@fishawack/lab-env 5.6.1 → 5.7.0-beta.2

package/commands/create/services/aws/index.js

@@ -1,18 +1,159 @@
 const md5 = require("apache-md5");
 const fs = require("fs-extra");
+const generator = require("generate-password");
+const { S3Client, ListBucketsCommand } = require("@aws-sdk/client-s3");
+const {
+    RDSClient,
+    DescribeDBInstancesCommand,
+} = require("@aws-sdk/client-rds");
+const {
+    SecretsManagerClient,
+    DescribeSecretCommand,
+} = require("@aws-sdk/client-secrets-manager");
+const {
+    OpenSearchClient,
+    DescribeDomainCommand,
+} = require("@aws-sdk/client-opensearch");
 
-const { nameSafe } = require("../../libs/utilities.js");
-const { eb } = require("../../libs/vars.js");
+const { nameSafe, Spinner } = require("../../libs/utilities.js");
+const { eb, secretGroups } = require("../../libs/vars.js");
 
 module.exports.s3 = require("./s3.js");
 module.exports.cloudfront = require("./cloudfront.js");
 module.exports.iam = require("./iam.js");
 module.exports.elasticbeanstalk = require("./elasticbeanstalk.js");
 module.exports.ec2 = require("./ec2.js");
+module.exports.rds = require("./rds.js");
+module.exports.opensearch = require("./opensearch.js");
+module.exports.secretsmanager = require("./secretsmanager.js");
+module.exports.acm = require("./acm.js");
 
 module.exports.slug = (repo, client, branch, service = "s3") =>
     nameSafe(`${branch}-${repo}-${client}`, service);
 
+module.exports.fullstackPreflight = async (
+    name,
+    repo,
+    branch,
+    { storage = false, database = false, opensearch = false } = {},
+) => {
+    const existing = {
+        environment: false,
+        storage: false,
+        database: false,
+        opensearch: false,
+        secrets: { app: null, storage: null, database: null, opensearch: null },
+    };
+
+    const spinner = new Spinner("Running pre-flight checks", true);
+
+    try {
+        // Check EB environment
+        spinner.ora.text = "Checking for existing EB environment";
+        try {
+            const { Environments } =
+                await module.exports.elasticbeanstalk.describeEnvironment(name);
+            const active = Environments.filter(
+                (e) => e.Status !== "Terminated",
+            );
+            if (active.length) {
+                existing.environment = active[0];
+            }
+        } catch {
+            /* does not exist */
+        }
+
+        // Check S3
+        if (storage) {
+            const s3Slug = module.exports.slug(
+                repo,
+                process.env.AWS_PROFILE,
+                branch,
+                "s3",
+            );
+
+            spinner.ora.text = "Checking for existing S3 bucket";
+            try {
+                const { Buckets } = await new S3Client({}).send(
+                    new ListBucketsCommand({}),
+                );
+                if (Buckets.some((b) => b.Name === s3Slug)) {
+                    existing.storage = true;
+                }
+            } catch {
+                /* empty */
+            }
+        }
+
+        // Check RDS
+        if (database) {
+            const rdsSlug = module.exports.slug(
+                repo,
+                process.env.AWS_PROFILE,
+                branch,
+                "rds",
+            );
+
+            spinner.ora.text = "Checking for existing RDS instance";
+            try {
+                const res = await new RDSClient({}).send(
+                    new DescribeDBInstancesCommand({
+                        DBInstanceIdentifier: rdsSlug,
+                    }),
+                );
+                const instance = res.DBInstances[0];
+                if (instance && instance.DBInstanceStatus !== "deleting") {
+                    existing.database = true;
+                }
+            } catch {
+                /* does not exist */
+            }
+        }
+
+        // Check OpenSearch
+        if (opensearch) {
+            const osSlug = module.exports.slug(
+                repo,
+                process.env.AWS_PROFILE,
+                branch,
+                "os",
+            );
+
+            spinner.ora.text = "Checking for existing OpenSearch domain";
+            try {
+                const { DomainStatus } = await new OpenSearchClient({}).send(
+                    new DescribeDomainCommand({ DomainName: osSlug }),
+                );
+                if (DomainStatus && !DomainStatus.Deleted) {
+                    existing.opensearch = true;
+                }
+            } catch {
+                /* does not exist */
+            }
+        }
+
+        // Check for existing secrets
+        for (const group of secretGroups) {
+            spinner.ora.text = `Checking for existing ${group} secret`;
+            try {
+                const secret = await new SecretsManagerClient({}).send(
+                    new DescribeSecretCommand({ SecretId: `${name}-${group}` }),
+                );
+                existing.secrets[group] = secret.ARN;
+            } catch {
+                /* does not exist */
+            }
+        }
+
+        spinner.ora.succeed("Pre-flight checks complete");
+    } catch (e) {
+        spinner.ora.fail("Pre-flight checks failed");
+        throw e;
+    }
+
+    return { existing };
+};
+
 module.exports.clients = [
     "fishawack",
     "abbvie",
@@ -166,35 +307,243 @@ module.exports.fullstack = async (
     framework,
     availability,
     database = false,
+    storage = false,
+    opensearch = false,
+    existingSecrets = {
+        app: null,
+        storage: null,
+        database: null,
+        opensearch: null,
+    },
+    snapshot = null,
+    elbScheme = "public",
+    existingEnvironment = false,
+    existingResources = {
+        storage: false,
+        database: false,
+        opensearch: false,
+    },
+    appName,
+    appDomain,
+    certArn,
 ) => {
     const { platform, language } = eb.configurations[framework];
+    const isLaravel = framework === "laravel";
 
