPC::Subnet.new(self, subnet)
                 elsif !subnet["cloud_id"]
-                  resp.data.subnets.each { |desc|
+                  resp.subnets.each { |desc|
                     if desc.cidr_block == subnet["ip_block"]
                       subnet['cloud_id'] = desc.subnet_id
                       @subnets << MU::Cloud::AWS::VPC::Subnet.new(self, subnet)
@@ -956,21 +499,21 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
 
             # Of course we might be loading up a dummy subnet object from a
             # foreign or non-Mu-created VPC and subnet. So make something up.
-            if !resp.nil? and @subnets.empty?
-              resp.data.subnets.each { |desc|
-                subnet = {}
-                subnet["ip_block"] = desc.cidr_block
-                subnet["name"] = subnet["ip_block"].gsub(/[\.\/]/, "_")
+            if @subnets.empty?
+              resp.subnets.each { |desc|
+                subnet = {
+                  "ip_block" => desc.cidr_block,
+                  "tags" => MU.structToHash(desc.tags),
+                  "cloud_id" => desc.subnet_id,
+                  'region' => @config['region'],
+                  'credentials' => @config['credentials'],
+                }
+                subnet['name'] = subnet["ip_block"].gsub(/[\.\/]/, "_")
                 subnet['mu_name'] = @mu_name+"-"+subnet['name']
-                subnet["tags"] = MU.structToHash(desc.tags)
-                subnet["cloud_id"] = desc.subnet_id
-                subnet['region'] = @config['region']
-                subnet['credentials'] = @config['credentials']
-                if !ext_ids.include?(desc.subnet_id)
-                  @subnets << MU::Cloud::AWS::VPC::Subnet.new(self, subnet)
-                end
+                @subnets << MU::Cloud::AWS::VPC::Subnet.new(self, subnet)
               }
             end
+
             return @subnets
           }
         end
@@ -983,13 +526,14 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
         def findNat(nat_cloud_id: nil, nat_filter_key: nil, nat_filter_value: nil, region: MU.curRegion, credentials: nil)
           # Discard the nat_cloud_id if it's an AWS instance ID
           nat_cloud_id = nil if nat_cloud_id && nat_cloud_id.start_with?("i-")
+          credentials ||= @credentials
 
           if @gateways.nil?
             @gateways = 
               if nat_cloud_id
-                MU::Cloud::AWS.ec2(region: region, credentials: nil).describe_nat_gateways(nat_gateway_ids: [nat_cloud_id])
+                MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_nat_gateways(nat_gateway_ids: [nat_cloud_id])
               elsif nat_filter_key && nat_filter_value
-                MU::Cloud::AWS.ec2(region: region, credentials: nil).describe_nat_gateways(
+                MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_nat_gateways(
                   filter: [
                     {
                       name: nat_filter_key,
@@ -1014,8 +558,8 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
 
           deploy_id = nil
           nat_name = nat_name.to_s if !nat_name.nil? and nat_name.class.to_s == "MU::Config::Tail"
-          nat_ip = nat_ip.to_s if !nat_ip.nil? and nat_ip.class.to_s == "MU::Config::Tail"
           nat_cloud_id = nat_cloud_id.to_s if !nat_cloud_id.nil? and nat_cloud_id.class.to_s == "MU::Config::Tail"
+          nat_ip = nat_ip.to_s if !nat_ip.nil? and nat_ip.class.to_s == "MU::Config::Tail"
           nat_tag_key = nat_tag_key.to_s if !nat_tag_key.nil? and nat_tag_key.class.to_s == "MU::Config::Tail"
           nat_tag_value = nat_tag_value.to_s if !nat_tag_value.nil? and nat_tag_value.class.to_s == "MU::Config::Tail"
 
@@ -1042,8 +586,8 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
             found.each { |nat|
               # Try some AWS-specific criteria
               cloud_desc = nat.cloud_desc
-              if !nat_host_ip.nil? and
-                  (cloud_desc.private_ip_address == nat_host_ip or cloud_desc.public_ip_address == nat_host_ip)
+              if !nat_ip.nil? and
+                  (cloud_desc.private_ip_address == nat_ip or cloud_desc.public_ip_address == nat_ip)
                 return nat
               elsif cloud_desc.vpc_id == @cloud_id
                 # XXX Strictly speaking we could have different NATs in different
@@ -1090,7 +634,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           if instance.nil?
             begin
               instance = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_instances(instance_ids: [instance_id]).reservations.first.instances.first
-            rescue NoMethodError, Aws::EC2::Errors::InvalidInstanceIDNotFound => e
+            rescue NoMethodError, Aws::EC2::Errors::InvalidInstanceIDNotFound
               MU.log "Failed to identify instance #{instance_id} in MU::Cloud::AWS::VPC.getInstanceSubnets", MU::WARN
               return []
             end
@@ -1133,20 +677,19 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           my_subnets = MU::Cloud::AWS::VPC.getInstanceSubnets(instance: MU.myCloudDescriptor)
           target_subnets = MU::Cloud::AWS::VPC.getInstanceSubnets(instance: target_instance, region: region, credentials: credentials)
 
-          resp = nil
           my_subnets_key = my_subnets.join(",")
           target_subnets_key = target_subnets.join(",")
           MU::Cloud::AWS::VPC.update_route_tables_cache(my_subnets_key, region: MU.myRegion)
           MU::Cloud::AWS::VPC.update_route_tables_cache(target_subnets_key, region: region, credentials: credentials)
 
-          if MU::Cloud::AWS::VPC.have_route_peered_vpc?(my_subnets_key, target_subnets_key, instance_id)
+          if MU::Cloud::AWS::VPC.can_route_to_master_peer?(my_subnets_key, target_subnets_key, instance_id)
             return true
           else
             # The cache can be out of date at times, check again without it
             MU::Cloud::AWS::VPC.update_route_tables_cache(my_subnets_key, use_cache: false, region: MU.myRegion)
             MU::Cloud::AWS::VPC.update_route_tables_cache(target_subnets_key, use_cache: false, region: region, credentials: credentials)
 
