Version 4

[ekristen]

I'm starting roadmap work on version 4 of this tool.

Roadmap

Confirmed

• Address any TODO(v4) from codebase, likely breaking changes
• Disable S3Object by default Exclude S3Object by Default #380
• Disable DynamoDBTableItem by default
• Establishing Policy on Resource Deprecation - when AWS deprecates a resource, we'll stop including it by default (open for discussion)
• DAG - Directed acyclic graph for dependencies at resource level and instance level

Researching / Discussion

• plan/apply - ability to run aws-nuke in plan mode - creates binary plan file, potentially editable, apply executes [rf] remove plans #85
• config upgrade path for resources with name changes or property name changes
• config verification - verify configs against actual available properties and actions
• arns, consistent arn, or structured summary

libnuke supporting features

• Feature: PhasedResource - some operations are becoming async, this allows for phases along the path to delete without blocking
• Feature: Dependency Graphing - allow building of a DAG graph to allow for removal in order.
• (MAYBE) Feature: Plan/Apply - binary plan files - (i.e. terraform plan/apply)

[thapakazi]

Hi @ekristen would be great to have a interactive option too.

Yesterday I tried the nuke, but the verbose output from the tool made it little difficult to read and use it easily, so I end up building a tui with help of claude, changes: main...thapakazi:aws-nuke:main

Today I built a small poc like this:

[ekristen]

Hi @ekristen would be great to have a interactive option too.

Yesterday I tried the nuke, but the verbose output from the tool made it little difficult to read and use it easily, so I end up building a tui with help of claude, changes: main...thapakazi:aws-nuke:main
Today I built a small poc like this:

Interesting! I'm open to it. What sort of interactivity are you hoping for? Your POC screenshot shows clearly the resources being organized while being scanned ... do you want to be able to toggle status mid run? just want the visual?

[thapakazi]

It would be interesting to have an interactive k9s styled tui, i added tui option to the command, and it opens the tui, to list all the resources, mark them and selectively nuke them.

do you want to be able to toggle status mid run?
what do you mean by this ?

[alesieber]

Hey @ekristen . Thanks for all the great work on aws-nuke — we rely on it heavily and the --log-format=json output has been really useful for automation.

It would be awesome to have a reliable way to get the ARN for each resource in the JSON output.

Today, When using --log-format=json, the name field format varies across resource types — sometimes it's a plain name, sometimes a prefixed format (s3://..., TopicARN: arn:...), sometimes a full ARN. This can pose a challenge when trying to reliably cross-reference Nuke's output with other AWS tools that use ARNs as the standard identifier.

For someone running aws-nuke who wants to verify cleanup results, having the ARNs available in the JSON output would make post-cleanup verification straightforward without needing resource-type-specific parsing logic.

Possible approaches

Either of these could work well:

Option A — Consistent arn field on each resource log line:

{
  "type": "IAMRole",
  "name": "Admin",
  "arn": "arn:aws:iam::123456789012:role/Admin",
  "state": "filtered",
  "state_code": 7
}

Option B — Structured summary at end of execution with ARN lists:

{
  "msg": "execution-summary",
  "deleted": ["arn:aws:s3:::my-bucket", "arn:aws:logs:us-east-1:123456789012:log-group:my-log-group"],
  "filtered": ["arn:aws:iam::123456789012:role/my-protected-role"],
  "failed": []
}

[ekristen]

@alesieber thanks for the comment, should be mostly doable to a point, there are actually a lot of resources that don't have ARNs that last time I checked because of how the service treats them, but I'll add it to the possible list as I'm going through.

[alesieber]

@alesieber thanks for the comment, should be mostly doable to a point, there are actually a lot of resources that don't have ARNs that last time I checked because of how the service treats them, but I'll add it to the possible list as I'm going through.

Thanks for the quick reply! That's unfortunate. Hopefully at least the core/major services expose it. But either way something is definitely better than nothing. Appreciate you adding this into the list!

[mdgm88]

Should probably disable DynamoDBTableItem by default much like disabling S3Object by default. Deleting the table would delete all the items in it much like deleting a S3 bucket would delete all the objects in it.