-    const s3Slug = module.exports.slug(
-        repo,
-        process.env.AWS_PROFILE,
-        branch,
-        "s3",
-    );
+    // Always compute s3Slug if storage is requested or pre-exists
+    // (needed for instance profile S3 access even when bucket creation is skipped)
+    const s3Slug =
+        storage || existingSecrets.storage
+            ? module.exports.slug(repo, process.env.AWS_PROFILE, branch, "s3")
+            : undefined;
 
-    await module.exports.iam.createIAMUser(s3Slug, tags);
-    await module.exports.iam.attachIAMPolicy(
-        s3Slug,
-        "arn:aws:iam::aws:policy/AmazonS3FullAccess",
-    );
-    const {
-        AccessKey: { AccessKeyId },
-        AccessKey: { SecretAccessKey },
-    } = await module.exports.iam.createAccessKey(s3Slug);
-
-    await module.exports.s3.createS3Bucket(
-        s3Slug,
-        tags,
-        false,
-        "BucketOwnerPreferred",
-    );
+    // Always compute osSlug if opensearch is requested or pre-exists
+    const osSlug =
+        opensearch || existingSecrets.opensearch
+            ? module.exports.slug(repo, process.env.AWS_PROFILE, branch, "os")
+            : undefined;
+
+    let s3Data = {};
+
+    if (storage && !existingResources.storage) {
+        if (isLaravel) {
+            await module.exports.s3.createS3Bucket(s3Slug, tags, {
+                BlockPublicAcls: true,
+                IgnorePublicAcls: true,
+                BlockPublicPolicy: false,
+                RestrictPublicBuckets: false,
+            });
+
+            await module.exports.s3.setPublicReadPolicy(s3Slug, "public/*");
+        } else {
+            await module.exports.iam.createIAMUser(s3Slug, tags);
+            await module.exports.iam.attachIAMPolicy(
+                s3Slug,
+                "arn:aws:iam::aws:policy/AmazonS3FullAccess",
+            );
+            const {
+                AccessKey: { AccessKeyId },
+                AccessKey: { SecretAccessKey },
+            } = await module.exports.iam.createAccessKey(s3Slug);
+
+            await module.exports.s3.createS3Bucket(
+                s3Slug,
+                tags,
+                false,
+                "BucketOwnerPreferred",
+            );
+
+            s3Data = { s3Slug, AccessKeyId, SecretAccessKey };
+        }
+    }
+
+    if (storage && !s3Data.s3Slug) {
+        s3Data = { s3Slug };
+    }
+
+    let instanceProfileName;
+    let opensearchDomainArn;
+
+    if (osSlug) {
+        opensearchDomainArn = `arn:aws:es:${process.env.AWS_REGION}:*:domain/${osSlug}`;
+    }
+
+    if (isLaravel) {
+        instanceProfileName =
+            await module.exports.iam.ensureEnvironmentInstanceProfile(
+                name,
+                s3Slug,
+                opensearchDomainArn,
+            );
+    } else {
+        await module.exports.iam.ensureEBInstanceProfileExists();
+    }
 