-            return MU::Cloud::AWS::VPC.have_route_peered_vpc?(my_subnets_key, target_subnets_key, instance_id)
+            return MU::Cloud::AWS::VPC.can_route_to_master_peer?(my_subnets_key, target_subnets_key, instance_id)
           end
 
         end
@@ -1185,7 +728,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
         # @param target_subnets_key [String]: The subnet/subnets on the other side of the peered VPC.
         # @param instance_id [String]: The instance ID in the target subnet/subnets.
         # @return [Boolean]
-        def self.have_route_peered_vpc?(source_subnets_key, target_subnets_key, instance_id)
+        def self.can_route_to_master_peer?(source_subnets_key, target_subnets_key, instance_id)
           my_routes = []
           vpc_peer_mapping = {}
 
@@ -1279,30 +822,39 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
         # @param ignoremaster [Boolean]: If true, will remove resources not flagged as originating from this Mu server
         # @param region [String]: The cloud provider region
         # @return [void]
-        def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
+        def self.cleanup(noop: false, deploy_id: MU.deploy_id, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
+          MU.log "AWS::VPC.cleanup: need to support flags['known']", MU::DEBUG, details: flags
+
           tagfilters = [
-            {name: "tag:MU-ID", values: [MU.deploy_id]}
+            {name: "tag:MU-ID", values: [deploy_id]}
           ]
           if !ignoremaster
             tagfilters << {name: "tag:MU-MASTER-IP", values: [MU.mu_public_ip]}
           end
 
           vpcs = []
-          retries = 0
-          begin
+          MU.retrier([Aws::EC2::Errors::InvalidVpcIDNotFound], wait: 5) {
             resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_vpcs(filters: tagfilters, max_results: 1000).vpcs
             vpcs = resp if !resp.empty?
-          rescue Aws::EC2::Errors::InvalidVpcIDNotFound => e
-            if retries < 5
-              sleep 5
-              retries += 1
-              retry
-            end
-          end
+          }
+
+#          resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpc_peering_connections(
+#            filters: [
+#              {
+#                name: "requester-vpc-info.vpc-id",
+#                values: [@cloud_id]
+#              },
+#              {
+#                name: "accepter-vpc-info.vpc-id",
+#                values: [peer_id.to_s]
+#              }
+#            ]
+#          )
 
           if !vpcs.empty?
             gwthreads = []
             vpcs.each { |vpc|
+              purge_peering_connections(noop, vpc.vpc_id, region: region, credentials: credentials)
               # NAT gateways don't have any tags, and we can't assign them a name. Lets find them based on a VPC ID
               gwthreads << Thread.new {
                 purge_nat_gateways(noop, vpc_id: vpc.vpc_id, region: region, credentials: credentials)
@@ -1322,17 +874,17 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           purge_vpcs(noop, tagfilters, region: region, credentials: credentials)
           purge_dhcpopts(noop, tagfilters, region: region, credentials: credentials)
 
-          unless noop
-            MU::Cloud::AWS.iam.list_roles.roles.each{ |role|
-              match_string = "#{MU.deploy_id}.*TRAFFIC-LOG"
-            }
-          end
+#          unless noop
+#            MU::Cloud::AWS.iam.list_roles.roles.each{ |role|
+#              match_string = "#{deploy_id}.*TRAFFIC-LOG"
+#            }
+#          end
         end
 
         # Cloud-specific configuration properties.
-        # @param config [MU::Config]: The calling MU::Config object
+        # @param _config [MU::Config]: The calling MU::Config object
         # @return [Array<Array,Hash>]: List of required fields, and json-schema Hash of cloud-specific configuration parameters for this resource
-        def self.schema(config)
+        def self.schema(_config)
           toplevel_required = []
           # Flow Logs can be declared at the VPC level or the subnet level
           flowlogs = {
@@ -1378,11 +930,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
             logdesc["tags"] = vpc["tags"] if !vpc["tags"].nil?
 #            logdesc["optional_tags"] = vpc["optional_tags"] if !vpc["optional_tags"].nil?
             configurator.insertKitten(logdesc, "logs")
-            vpc['dependencies'] ||= []
-            vpc['dependencies'] << {
-              "type" => "log",
-              "name" => vpc['name']+"loggroup"
-            }
+            MU::Config.addDependency(vpc, vpc['name']+"loggroup", "log")
 
             roledesc = {
               "name" => vpc['name']+"logrole",
@@ -1420,15 +968,10 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
             roledesc["tags"] = vpc["tags"] if !vpc["tags"].nil?
             roledesc["optional_tags"] = vpc["optional_tags"] if !vpc["optional_tags"].nil?
             configurator.insertKitten(roledesc, "roles")
-            vpc['dependencies'] ||= []
-            vpc['dependencies'] << {
-              "type" => "role",
-              "name" => vpc['name']+"logrole"
-            }
+            MU::Config.addDependency(vpc, vpc['name']+"logrole", "role")
           end
 
           subnet_routes = Hash.new
-          public_routes = Array.new
 
           if vpc['subnets']
             vpc['subnets'].each { |subnet|
@@ -1476,10 +1019,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
                 subnet_routes[table['name']].each { |subnet|
                   nat_routes[subnet] = route['nat_host_name']
                 }
-                vpc['dependencies'] << {
-                  "type" => "server",
-                  "name" => route['nat_host_name']
-                }
+                MU::Config.addDependency(vpc, route['nat_host_name'], "server", no_create_wait: true)
               elsif route['gateway'] == '#NAT'
                 vpc['create_nat_gateway'] = true
                 private_rtbs << table['name']
@@ -1492,17 +1032,11 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
                 if route['gateway'] == '#INTERNET'
                   if table['name'] == subnet['route_table']
                     subnet['is_public'] = true
-                    if vpc['create_nat_gateway']
-                      if vpc['nat_gateway_multi_az']
-                        subnet['create_nat_gateway'] = true
-                      else
-                        if nat_gateway_added
-                          subnet['create_nat_gateway'] = false
-                        else
-                          subnet['create_nat_gateway'] = true 
-                          nat_gateway_added = true
-                        end
-                      end
+                    if vpc['create_nat_gateway'] and (vpc['nat_gateway_multi_az'] or !nat_gateway_added)
+                      subnet['create_nat_gateway'] = true
+                      nat_gateway_added = true
+                    else
+                      subnet['create_nat_gateway'] = false
                     end
                   else
                     subnet['is_public'] = false
@@ -1600,9 +1134,11 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           @my_visible_cidrs[subnets]
         end
 
-        private
 
         # List the route tables for each subnet in the given VPC
+        # @param vpc_id [String]:
+        # @param region [String]:
+        # @param credentials [String]:
         def self.listAllSubnetRouteTables(vpc_id, region: MU.curRegion, credentials: nil)
           resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_subnets(
               filters: [
@@ -1645,6 +1181,299 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           return table_ids.uniq
         end
 
