@rulebricks/cli 2.1.4 → 2.1.5

package/dist/lib/terraform.js

@@ -265,7 +265,32 @@ async function deleteAwsCloudWatchLogGroup(clusterName, region) {
     }
     catch { /* may not exist */ }
 }
-async function deleteAwsOidcProvider(clusterName) {
+/**
+ * Captures the OIDC issuer URL from an EKS cluster before it's deleted.
+ * The URL uses a random cluster ID (not the cluster name), so we must
+ * grab it while the cluster still exists to identify the OIDC provider later.
+ */
+async function getEksOidcIssuer(clusterName, region) {
+    try {
+        const { stdout } = await execa('aws', [
+            'eks', 'describe-cluster',
+            '--name', clusterName,
+            '--region', region,
+            '--query', 'cluster.identity.oidc.issuer',
+            '--output', 'text',
+        ]);
+        const url = stdout.trim();
+        return url && url !== 'None' ? url : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function deleteAwsOidcProvider(oidcIssuerUrl) {
+    if (!oidcIssuerUrl)
+        return;
+    // Strip the https:// prefix to match how IAM stores the URL
+    const issuerHost = oidcIssuerUrl.replace('https://', '');
     let providerArns;
     try {
         const { stdout } = await execa('aws', [
@@ -286,7 +311,7 @@ async function deleteAwsOidcProvider(clusterName) {
                 '--output', 'json',
             ]);
             const parsed = JSON.parse(stdout);
-            if (parsed.Url && parsed.Url.includes(clusterName)) {
+            if (parsed.Url && issuerHost.includes(parsed.Url)) {
                 await execa('aws', [
                     'iam', 'delete-open-id-connect-provider',
                     '--open-id-connect-provider-arn', arn,
@@ -296,6 +321,29 @@ async function deleteAwsOidcProvider(clusterName) {
         catch { /* skip */ }
     }
 }
+async function releaseAwsElasticIps(clusterName, region) {
+    try {
+        const { stdout } = await execa('aws', [
+            'ec2', 'describe-addresses',
+            '--filters', `Name=tag:Name,Values=*${clusterName}*`,
+            '--region', region,
+            '--query', 'Addresses[?AssociationId==null].AllocationId',
+            '--output', 'json',
+        ]);
+        const allocationIds = JSON.parse(stdout);
+        for (const id of allocationIds) {
+            try {
+                await execa('aws', [
+                    'ec2', 'release-address',
+                    '--allocation-id', id,
+                    '--region', region,
+                ]);
+            }
+            catch { /* may already be released */ }
+        }
+    }
+    catch { /* skip */ }
+}
 async function deleteAwsIamRole(roleName) {
     // Detach all managed policies
     try {
@@ -343,6 +391,107 @@ async function deleteAwsIamRole(roleName) {
     }
     catch { /* may not exist */ }
 }
+async function deleteAwsKmsAlias(clusterName, region) {
+    const aliasName = `alias/eks/${clusterName}`;
+    let keyId;
+    // Find the KMS key behind the alias so we can schedule it for deletion
+    try {
+        const { stdout } = await execa('aws', [
+            'kms', 'list-aliases',
+            '--query', `Aliases[?AliasName=='${aliasName}'].TargetKeyId | [0]`,
+            '--output', 'text',
+            '--region', region,
+        ]);
+        const id = stdout.trim();
+        if (id && id !== 'None') {
+            keyId = id;
+        }
+    }
+    catch { /* skip */ }
+    // Delete the alias (unique name constraint -- blocks re-deploy if left behind)
+    try {
+        await execa('aws', [
+            'kms', 'delete-alias',
+            '--alias-name', aliasName,
+            '--region', region,
+        ]);
+    }
+    catch { /* may not exist */ }
+    // Schedule the underlying key for deletion (7-day mandatory minimum)
+    if (keyId) {
+        try {
+            await execa('aws', [
+                'kms', 'schedule-key-deletion',
+                '--key-id', keyId,
+                '--pending-window-in-days', '7',
+                '--region', region,
+            ]);
+        }
+        catch { /* key may already be pending deletion or not exist */ }
+    }
+}
+/**
+ * Finds KMS keys by the description the EKS module uses, and schedules them for
+ * deletion. Catches keys that survive after their alias is already deleted.