-    await module.exports.iam.ensureEBInstanceProfileExists();
     await module.exports.iam.ensureEBManagedUpdateProfileExists();
+    const vpcData = await module.exports.ec2.ensurePrivateSubnets();
+
+    // Create decoupled RDS instance if database is required
+    let rdsData = {};
+
+    if (database && !existingResources.database) {
+        const rdsSlug = module.exports.slug(
+            repo,
+            process.env.AWS_PROFILE,
+            branch,
+            "rds",
+        );
+
+        const dbPassword = generator.generate({
+            length: 10,
+            numbers: true,
+        });
+
+        await module.exports.rds.ensureSSLParameterGroup();
+
+        const rdsSecurityGroupId =
+            await module.exports.ec2.createRDSSecurityGroup(rdsSlug, tags);
+
+        const dbSubnetGroupName = await module.exports.rds.ensureDBSubnetGroup(
+            vpcData.privateSubnetIds,
+        );
+
+        if (snapshot) {
+            await module.exports.rds.restoreRDSInstanceFromSnapshot(
+                rdsSlug,
+                snapshot,
+                rdsSecurityGroupId,
+                tags,
+                dbSubnetGroupName,
+            );
+
+            await module.exports.rds.waitForRDSInstance(rdsSlug);
+
+            await module.exports.rds.modifyRDSPassword(rdsSlug, dbPassword);
+        } else {
+            await module.exports.rds.createRDSInstance(
+                rdsSlug,
+                tags,
+                dbPassword,
+                rdsSecurityGroupId,
+                dbSubnetGroupName,
+            );
+        }
+
+        const rdsInstance =
+            await module.exports.rds.waitForRDSInstance(rdsSlug);
+
+        rdsData = {
+            RDS_HOSTNAME: rdsInstance.Endpoint.Address,
+            RDS_PORT: String(rdsInstance.Endpoint.Port),
+            RDS_PASSWORD: dbPassword,
+        };
+    } else if (
+        database &&
+        existingResources.database &&
+        !existingSecrets.database
+    ) {
+        // Recovery: RDS exists but secret was lost — reset password and populate data
+        const rdsSlug = module.exports.slug(
+            repo,
+            process.env.AWS_PROFILE,
+            branch,
+            "rds",
+        );
+
+        const dbPassword = generator.generate({
+            length: 10,
+            numbers: true,
+        });
+
+        await module.exports.rds.modifyRDSPassword(rdsSlug, dbPassword);
+        const rdsInstance =
+            await module.exports.rds.waitForRDSInstance(rdsSlug);
+
+        rdsData = {
+            RDS_HOSTNAME: rdsInstance.Endpoint.Address,
+            RDS_PORT: String(rdsInstance.Endpoint.Port),
+            RDS_PASSWORD: dbPassword,
+        };
+    } else if (
+        database &&
+        existingResources.database &&
+        existingSecrets.database
+    ) {
+        // Existing RDS + secret — read secret values for template interpolation
+        const secretValue = await module.exports.secretsmanager.getSecretValue(
+            `${name}-database`,
+        );
+        rdsData = {
+            RDS_HOSTNAME: secretValue.RDS_HOSTNAME,
+            RDS_PORT: secretValue.RDS_PORT,
+            RDS_PASSWORD: secretValue.RDS_PASSWORD,
+        };
+    }
+
+    // Create decoupled OpenSearch domain if requested
+    let osData = {};
+
+    if (opensearch && !existingResources.opensearch) {
+        await module.exports.iam.ensureOpenSearchServiceRole();
+
+        const roleArn = instanceProfileName
+            ? (await module.exports.iam.getRole(instanceProfileName)).Role.Arn
+            : undefined;
+
+        const osSecurityGroupId =
+            await module.exports.ec2.createOpenSearchSecurityGroup(
+                osSlug,
+                tags,
+            );
+
+        await module.exports.opensearch.createOpenSearchDomain(
+            osSlug,
+            osSecurityGroupId,
+            vpcData.privateSubnetIds,
+            roleArn,
+        );
+
+        const osDomain =
+            await module.exports.opensearch.waitForOpenSearchDomain(osSlug);
+
+        const osEndpoint =
+            osDomain.Endpoint || (osDomain.Endpoints && osDomain.Endpoints.vpc);
+
+        osData = {
+            SEARCH_HOST: `https://${osEndpoint}`,
+        };
+    } else if (opensearch && existingResources.opensearch) {
+        // Existing domain — describe to populate osData for secret payloads
+        const osDomain =
+            await module.exports.opensearch.describeOpenSearchDomain(osSlug);
+
+        const osEndpoint =
+            osDomain.Endpoint || (osDomain.Endpoints && osDomain.Endpoints.vpc);
+
+        osData = {
+            SEARCH_HOST: `https://${osEndpoint}`,
+        };
+    }
 