+        # Remove all network interfaces associated with the currently loaded deployment.
+        # @param noop [Boolean]: If true, will only print what would be done
+        # @param filters [Array<Hash>]: EC2 tags to filter against when search for resources to purge
+        # @param region [String]: The cloud provider region
+        # @return [void]
+        def self.purge_interfaces(noop = false, filters = [{name: "tag:MU-ID", values: [MU.deploy_id]}], region: MU.curRegion, credentials: nil)
+          resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_network_interfaces(
+            filters: filters
+          )
+          ifaces = resp.data.network_interfaces
+
+          return if ifaces.nil? or ifaces.size == 0
+
+          ifaces.each { |iface|
+            if iface.vpc_id
+              default_sg = MU::Cloud::AWS::VPC.getDefaultSg(iface.vpc_id, region: region, credentials: credentials)
+              if default_sg and (iface.groups.size > 1 or (iface.groups.size == 1 and iface.groups.first.group_id != default_sg))
+                MU.log "Removing extra security groups from ENI #{iface.network_interface_id}"
+                if !noop
+                  begin
+                    MU::Cloud::AWS.ec2(credentials: credentials, region: region).modify_network_interface_attribute(
+                      network_interface_id: iface.network_interface_id,
+                      groups: [default_sg]
+                    )
+                  rescue ::Aws::EC2::Errors::AuthFailure
+                    MU.log "Permission denied attempting to trim Security Group list for #{iface.network_interface_id}", MU::WARN, details: iface.groups.map { |g| g.group_name }.join(",")+" => default"
+                  end
+                end
+              end
+            end
+            begin
+              if iface.attachment and iface.attachment.status == "attached"
+                MU.log "Detaching Network Interface #{iface.network_interface_id} from #{iface.attachment.instance_owner_id}"
+                tried_lbs = false
+                begin
+                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).detach_network_interface(attachment_id: iface.attachment.attachment_id) if !noop
+                rescue Aws::EC2::Errors::OperationNotPermitted => e
+                  MU.log "Can't detach #{iface.network_interface_id}: #{e.message}", MU::WARN, details: iface.attachment
+                  next
+                rescue Aws::EC2::Errors::IncorrectState => e
+                  MU.log e.message, MU::WARN
+                  sleep 5
+                  retry
+                rescue Aws::EC2::Errors::InvalidAttachmentIDNotFound => e
+                  # suits me just fine
+                rescue Aws::EC2::Errors::AuthFailure => e
+                  if !tried_lbs and iface.attachment.instance_owner_id == "amazon-elb"
+                    MU::Cloud.resourceClass("AWS", "LoadBalancer").cleanup(
+                      noop: noop,
+                      region: region,
+                      credentials: credentials,
+                      flags: {"vpc_id" => iface.vpc_id}
+                    )
+                    tried_lbs = true
+                    retry
+                  end
+                  MU.log e.message, MU::ERR, details: iface.attachment
+                end
+              end
+              MU.log "Deleting Network Interface #{iface.network_interface_id}"
+              MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_network_interface(network_interface_id: iface.network_interface_id) if !noop
+            rescue Aws::EC2::Errors::InvalidNetworkInterfaceIDNotFound
+              # ok then!
+            rescue Aws::EC2::Errors::InvalidParameterValue => e
+              MU.log e.message, MU::ERR, details: iface
+            end
+          }
+        end
+
+        # Fetch the group id of the +default+ security group for the given VPC
+        # @param vpc_id [String]
+        # @param region [String]
+        # @param credentials [String]
+        # @return [String]
+        def self.getDefaultSg(vpc_id, region: MU.curRegion, credentials: nil)
+          default_sg_resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_security_groups(
+            filters: [
+              { name: "group-name", values: ["default"] },
+              { name: "vpc-id", values: [vpc_id] }
+            ]
+          ).security_groups
+          if default_sg_resp and default_sg_resp.size == 1
+            return default_sg_resp.first.group_id
+          end
+          nil
+        end
+
+        # Try to locate the default VPC for a region, and return a BoK-style
+        # config fragment for something that might want to live in it.
+        def self.defaultVpc(region, credentials)
+          cfg_fragment = nil
+          MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_vpcs.vpcs.each { |vpc|
+            if vpc.is_default
+              cfg_fragment = {
+                "id" => vpc.vpc_id,
+                "cloud" => "AWS",
+                "region" => region,
+                "credentials" => credentials
+              }
+              cfg_fragment['subnets'] = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_subnets(
+                filters: [
+                  {
+                    name: "vpc-id",
+                    values: [vpc.vpc_id]
+                  }
+                ]
+              ).subnets.map { |s| { "subnet_id" => s.subnet_id } }
+              break
+            end
+          }
+
+          cfg_fragment
+        end
+
+        # Return a {MU::Config::Ref} that indicates this VPC.
+        # @param subnet_ids [Array<String>]: Optional list of subnet ids with which to infer a +subnet_pref+ parameter.
+        # @return [MU::Config::Ref]
+        def getReference(subnet_ids = [])
+          have_private = have_public = false
+          subnets.each { |s|
+            next if subnet_ids and !subnet_ids.empty? and !subnet_ids.include?(s.cloud_id)
+            if s.private?
+              have_private = true
+            else
+              have_public = true
+            end
+          }
+          subnet_pref = if have_private == have_public
+            "any"
+          elsif have_private
+            "all_private"
+          elsif have_public
+            "all_public"
+          end
+          MU::Config::Ref.get(
+            id: @cloud_id,
+            cloud: "AWS",
+            credentials: @credentials,
+            region: @config['region'],
+            type: "vpcs",
+            subnet_pref: subnet_pref
+          )
+        end
+
+        private
+
+        def peerWith(peer)
+          peer_ref = MU::Config::Ref.get(peer['vpc'])
+          peer_obj = peer_ref.kitten
+          peer_id = peer_ref.kitten.cloud_id
+          if peer_id == @cloud_id
+            MU.log "#{@mu_name} attempted to peer with itself (#{@cloud_id})", MU::ERR, details: peer
+            raise "#{@mu_name} attempted to peer with itself (#{@cloud_id})"
+          end
+
+          if peer_obj and peer_obj.config['peers']
+            peer_obj.config['peers'].each { |peerpeer|
+              if peerpeer['vpc']['name'] == @config['name'] and
+                 (peer['vpc']['name'] <=> @config['name']) == -1
+                MU.log "VPCs #{peer['vpc']['name']} and #{@config['name']} both declare mutual peering connection, ignoring #{@config['name']}'s redundant declaration", MU::DEBUG
+                return
+# XXX and if deploy_id matches or is unset
+              end
+            }
+
+            peer['account'] ||= MU::Cloud::AWS.credToAcct(peer_obj.credentials)
+          end