+ */
+async function scheduleAwsOrphanedKmsKeys(clusterName, region) {
+    try {
+        const { stdout } = await execa('aws', [
+            'kms', 'list-keys',
+            '--region', region,
+            '--query', 'Keys[].KeyId',
+            '--output', 'json',
+        ]);
+        const keyIds = JSON.parse(stdout);
+        for (const keyId of keyIds) {
+            try {
+                const { stdout: meta } = await execa('aws', [
+                    'kms', 'describe-key',
+                    '--key-id', keyId,
+                    '--region', region,
+                    '--query', 'KeyMetadata.{State:KeyState,Desc:Description,Manager:KeyManager}',
+                    '--output', 'json',
+                ]);
+                const info = JSON.parse(meta);
+                if (info.Manager === 'CUSTOMER' &&
+                    info.State === 'Enabled' &&
+                    info.Desc.includes(clusterName)) {
+                    await execa('aws', [
+                        'kms', 'schedule-key-deletion',
+                        '--key-id', keyId,
+                        '--pending-window-in-days', '7',
+                        '--region', region,
+                    ]);
+                }
+            }
+            catch { /* skip individual key */ }
+        }
+    }
+    catch { /* skip */ }
+}
+async function deleteAwsLaunchTemplates(clusterName, region) {
+    try {
+        const { stdout } = await execa('aws', [
+            'ec2', 'describe-launch-templates',
+            '--filters', `Name=tag:Environment,Values=rulebricks`,
+            '--region', region,
+            '--query', 'LaunchTemplates[].LaunchTemplateId',
+            '--output', 'json',
+        ]);
+        const ids = JSON.parse(stdout);
+        for (const id of ids) {
+            try {
+                await execa('aws', [
+                    'ec2', 'delete-launch-template',
+                    '--launch-template-id', id,
+                    '--region', region,
+                ]);
+            }
+            catch { /* may not exist or in use */ }
+        }
+    }
+    catch { /* skip */ }
+}
 async function deleteAwsIamPolicy(policyName) {
     try {
         const { stdout } = await execa('aws', [
@@ -366,20 +515,31 @@ async function deleteAwsIamPolicy(policyName) {
  * Entirely best-effort: every step silently swallows errors.
  */
 async function cleanupAwsResources(clusterName, region) {
+    // Capture the OIDC issuer URL BEFORE deleting the cluster -- the URL uses a
+    // random cluster ID (not the cluster name) so we can't find it after deletion.
+    const oidcIssuerUrl = await getEksOidcIssuer(clusterName, region);
     // 1. EKS node groups (must be deleted before cluster)
     await deleteAwsEksNodeGroups(clusterName, region);
     // 2. EKS cluster
     await deleteAwsEksCluster(clusterName, region);
     // 3. CloudWatch log group (now safe -- cluster is gone, won't be recreated)
     await deleteAwsCloudWatchLogGroup(clusterName, region);
-    // 4. OIDC provider (created by EKS module for IRSA)
-    await deleteAwsOidcProvider(clusterName);
+    // 4. OIDC provider (matched by issuer URL captured above)
+    await deleteAwsOidcProvider(oidcIssuerUrl);
     // 5. IAM roles created by terraform modules
     await deleteAwsIamRole(`${clusterName}-ebs-csi`);
     await deleteAwsIamRole(`${clusterName}-external-dns`);
     await deleteAwsIamRole(`${clusterName}-vector`);
     // 6. Customer-managed IAM policies
     await deleteAwsIamPolicy(`${clusterName}-vector-s3`);
+    // 7. KMS key + alias (created by EKS module for envelope encryption)
+    await deleteAwsKmsAlias(clusterName, region);
+    // 8. KMS keys that lost their alias but are still Enabled (matched by description)
+    await scheduleAwsOrphanedKmsKeys(clusterName, region);
+    // 9. Launch templates (created by EKS managed node groups)
+    await deleteAwsLaunchTemplates(clusterName, region);
+    // 10. Elastic IPs (created by VPC module for NAT gateways, cost money if leaked)
+    await releaseAwsElasticIps(clusterName, region);
 }
 /**
  * Destroys Terraform infrastructure, then sweeps remaining cloud resources.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulebricks/cli",
-  "version": "2.1.4",
+  "version": "2.1.5",
   "description": "CLI for deploying and managing private Rulebricks instances",
   "type": "module",
   "bin": {