     try {
         await module.exports.elasticbeanstalk.createElasticBeanstalkApplication(
@@ -217,29 +566,273 @@ module.exports.fullstack = async (
     const CNAMEPrefix = `fw-auto-${name.split("-")[name.split("-").length - 1]}`;
     process.env.DOMAIN_LINK = `${CNAMEPrefix}.${process.env.AWS_REGION}.elasticbeanstalk.com`;
 
-    const OptionSettings = eb.merge(
-        "environments",
-        { framework, availability, platform, language, database },
-        { s3Slug, AccessKeyId, SecretAccessKey },
+    // Build secret payloads and create/reuse secrets
+    const payloads = eb.buildSecretPayloads(
+        {
+            framework,
+            availability,
+            platform,
+            language,
+            database,
+            storage,
+            opensearch,
+        },
+        {
+            ...s3Data,
+            ...rdsData,
+            ...osData,
+            APP_NAME: appName,
+            APP_DOMAIN: appDomain,
+        },
     );
 
-    if (hasKeyPair) {
-        OptionSettings.push({
-            OptionName: "EC2KeyName",
-            Value: "id_rsa_prev",
-            Namespace: "aws:autoscaling:launchconfiguration",
+    const secretArns = {};
+
+    for (const group of secretGroups) {
+        if (existingSecrets[group]) {
+            secretArns[`${group}SecretArn`] = existingSecrets[group];
+
+            // Merge new keys into existing secret if payload has additions
+            if (Object.keys(payloads[group]).length) {
+                const currentValue =
+                    await module.exports.secretsmanager.getSecretValue(
+                        `${name}-${group}`,
+                    );
+                const newKeys = Object.keys(payloads[group]).filter(
+                    (k) => !(k in currentValue),
+                );
+
+                if (newKeys.length) {
+                    const merged = { ...currentValue };
+                    for (const k of newKeys) {
+                        merged[k] = payloads[group][k];
+                    }
+                    await module.exports.secretsmanager.updateSecretValue(
+                        `${name}-${group}`,
+                        merged,
+                    );
+                }
+            }
+        } else if (Object.keys(payloads[group]).length) {
+            const res = await module.exports.secretsmanager.createSecret(
+                `${name}-${group}`,
+                payloads[group],
+                tags,
+            );
+            secretArns[`${group}SecretArn`] = res.ARN;
+        }
+    }
+
+    // Auto-generate environmentsecrets entries from secret keys + ARNs
+    const secretSettings = [];
+
+    for (const group of secretGroups) {
+        const arn = secretArns[`${group}SecretArn`];
+        if (!arn) continue;
+
+        let keys;
+
+        if (existingSecrets[group]) {
+            const secretValue =
+                await module.exports.secretsmanager.getSecretValue(
+                    `${name}-${group}`,
+                );
+            keys = Object.keys(secretValue);
+        } else {
+            keys = Object.keys(payloads[group]);
+        }
+
+        for (const key of keys) {
+            secretSettings.push({
+                OptionName: key,
+                Value: `${arn}:${key}`,
+                Namespace:
+                    "aws:elasticbeanstalk:application:environmentsecrets",
+            });
+        }
+    }
+
+    let environment;
+
+    if (existingEnvironment) {
+        // Re-provision: sync secrets to existing EB environment
+        const SECRETS_NAMESPACE =
+            "aws:elasticbeanstalk:application:environmentsecrets";
+        const currentSettings =
+            await module.exports.elasticbeanstalk.describeConfigurationSettings(