+
+          peer['account'] ||= MU::Cloud::AWS.account_number
+
+          # See if the peering connection exists before we bother
+          # creating it.
+          resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpc_peering_connections(
+            filters: [
+              {
+                name: "requester-vpc-info.vpc-id",
+                values: [@cloud_id]
+              },
+              {
+                name: "accepter-vpc-info.vpc-id",
+                values: [peer_id.to_s]
+              }
+            ]
+          )
+
+          peering_id = if !resp or !resp.vpc_peering_connections or
+             resp.vpc_peering_connections.empty?
+
+            MU.log "Setting peering connection from VPC #{@config['name']} (#{@cloud_id} in account #{MU::Cloud::AWS.credToAcct(@config['credentials'])}) to #{peer_id} in account #{peer['account']}", details: peer
+            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_vpc_peering_connection(
+              vpc_id: @cloud_id,
+              peer_vpc_id: peer_id,
+              peer_owner_id: peer['account'],
+              peer_region: peer_obj.config['region']
+            )
+            resp.vpc_peering_connection.vpc_peering_connection_id
+          else
+            resp.vpc_peering_connections.first.vpc_peering_connection_id
+          end
+
+          peering_name = @deploy.getResourceName(@config['name']+"-PEER-"+peer_id)
+
+          tag_me(peering_id, peering_name)
+
+          # Create routes to our new friend.
+          MU::Cloud::AWS::VPC.listAllSubnetRouteTables(@cloud_id, region: @config['region'], credentials: @config['credentials']).each { |rtb_id|
+            my_route_config = {
+              :route_table_id => rtb_id,
+              :destination_cidr_block => peer_obj.cloud_desc.cidr_block,
+              :vpc_peering_connection_id => peering_id
+            }
+            rtbdesc = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_route_tables(
+              route_table_ids: [rtb_id]
+            ).route_tables.first
+            already_exists = false
+            rtbdesc.routes.each { |r|
+              if r.destination_cidr_block == peer_obj.cloud_desc.cidr_block
+                if r.vpc_peering_connection_id != peering_id
+                  MU.log "Attempt to create duplicate route to #{peer_obj.cloud_desc.cidr_block} from VPC #{@config['name']}", MU::ERR, details: r
+                  raise MuError, "Can't create route via #{peering_id}, a route to #{peer_obj.cloud_desc.cidr_block} already exists"
+                else
+                  already_exists = true
+                end
+              end
+            }
+            next if already_exists
+
+            MU.log "Creating peering route to #{peer_obj.cloud_desc.cidr_block} in #{peer['vpc']['region']} from VPC #{@config['name']} in #{@config['region']}"
+            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_route(my_route_config)
+          } # MU::Cloud::AWS::VPC.listAllSubnetRouteTables
+
+          can_auto_accept = ((!peer_obj.nil? and !peer_obj.deploydata.nil? and peer_obj.deploydata['auto_accept_peers']) or $MU_CFG['allow_invade_foreign_vpcs'])
+
+          cnxn = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpc_peering_connections(
+            vpc_peering_connection_ids: [peering_id]
+          ).vpc_peering_connections.first
+
+          loop_if = Proc.new {
+            cnxn = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_vpc_peering_connections(
+              vpc_peering_connection_ids: [peering_id]
+            ).vpc_peering_connections.first
+            ((can_auto_accept and cnxn.status.code == "pending-acceptance") or (cnxn.status.code != "active" and cnxn.status.code != "pending-acceptance"))
+          }
+
+          MU.retrier(wait: 5, loop_if: loop_if, ignoreme: [Aws::EC2::Errors::VpcPeeringConnectionAlreadyExists, Aws::EC2::Errors::RouteAlreadyExists]) {
+            if cnxn.status.code == "pending-acceptance"
+              if can_auto_accept
+                MU.log "Auto-accepting peering connection #{peering_id} from VPC #{@config['name']} (#{@cloud_id}) to #{peer_id}", MU::NOTICE
+                MU::Cloud::AWS.ec2(region: peer_obj.config['region'], credentials: peer['account']).accept_vpc_peering_connection(
+                  vpc_peering_connection_id: peering_id,
+                )
+
+                # Create routes back from our new friend to us.
+                MU::Cloud::AWS::VPC.listAllSubnetRouteTables(peer_id, region: peer_obj.config['region'], credentials: peer['account']).uniq.each { |rtb_id|
+                  peer_route_config = {
+                    :route_table_id => rtb_id,
+                    :destination_cidr_block => @config['ip_block'],
+                    :vpc_peering_connection_id => peering_id
+                  }
+                  resp = MU::Cloud::AWS.ec2(region: peer_obj.config['region'], credentials: peer['account']).create_route(peer_route_config)
+                }
+              else
+                MU.log "VPC #{peer_id} is not managed by this Mu server or is not configured to auto-accept peering requests. You must accept the peering request for '#{@config['name']}' (#{@cloud_id}) by hand.", MU::WARN, details: "In the AWS Console, go to VPC => Peering Connections and look in the Actions drop-down. You can also set 'Invade Foreign VPCs' to 'true' using mu-configure to auto-accept all peering connections within this account, regardless of whether this Mu server owns the VPCs. This setting is per-user."
+              end
+            end
+
+            if ["failed", "rejected", "expired", "deleted"].include?(cnxn.status.code)
+              MU.log "VPC peering connection from VPC #{@config['name']} (#{@cloud_id} in #{@config['region']}) to #{peer_id} in #{peer_obj.config['region']} #{cnxn.status.code}: #{cnxn.status.message}", MU::ERR
+              begin
+                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).delete_vpc_peering_connection(
+                  vpc_peering_connection_id: peering_id
+                )
+              rescue Aws::EC2::Errors::InvalidStateTransition
+                # XXX apparently this is normal?
+              end
+              raise MuError, "VPC peering connection from VPC #{@config['name']} (#{@cloud_id}) to #{peer_id} #{cnxn.status.code}: #{cnxn.status.message}"
+            end
+
+          }
+
+        end
+
+        def tag_me(resource_id = @cloud_id, name = @mu_name)
+          MU::Cloud::AWS.createStandardTags(
+            resource_id,
+            region: @config['region'],
+            credentials: @config['credentials'],
+            optional: @config['optional_tags'],
+            nametag: name,
+            othertags: @config['tags']
+          )
+        end
+
         # Helper method for manufacturing route tables. Expect to be called from
         # {MU::Cloud::AWS::VPC#create} or {MU::Cloud::AWS::VPC#groom}.
         # @param rtb [Hash]: A route table description parsed through {MU::Config::BasketofKittens::vpcs::route_tables}.
@@ -1656,21 +1485,9 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_route_table(vpc_id: vpc_id).route_table
           route_table_id = rtb['route_table_id'] = resp.route_table_id
           sleep 5
-          MU::MommaCat.createTag(route_table_id, "Name", vpc_name+"-"+rtb['name'].upcase, credentials: @config['credentials'])
-
-          if @config['tags']
-            @config['tags'].each { |tag|
-              MU::MommaCat.createTag(route_table_id, tag['key'], tag['value'], credentials: @config['credentials'])
-            }
-          end
 
