azure-nuke

Azure Nuke

This is potentially very destructive! Use at your own risk!

Status: This is early beta. Expect some behaviors around safeguarding, delays, and prompts to change. Likely will change CLI behavior a bit as well.

Originally based on the source code from aws-nuke fork and aws-nuke original

Overview

This tool is designed to target an Azure Tenant and all subscriptions within the tenant and remove all resources from that tenant.

Usage

Note: all cli flags can also be expressed as environment variables.

By default no destructive actions will be taken.

azure-nuke nuke \
  --tenant-id=00000000-0000-0000-0000-000000000000 \
  --resource-id=api://11111111-1111-1111-1111-111111111111 \
  --config=./config.yaml

To actually destroy you must add the --no-dry-run cli parameter.

azure-nuke nuke \
  --tenant-id=00000000-0000-0000-0000-000000000000 \
  --resource-id=api://11111111-1111-1111-1111-111111111111 \
  --config=./config.yaml \
  --no-dry-run

Help Text

NAME:
   azure-nuke - remove everything from an azure tenant

USAGE:
   azure-nuke [global options] command [command options] [arguments...]

VERSION:
   0.7.1

AUTHOR:
   Erik Kristensen <erik@erikkristensen.com>

COMMANDS:
   nuke     nuke an azure tenant
   help, h  Shows a list of commands or help for one command

GLOBAL OPTIONS:
   --help, -h     show help (default: false)
   --version, -v  print the version (default: false)

Authentication

Authentication is only supported via a Service Principal and you can authenticate via a shared secret, certificate, or federated token (kubernetes)

Shared Secret

export AZURE_CLIENT_ID=00000000-0000-0000-0000-000000000000
export AZURE_CLIENT_SECRET=000000000000

Certificate

export AZURE_CLIENT_ID=00000000-0000-0000-0000-000000000000
export AZURE_CLIENT_CERTIFICATE=""
export AZURE_CLIENT_PRIVATE_KEY=""

Federated Token (Kubernetes)

You can also authenticate using Federated Tokens with Kubernetes and the Azure Workload Identity.

To make this work you'll need to deploy azure-nuke with a Service Account that's configured to do federation with the Service Principal.

Configuring

The entire configuration of the tool is done via a single YAML file.

Example Configuration

Note: you must add at least one entry to the blocklist.

tenant-blocklist:
  - 00001111-2222-3333-4444-555566667777

tenants:
  77776666-5555-4444-3333-222211110000:
    presets:
      - common
    filters:
      AzureADUser:
        - property: Name
          type: contains
          value: ImportantUser
      ServicePrincipal:
        - type: contains
          property: Name
          value: testing-azure-nuke

presets:
  common:
    filters:
      ResourceGroup:
        - Default
        - NetworkWatcherRG

Azure Locations

• eastus
• eastus2
• southcentralus
• westus2
• westus3
• australiaeast
• southeastasia
• northeurope
• swedencentral
• uksouth
• westeurope
• centralus
• northcentralus
• westus
• southafricanorth
• centralindia
• eastasia
• japaneast
• jioindiawest
• koreacentral
• canadacentral
• francecentral
• germanywestcentral
• norwayeast
• switzerlandnorth
• uaenorth
• brazilsouth
• centralusstage
• eastusstage
• eastus2stage
• northcentralusstage
• southcentralusstage
• westusstage
• westus2stage
• asia
• asiapacific
• australia
• brazil
• canada
• europe
• france
• germany
• global
• india
• japan
• korea
• norway
• southafrica
• switzerland
• uae
• uk
• unitedstates
• unitedstateseuap
• eastasiastage
• southeastasiastage
• centraluseuap
• eastus2euap
• westcentralus
• southafricawest
• australiacentral
• australiacentral2
• australiasoutheast
• japanwest
• jioindiacentral
• koreasouth
• southindia
• westindia
• canadaeast
• francesouth
• germanynorth
• norwaywest
• switzerlandwest
• ukwest
• uaecentral
• brazilsoutheast