+                repo,
+                name,
+            );
+        const currentSecrets = currentSettings.filter(
+            (s) => s.Namespace === SECRETS_NAMESPACE,
+        );
+
+        const currentKeys = new Set(currentSecrets.map((s) => s.OptionName));
+        const expectedKeys = new Set(secretSettings.map((s) => s.OptionName));
+
+        const toAdd = secretSettings.filter(
+            (s) => !currentKeys.has(s.OptionName),
+        );
+        const toUpdate = secretSettings.filter((s) => {
+            const current = currentSecrets.find(
+                (c) => c.OptionName === s.OptionName,
+            );
+            return current && current.Value !== s.Value;
         });
+        const toRemove = currentSecrets
+            .filter((s) => !expectedKeys.has(s.OptionName))
+            .map((s) => ({
+                OptionName: s.OptionName,
+                Namespace: SECRETS_NAMESPACE,
+            }));
+
+        const optionSettings = [...toAdd, ...toUpdate];
+
+        if (optionSettings.length || toRemove.length) {
+            await module.exports.elasticbeanstalk.updateEnvironmentSettings(
+                name,
+                optionSettings,
+                toRemove,
+            );
+        }
+
+        environment = existingEnvironment;
+    } else {
+        const OptionSettings = eb.merge(
+            "environments",
+            {
+                framework,
+                availability,
+                platform,
+                language,
+                database,
+                storage,
+                opensearch,
+                vpcId: vpcData.vpcId,
+                privateSubnetIds: vpcData.privateSubnetIds.join(","),
+                publicSubnetIds: vpcData.publicSubnetIds.join(","),
+                elbScheme,
+                instanceProfileName,
+            },
+            {
+                ...s3Data,
+                ...rdsData,
+                ...osData,
+                APP_NAME: appName,
+                APP_DOMAIN: appDomain,
+            },
+        );
+
+        // HTTPS listener via ACM cert
+        if (certArn) {
+            OptionSettings.push(
+                {
+                    OptionName: "ListenerEnabled",
+                    Value: "true",
+                    Namespace: "aws:elbv2:listener:443",
+                },
+                {
+                    OptionName: "Protocol",
+                    Value: "HTTPS",
+                    Namespace: "aws:elbv2:listener:443",
+                },
+                {
+                    OptionName: "SSLCertificateArns",
+                    Value: certArn,
+                    Namespace: "aws:elbv2:listener:443",
+                },
+                {
+                    OptionName: "SSLPolicy",
+                    Value: "ELBSecurityPolicy-FS-1-2-Res-2020-10",
+                    Namespace: "aws:elbv2:listener:443",
+                },
+                {
+                    OptionName: "DefaultProcess",
+                    Value: "default",
+                    Namespace: "aws:elbv2:listener:443",
+                },
+            );
+        }
+
+        OptionSettings.push(...secretSettings);
+
+        if (hasKeyPair) {
+            OptionSettings.push({
+                OptionName: "EC2KeyName",
+                Value: "id_rsa_prev",
+                Namespace: "aws:autoscaling:launchconfiguration",
+            });
+        }
+
+        environment =
+            await module.exports.elasticbeanstalk.createElasticBeanstalkEnvironment(
+                name,
+                { framework, availability, platform, language },
+                repo,
+                OptionSettings,
+                CNAMEPrefix,
+                tags,
+            );
     }
 