-          if @config['optional_tags']
-            MU::MommaCat.listOptionalTags.each { |key, value|
-              MU::MommaCat.createTag(route_table_id, key, value, region: @config['region'], credentials: @config['credentials'])
-            }
-          end
+          tag_me(route_table_id, vpc_name+"-"+rtb['name'].upcase)
 
-          MU::Cloud::AWS.createStandardTags(route_table_id, credentials: @config['credentials'])
           rtb['routes'].each { |route|
             if route['nat_host_id'].nil? and route['nat_host_name'].nil?
               route_config = {
@@ -1693,7 +1510,6 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           return rtb
         end
 
-
         # Remove all network gateways associated with the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
         # @param region [String]: The cloud provider region
@@ -1746,6 +1562,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           }
           return nil
         end
+        private_class_method :purge_gateways
 
         # Remove all NAT gateways associated with the VPC of the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
@@ -1763,36 +1580,25 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           ).nat_gateways
 
           threads = []
-          parent_thread_id = Thread.current.object_id
+
           if !gateways.empty?
             gateways.each { |gateway|
+              next if noop
+              MU.log "Deleting NAT Gateway #{gateway.nat_gateway_id}"
               threads << Thread.new {
-                MU.dupGlobals(parent_thread_id)
-                MU.log "Deleting NAT Gateway #{gateway.nat_gateway_id}"
-                if !noop
-                  begin
-                    MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_nat_gateway(nat_gateway_id: gateway.nat_gateway_id)
-                    resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_nat_gateways(nat_gateway_ids: [gateway.nat_gateway_id]).nat_gateways.first
+                MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_nat_gateway(nat_gateway_id: gateway.nat_gateway_id)
+
+                resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_nat_gateways(nat_gateway_ids: [gateway.nat_gateway_id]).nat_gateways.first
+
+                loop_if = Proc.new {
+                  resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_nat_gateways(nat_gateway_ids: [gateway.nat_gateway_id]).nat_gateways.first
+                  (resp.state != "deleted" and resp.state != "failed")
+                }
+
+                MU.retrier([Aws::EmptyStructure, NoMethodError], ignoreme: [Aws::EC2::Errors::NatGatewayMalformed, Aws::EC2::Errors::NatGatewayNotFound], max: 50, loop_if: loop_if) { |retries, _wait|
+                  MU.log "Waiting for nat gateway #{gateway.nat_gateway_id} to delete" if retries % 3 == 0
+                }
 
-                    attempts = 0
-                    while resp.state != "deleted" and resp.state != "failed"
-                      MU.log "Waiting for nat gateway #{gateway.nat_gateway_id} to delete" if attempts % 2 == 0
-                      sleep 30
-                      begin
-                        resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_nat_gateways(nat_gateway_ids: [gateway.nat_gateway_id]).nat_gateways.first
-                      rescue Aws::EmptyStructure, NoMethodError
-                        sleep 5
-                        retry
-                      rescue Aws::EC2::Errors::NatGatewayNotFound
-                        MU.log "NAT gateway #{gateway.nat_gateway_id} already deleted", MU::NOTICE
-                      end
-                      MU.log "Timed out while waiting for NAT Gateway to delete #{gateway.nat_gateway_id}: #{resp}", MU::WARN if attempts > 50
-                      attempts += 1
-                    end
-                  rescue Aws::EC2::Errors::NatGatewayMalformed
-                    MU.log "NAT Gateway #{gateway.nat_gateway_id} was already deleted", MU::NOTICE
-                  end
-                end
               }
             }
           end
@@ -1803,6 +1609,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
 
           return nil
         end
+        private_class_method :purge_nat_gateways
 
         # Remove all VPC endpoints associated with the VPC of the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
@@ -1820,38 +1627,21 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           ).vpc_endpoints
 
           threads = []
-          parent_thread_id = Thread.current.object_id
+
           if !vpc_endpoints.empty?
             vpc_endpoints.each { |endpoint|
+              MU.log "Deleting VPC endpoint #{endpoint.vpc_endpoint_id}"
+              next if noop
               threads << Thread.new {
-                MU.dupGlobals(parent_thread_id)
-                MU.log "Deleting VPC endpoint #{endpoint.vpc_endpoint_id}"
-                if !noop
-                  begin
-                    MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_vpc_endpoints(vpc_endpoint_ids: [endpoint.vpc_endpoint_id])
-                    resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpc_endpoints(vpc_endpoint_ids: [endpoint.vpc_endpoint_id]).vpc_endpoints.first
-
-                    attempts = 0
-                    while resp.state != "deleted"
-                      MU.log "Waiting for VPC endpoint #{endpoint.vpc_endpoint_id} to delete" if attempts % 5 == 0
-                      sleep 30
-                      begin
-                        resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpc_endpoints(vpc_endpoint_ids: [endpoint.vpc_endpoint_id]).vpc_endpoints.first
-                      rescue Aws::EmptyStructure, NoMethodError
-                        sleep 5
-                        retry
-                      rescue Aws::EC2::Errors::InvalidVpcEndpointIdNotFound
-                        MU.log "VPC endpoint #{endpoint.vpc_endpoint_id} already deleted", MU::NOTICE
-                      end
-                      MU.log "Timed out while waiting for VPC endpoint to delete #{endpoint.vpc_endpoint_id}: #{resp}", MU::WARN if attempts > 50
-                      attempts += 1
-                    end
-                  rescue Aws::EC2::Errors::VpcEndpointIdMalformed
-                    MU.log "VPC endpoint #{endpoint.vpc_endpoint_id} was already deleted", MU::NOTICE
-                  rescue Aws::EC2::Errors::InvalidVpcEndpointIdNotFound
-                    MU.log "VPC endpoint #{endpoint.vpc_endpoint_id} already deleted", MU::NOTICE
-                  end
-                end
+                MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_vpc_endpoints(vpc_endpoint_ids: [endpoint.vpc_endpoint_id])
+                resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpc_endpoints(vpc_endpoint_ids: [endpoint.vpc_endpoint_id]).vpc_endpoints.first
+                loop_if = Proc.new {
+                  resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpc_endpoints(vpc_endpoint_ids: [endpoint.vpc_endpoint_id]).vpc_endpoints.first
+                  resp.state != "deleted"
+                }
+                MU.retrier([Aws::EmptyStructure, NoMethodError], ignoreme: [Aws::EC2::Errors::InvalidVpcEndpointIdNotFound, Aws::EC2::Errors::VpcEndpointIdMalformed], max: 20, wait: 10, loop_if: loop_if) { |retries, _wait|
+                  MU.log "Waiting for VPC endpoint #{endpoint.vpc_endpoint_id} to delete" if retries % 5 == 0
+                }
               }
             }
           end
@@ -1862,6 +1652,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
 
           return nil
         end
+        private_class_method :purge_endpoints
 
         # Remove all route tables associated with the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
@@ -1882,7 +1673,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
                 MU.log "Deleting Network Interface #{route.network_interface_id}"
                 begin
                   MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_network_interface(network_interface_id: route.network_interface_id) if !noop
-                rescue Aws::EC2::Errors::InvalidNetworkInterfaceIDNotFound => e
+                rescue Aws::EC2::Errors::InvalidNetworkInterfaceIDNotFound
                   MU.log "Network Interface #{route.network_interface_id} has already been deleted", MU::WARN
                 end
               end
@@ -1902,9 +1693,9 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
             table.associations.each { |assoc|
               begin
                 MU::Cloud::AWS.ec2(credentials: credentials, region: region).disassociate_route_table(association_id: assoc.route_table_association_id) if !noop
-              rescue Aws::EC2::Errors::InvalidAssociationIDNotFound => e
+              rescue Aws::EC2::Errors::InvalidAssociationIDNotFound
                 MU.log "Route table association #{assoc.route_table_association_id} already removed", MU::WARN
-              rescue Aws::EC2::Errors::InvalidParameterValue => e
+              rescue Aws::EC2::Errors::InvalidParameterValue
                 # normal and ignorable with the default route table
                 can_delete = false
                 next
@@ -1920,124 +1711,7 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           }
           return nil
         end
-
-
-        # Remove all network interfaces associated with the currently loaded deployment.
-        # @param noop [Boolean]: If true, will only print what would be done
-        # @param filters [Array<Hash>]: EC2 tags to filter against when search for resources to purge
-        # @param region [String]: The cloud provider region
-        # @return [void]
-        def self.purge_interfaces(noop = false, filters = [{name: "tag:MU-ID", values: [MU.deploy_id]}], region: MU.curRegion, credentials: nil)
-          resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_network_interfaces(
-            filters: filters
-          )
-          ifaces = resp.data.network_interfaces
-
-          return if ifaces.nil? or ifaces.size == 0
-
-          ifaces.each { |iface|
-            if iface.vpc_id
-              default_sg_resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_security_groups(
-                filters: [
-                  { name: "group-name", values: ["default"] },
-                  { name: "vpc-id", values: [iface.vpc_id] }
-                ]
-              ).security_groups
-              if default_sg_resp and default_sg_resp.size == 1
-                default_sg = default_sg_resp.first.group_id
-                if iface.groups.size != 1 or
-                   iface.groups.first.group_id != default_sg
-                  MU.log "Removing extra security groups from ENI #{iface.network_interface_id}"
-                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).modify_network_interface_attribute(
-                    network_interface_id: iface.network_interface_id,
-                    groups: [default_sg]
-                  )
-                end
-              end
-            end
-            begin
-              if iface.attachment and iface.attachment.status == "attached"
-                MU.log "Detaching Network Interface #{iface.network_interface_id} from #{iface.attachment.instance_owner_id}"
-                tried_lbs = false
-                begin
-                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).detach_network_interface(attachment_id: iface.attachment.attachment_id) if !noop
-                rescue Aws::EC2::Errors::OperationNotPermitted => e
-                  MU.log "Can't detach #{iface.network_interface_id}: #{e.message}", MU::WARN, details: iface.attachment
-                  next
-                rescue Aws::EC2::Errors::InvalidAttachmentIDNotFound => e
-                  # suits me just fine
-                rescue Aws::EC2::Errors::AuthFailure => e
-                  if !tried_lbs and iface.attachment.instance_owner_id == "amazon-elb"
-                    MU::Cloud::AWS::LoadBalancer.cleanup(
-                      noop: noop,
-                      region: region,
-                      credentials: credentials,
-                      flags: {"vpc_id" => iface.vpc_id}
-                    )
-                    tried_lbs = true
-                    retry
-                  end
-                  MU.log e.message, MU::ERR, details: iface.attachment
-                end
-              end
-              MU.log "Deleting Network Interface #{iface.network_interface_id}"
-              MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_network_interface(network_interface_id: iface.network_interface_id) if !noop
-            rescue Aws::EC2::Errors::InvalidNetworkInterfaceIDNotFound => e
-              # ok then!
-            rescue Aws::EC2::Errors::InvalidParameterValue => e
-              MU.log e.message, MU::ERR, details: iface
-            end
-          }
-        end
-
-        # Remove all subnets associated with the currently loaded deployment.
-        # @param noop [Boolean]: If true, will only print what would be done
-        # @param tagfilters [Array<Hash>]: EC2 tags to filter against when search for resources to purge
-        # @param region [String]: The cloud provider region
-        # @return [void]
-        def self.purge_subnets(noop = false, tagfilters = [{name: "tag:MU-ID", values: [MU.deploy_id]}], region: MU.curRegion, credentials: nil)
-          resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_subnets(
-              filters: tagfilters
-          )
-          subnets = resp.data.subnets
-
-          return if subnets.nil? or subnets.size == 0
-
-          retries = 0
-          subnets.each { |subnet|
-            MU.log "Deleting Subnet #{subnet.subnet_id}"
-            begin
-              if subnet.state != "available"
-                MU.log "Waiting for #{subnet.subnet_id} to be in a removable state...", MU::NOTICE
-                sleep 30
-              else
-                MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_subnet(subnet_id: subnet.subnet_id) if !noop
-              end
-            rescue Aws::EC2::Errors::DependencyViolation => e
-              # We're often stuck waiting for an RDS database or something else
-              # that takes 5-ever to delete.
-              if retries < 19
-                loglevel = (retries > 0 and (retries % 3) == 0) ? MU::NOTICE : MU::DEBUG
-                MU.log "#{e.message} (retry #{retries.to_s}/20)", loglevel
-                if loglevel == MU::NOTICE
-                  MU::Cloud::AWS::VPC.purge_interfaces(noop, [{name: "subnet-id", values: [subnet.subnet_id]}], region: region, credentials: credentials)
-                end
-                sleep 30
-                retries = retries + 1
-                retry
-              elsif retries < 20
-                MU.log "#{e.message} (final attempt)", MU::WARN
-                sleep 60
-                retries = retries + 1
-                retry
-              else
-                raise e
-              end
-            rescue Aws::EC2::Errors::InvalidSubnetIDNotFound
-              next
-            end while subnet.state != "available"
-          }
-        end
+        private_class_method :purge_routetables
 