-    const environment =
-        await module.exports.elasticbeanstalk.createElasticBeanstalkEnvironment(
-            name,
-            { framework, availability, platform, language },
-            repo,
-            OptionSettings,
-            CNAMEPrefix,
-            tags,
+    // Add RDS security group ingress rule from EB security group
+    const rdsSlugForIngress = module.exports.slug(
+        repo,
+        process.env.AWS_PROFILE,
+        branch,
+        "rds",
+    );
+
+    try {
+        const rdsSg = await module.exports.ec2.findSecurityGroupByName(
+            `${rdsSlugForIngress}-rds`,
         );
+        const ebSg = await module.exports.ec2.findSecurityGroupByTag([
+            {
+                Name: "tag:elasticbeanstalk:environment-name",
+                Values: [name],
+            },
+            {
+                Name: "tag:aws:cloudformation:logical-id",
+                Values: ["AWSEBSecurityGroup"],
+            },
+        ]);
+        if (rdsSg && ebSg) {
+            await module.exports.ec2.authorizeRDSIngress(
+                rdsSg.GroupId,
+                ebSg.GroupId,
+            );
+        }
+    } catch {
+        /* empty */
+    }
+
+    // Add OpenSearch security group ingress rule from EB security group
+    if (osSlug) {
+        try {
+            const osSg = await module.exports.ec2.findSecurityGroupByName(
+                `${osSlug}-os`,
+            );
+            const ebSgForOs = await module.exports.ec2.findSecurityGroupByTag([
+                {
+                    Name: "tag:elasticbeanstalk:environment-name",
+                    Values: [name],
+                },
+                {
+                    Name: "tag:aws:cloudformation:logical-id",
+                    Values: ["AWSEBSecurityGroup"],
+                },
+            ]);
+            if (osSg && ebSgForOs) {
+                await module.exports.ec2.authorizeOpenSearchIngress(
+                    osSg.GroupId,
+                    ebSgForOs.GroupId,
+                );
+            }
+        } catch {
+            /* empty */
+        }
+    }
 
     const configurations = eb.merge("configurations", {
         framework,
@@ -287,28 +880,104 @@ module.exports.fullstack = async (
     return config;
 };
 
-module.exports.fullstackTerminate = async (name, repo, branch) => {
-    const s3Slug = module.exports.slug(
+module.exports.fullstackTerminate = async (
+    name,
+    repo,
+    branch,
+    {
+        deleteStorage = false,
+        deleteDatabase = false,
+        deleteOpenSearch = false,
+        deleteAppSecret = false,
+    } = {},
+) => {
+    if (deleteStorage) {
+        const s3Slug = module.exports.slug(
+            repo,
+            process.env.AWS_PROFILE,
+            branch,
+            "s3",
+        );
+
+        try {
+            await module.exports.iam.removeIAMUser(s3Slug);
+        } catch {
+            /* empty */
+        }
+
+        try {
+            await module.exports.s3.emptyS3Bucket(s3Slug);
+        } catch {
+            /* empty */
+        }
+
+        try {
+            await module.exports.s3.removeS3Bucket(s3Slug);
+        } catch {
+            /* empty */
+        }
+    }
+
+    // Remove RDS inbound rule referencing EB security group before terminating EB
+    const rdsSlug = module.exports.slug(
         repo,
         process.env.AWS_PROFILE,
         branch,
-        "s3",
+        "rds",
     );
 