         # Remove all DHCP options sets associated with the currently loaded
         # deployment.
@@ -2056,7 +1730,9 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
           sets.each { |optset|
             begin
               MU.log "Deleting DHCP Option Set #{optset.dhcp_options_id}"
-              MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_dhcp_options(dhcp_options_id: optset.dhcp_options_id)
+              if !noop
+                MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_dhcp_options(dhcp_options_id: optset.dhcp_options_id)
+              end
             rescue Aws::EC2::Errors::DependencyViolation => e
               MU.log e.inspect, MU::ERR
 #        rescue Aws::EC2::Errors::InvalidSubnetIDNotFound
@@ -2065,6 +1741,62 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
             end
           }
         end
+        private_class_method :purge_dhcpopts
+
+        def self.purge_peering_connections(noop, vpc_id, region: MU.curRegion, credentials: nil)
+          my_peer_conns = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpc_peering_connections(
+            filters: [
+              {
+                name: "requester-vpc-info.vpc-id",
+                values: [vpc_id]
+              }
+            ]
+          ).vpc_peering_connections
+          my_peer_conns.concat(MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpc_peering_connections(
+            filters: [
+              {
+                name: "accepter-vpc-info.vpc-id",
+                values: [vpc_id]
+              }
+            ]
+          ).vpc_peering_connections)
+
+          my_peer_conns.each { |cnxn|
+            [cnxn.accepter_vpc_info.vpc_id, cnxn.requester_vpc_info.vpc_id].each { |peer_vpc|
+              MU::Cloud::AWS::VPC.listAllSubnetRouteTables(peer_vpc, region: region, credentials: credentials).each { |rtb_id|
+                begin
+                  resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_route_tables(
+                    route_table_ids: [rtb_id]
+                  )
+                rescue Aws::EC2::Errors::InvalidRouteTableIDNotFound
+                  next
+                end
+                resp.route_tables.each { |rtb|
+                  rtb.routes.each { |route|
+                    if route.vpc_peering_connection_id == cnxn.vpc_peering_connection_id
+                      MU.log "Removing route #{route.destination_cidr_block} from route table #{rtb_id} in VPC #{peer_vpc}"
+                      MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_route(
+                          route_table_id: rtb_id,
+                          destination_cidr_block: route.destination_cidr_block
+                      ) if !noop
+                    end
+                  }
+                }
+              }
+            }
+            MU.log "Deleting VPC peering connection #{cnxn.vpc_peering_connection_id}"
+            begin
+              MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_vpc_peering_connection(
+                vpc_peering_connection_id: cnxn.vpc_peering_connection_id
+              ) if !noop
+            rescue Aws::EC2::Errors::InvalidStateTransition
+              MU.log "VPC peering connection #{cnxn.vpc_peering_connection_id} not in removable (state #{cnxn.status.code})", MU::WARN
+            rescue Aws::EC2::Errors::OperationNotPermitted => e
+              MU.log "VPC peering connection #{cnxn.vpc_peering_connection_id} refuses to delete: #{e.message}", MU::WARN
+            end
+          }
+        end
+        private_class_method :purge_peering_connections
 
         # Remove all VPCs associated with the currently loaded deployment.
         # @param noop [Boolean]: If true, will only print what would be done
@@ -2073,177 +1805,39 @@ MU.log "association I don't understand in #{@cloud_id}", MU::WARN, details: rtb_
         # @return [void]
         def self.purge_vpcs(noop = false, tagfilters = [{name: "tag:MU-ID", values: [MU.deploy_id]}], region: MU.curRegion, credentials: nil)
           resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpcs(
-              filters: tagfilters
+            filters: tagfilters
           )
 
           vpcs = resp.data.vpcs
           return if vpcs.nil? or vpcs.size == 0
 
           vpcs.each { |vpc|
-            my_peer_conns = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpc_peering_connections(
-                filters: [
-                    {
-                        name: "requester-vpc-info.vpc-id",
-                        values: [vpc.vpc_id]
-                    }
-                ]
-            ).vpc_peering_connections
-            my_peer_conns.concat(MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_vpc_peering_connections(
-              filters: [
-                {
-                  name: "accepter-vpc-info.vpc-id",
-                  values: [vpc.vpc_id]
-                }
-              ]
-            ).vpc_peering_connections)
-            my_peer_conns.each { |cnxn|
-
-              [cnxn.accepter_vpc_info.vpc_id, cnxn.requester_vpc_info.vpc_id].each { |peer_vpc|
-                MU::Cloud::AWS::VPC.listAllSubnetRouteTables(peer_vpc, region: region, credentials: credentials).each { |rtb_id|
-                  begin
-                    resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_route_tables(
-                      route_table_ids: [rtb_id]
-                    )
-                  rescue Aws::EC2::Errors::InvalidRouteTableIDNotFound => e
-                    next
-                  end
-                  resp.route_tables.each { |rtb|
-                    rtb.routes.each { |route|
-                      if route.vpc_peering_connection_id == cnxn.vpc_peering_connection_id
-                        MU.log "Removing route #{route.destination_cidr_block} from route table #{rtb_id} in VPC #{peer_vpc}"
-                        MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_route(
-                            route_table_id: rtb_id,
-                            destination_cidr_block: route.destination_cidr_block
-                        ) if !noop
-                      end
-                    }
-                  }
-                }
-              }
-              MU.log "Deleting VPC peering connection #{cnxn.vpc_peering_connection_id}"
-              begin
-                MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_vpc_peering_connection(
-                    vpc_peering_connection_id: cnxn.vpc_peering_connection_id
-                ) if !noop
-              rescue Aws::EC2::Errors::InvalidStateTransition => e
-                MU.log "VPC peering connection #{cnxn.vpc_peering_connection_id} not in removable (state #{cnxn.status.code})", MU::WARN
-              rescue Aws::EC2::Errors::OperationNotPermitted => e
-                MU.log "VPC peering connection #{cnxn.vpc_peering_connection_id} refuses to delete: #{e.message}", MU::WARN
-              end
+            purge_peering_connections(noop, vpc.vpc_id, region: region, credentials: credentials)
+
+            on_retry = Proc.new {
+              MU::Cloud.resourceClass("AWS", "FirewallRule").cleanup(
+                noop: noop,
+                region: region,
+                credentials: credentials,
+                flags: { "vpc_id" => vpc.vpc_id }
+              )
+              purge_gateways(noop, tagfilters, region: region, credentials: credentials)
             }
 
-            retries = 0
-            begin
+            MU.retrier([Aws::EC2::Errors::DependencyViolation], ignoreme: [Aws::EC2::Errors::InvalidVpcIDNotFound], max: 20, on_retry: on_retry) {
               MU.log "Deleting VPC #{vpc.vpc_id}"
               MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_vpc(vpc_id: vpc.vpc_id) if !noop
-            rescue Aws::EC2::Errors::InvalidVpcIDNotFound
-              MU.log "VPC #{vpc.vpc_id} has already been deleted", MU::WARN
-            rescue Aws::EC2::Errors::DependencyViolation => e
-              if retries < 5
-                MU.log "#{vpc.vpc_id} in #{region} had hidden dependencies, will try to remove them", MU::NOTICE
-                retries += 1
-                # fry some common rogue resources
-                MU::Cloud::AWS::FirewallRule.cleanup(
-                  noop: noop,
-                  region: region,
-                  credentials: credentials,
-                  flags: { "vpc_id" => vpc.vpc_id }
-                )
-                purge_gateways(noop, tagfilters, region: region, credentials: credentials)
-                sleep 10
-                retry
-              else
-                MU.log "Failed to remove #{vpc.vpc_id} in #{region}: #{e.message}", MU::ERR
-                next
-              end
-            end
+            }
 
             if !MU::Cloud::AWS.isGovCloud?(region)
               mu_zone = MU::Cloud::DNSZone.find(cloud_id: "platform-mu", region: region, credentials: credentials).values.first
               if !mu_zone.nil?
-                MU::Cloud::AWS::DNSZone.toggleVPCAccess(id: mu_zone.id, vpc_id: vpc.vpc_id, remove: true, credentials: credentials)
+                MU::Cloud.resourceClass("AWS", "DNSZone").toggleVPCAccess(id: mu_zone.id, vpc_id: vpc.vpc_id, remove: true, credentials: credentials)
               end
             end
           }
         end
-
-        protected
-
-        # Subnets are almost a first-class resource. So let's kinda sorta treat
-        # them like one. This should only be invoked on objects that already
-        # exists in the cloud layer.
-        class Subnet < MU::Cloud::AWS::VPC
-
-          attr_reader :cloud_id
-          attr_reader :ip_block
-          attr_reader :mu_name
-          attr_reader :name
-          attr_reader :az
-          attr_reader :cloud_desc
-
-          # @param parent [MU::Cloud::AWS::VPC]: The parent VPC of this subnet.
-          # @param config [Hash<String>]:
-          def initialize(parent, config)
-            @parent = parent
-            @config = MU::Config.manxify(config)
-            @cloud_id = config['cloud_id']
-            @mu_name = config['mu_name']
-            @name = config['name']
-            @deploydata = config # This is a dummy for the sake of describe()
-            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_subnets(subnet_ids: [@cloud_id]).subnets.first
-            @az = resp.availability_zone
-            @ip_block = resp.cidr_block
-            @cloud_desc = resp # XXX this really isn't the cloud implementation's business
-
-          end
-
-          # Return the cloud identifier for the default route of this subnet.
-          def defaultRoute
-            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_route_tables(
-                filters: [{name: "association.subnet-id", values: [@cloud_id]}]
-            )
-            if resp.route_tables.size == 0 # use default route table for the VPC
-              resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_route_tables(
-                 filters: [{name: "vpc-id", values: [@parent.cloud_id]}]
-              )
-            end
-            resp.route_tables.each { |route_table|
-              route_table.routes.each { |route|
-                if route.destination_cidr_block =="0.0.0.0/0" and route.state != "blackhole"
-                  return route.instance_id if !route.instance_id.nil?
-                  return route.gateway_id if !route.gateway_id.nil?
-                  return route.vpc_peering_connection_id if !route.vpc_peering_connection_id.nil?
-                  return route.network_interface_id if !route.network_interface_id.nil?
-                end
-              }
-            }
-            return nil
-          end
-
-          # Is this subnet privately-routable only, or public?
-          # @return [Boolean]
-          def private?
-            return false if @cloud_id.nil?
-            resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_route_tables(
-                filters: [{name: "association.subnet-id", values: [@cloud_id]}]
-            )
-            if resp.route_tables.size == 0 # use default route table for the VPC
-              resp = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_route_tables(
-                 filters: [{name: "vpc-id", values: [@parent.cloud_id]}]
-              )
-            end
-            resp.route_tables.each { |route_table|
-              route_table.routes.each { |route|
-                return false if !route.gateway_id.nil? and route.gateway_id != "local" # you can have an IgW and route it to a subset of IPs instead of 0.0.0.0/0
-                if route.destination_cidr_block == "0.0.0.0/0"
-                  return true if !route.instance_id.nil?
-                  return true if route.nat_gateway_id
-                end
-              }
-            }
-            return true
-          end
-        end
+        private_class_method :purge_vpcs
 
       end #class
     end #class