     try {
-        await module.exports.iam.removeIAMUser(s3Slug);
+        const rdsSg = await module.exports.ec2.findSecurityGroupByName(
+            `${rdsSlug}-rds`,
+        );
+        const ebSg = await module.exports.ec2.findSecurityGroupByTag([
+            {
+                Name: "tag:elasticbeanstalk:environment-name",
+                Values: [name],
+            },
+            {
+                Name: "tag:aws:cloudformation:logical-id",
+                Values: ["AWSEBSecurityGroup"],
+            },
+        ]);
+        if (rdsSg && ebSg) {
+            await module.exports.ec2.revokeRDSIngress(
+                rdsSg.GroupId,
+                ebSg.GroupId,
+            );
+        }
     } catch {
         /* empty */
     }
 
-    try {
-        await module.exports.s3.emptyS3Bucket(s3Slug);
-    } catch {
-        /* empty */
-    }
+    // Remove OpenSearch inbound rule referencing EB security group before terminating EB
+    const osSlug = module.exports.slug(
+        repo,
+        process.env.AWS_PROFILE,
+        branch,
+        "os",
+    );
 
     try {
-        await module.exports.s3.removeS3Bucket(s3Slug);
+        const osSg = await module.exports.ec2.findSecurityGroupByName(
+            `${osSlug}-os`,
+        );
+        const ebSgForOs = await module.exports.ec2.findSecurityGroupByTag([
+            {
+                Name: "tag:elasticbeanstalk:environment-name",
+                Values: [name],
+            },
+            {
+                Name: "tag:aws:cloudformation:logical-id",
+                Values: ["AWSEBSecurityGroup"],
+            },
+        ]);
+        if (osSg && ebSgForOs) {
+            await module.exports.ec2.revokeOpenSearchIngress(
+                osSg.GroupId,
+                ebSgForOs.GroupId,
+            );
+        }
     } catch {
         /* empty */
     }
@@ -328,4 +997,87 @@ module.exports.fullstackTerminate = async (name, repo, branch) => {
     } catch {
         /* empty */
     }
+
+    try {
+        await module.exports.iam.removeEnvironmentInstanceProfile(name);
+    } catch {
+        /* empty */
+    }
+
+    if (deleteDatabase) {
+        try {
+            await module.exports.rds.deleteRDSInstance(rdsSlug);
+            await module.exports.rds.waitForRDSDeletion(rdsSlug);
+        } catch {
+            /* empty */
+        }
+
+        try {
+            const sg = await module.exports.ec2.findSecurityGroupByName(
+                `${rdsSlug}-rds`,
+            );
+            if (sg) {
+                await module.exports.ec2.deleteSecurityGroup(sg.GroupId);
+            }
+        } catch {
+            /* empty */
+        }
+    }
+
+    if (deleteOpenSearch) {
+        try {
+            await module.exports.opensearch.deleteOpenSearchDomain(osSlug);
+            await module.exports.opensearch.waitForOpenSearchDeletion(osSlug);
+        } catch {
+            /* empty */
+        }
+
+        try {
+            const sg = await module.exports.ec2.findSecurityGroupByName(
+                `${osSlug}-os`,
+            );
+            if (sg) {
+                await module.exports.ec2.deleteSecurityGroup(sg.GroupId);
+            }
+        } catch {
+            /* empty */
+        }
+    }
+
+    // Delete secrets
+    if (deleteStorage) {
+        try {
+            await module.exports.secretsmanager.deleteSecret(`${name}-storage`);
+        } catch {
+            /* empty */
+        }
+    }
+
+    if (deleteDatabase) {
+        try {
+            await module.exports.secretsmanager.deleteSecret(
+                `${name}-database`,
+            );
+        } catch {
+            /* empty */
+        }
+    }
+
+    if (deleteOpenSearch) {
+        try {
+            await module.exports.secretsmanager.deleteSecret(
+                `${name}-opensearch`,
+            );
+        } catch {
+            /* empty */
+        }
+    }
+
+    if (deleteAppSecret) {
+        try {
+            await module.exports.secretsmanager.deleteSecret(`${name}-app`);
+        } catch {
+            /* empty */
+        }
+    }
 };