Merge pull request #932 from alesieber/feat/use-current-role-to-delete-stack

feat(cloudformation): Add UseCurrentRoleToDeleteStack setting

Author: ekristen

docs/resources/cloud-formation-stack.md

@@ -37,26 +37,59 @@ The string value is always what is used in the output of the log format when a r
 
 - `DisableDeletionProtection`
 - `CreateRoleToDeleteStack`
+- `UseCurrentRoleToDeleteStack`
 
 
 ### DisableDeletionProtection
 
-!!! note
-    There is currently no description for this setting. Often times settings are fairly self-explanatory. However, we
-    are working on adding descriptions for all settings.
+When enabled, aws-nuke will automatically disable termination protection on a CloudFormation stack before
+attempting to delete it. Without this setting, stacks with termination protection enabled will fail to delete.
 
-```text
-DisableDeletionProtection
+```yaml
+CloudFormationStack:
+  DisableDeletionProtection: "true"
 ```
 
 
 ### CreateRoleToDeleteStack
 
-!!! note
-    There is currently no description for this setting. Often times settings are fairly self-explanatory. However, we
-    are working on adding descriptions for all settings.
+When enabled, aws-nuke will create a temporary IAM role to delete a stack whose original execution role no longer
+exists or cannot be assumed. The temporary role is tagged with `Managed: aws-nuke` and is cleaned up after deletion.
 
-```text
-CreateRoleToDeleteStack
+```yaml
+CloudFormationStack:
+  CreateRoleToDeleteStack: "true"
+```
+
+
+### UseCurrentRoleToDeleteStack
+
+When enabled, aws-nuke overrides the stack's associated IAM role with the caller's current role during deletion.
+The caller's role ARN is resolved via STS `GetCallerIdentity` and passed as the `RoleARN` parameter on `DeleteStack`
+calls. This applies to both normal deletion and `DELETE_FAILED` retry paths.
+
+This is useful when SCPs deny actions from the stack's original creation role (e.g. CDK `cfn-exec-role`) during
+account cleanup.
+
+```yaml
+CloudFormationStack:
+  UseCurrentRoleToDeleteStack: "true"
 ```
 
+!!! warning "Security Consideration"
+    Enabling this setting may broaden the permissions available during stack deletion. The role running aws-nuke
+    typically has broader permissions than the stack's original execution role. Be aware that stack deletion
+    operations (such as deleting resources within the stack) will execute with the caller's role permissions
+    rather than the more constrained original stack role.
+
+!!! note "Assumed Role Requirement"
+    This setting only takes effect when aws-nuke is authenticated via an IAM assumed role. If aws-nuke is running
+    as an IAM user or using any other authentication method that is not an assumed role, this setting is effectively
+    a no-op and stack deletion falls back to normal behavior (using the stack's original role or no role).
+
+!!! note "IAM Path Prefix Limitation"
+    If the assumed role has an IAM path prefix (e.g. `arn:aws:iam::123456789012:role/my-path/MyRole`), the STS
+    assumed-role ARN omits the path component. The reconstructed role ARN will not include the path, which may
+    result in an incorrect ARN. This is uncommon in typical CDK or CloudFormation use cases.
+
+

resources/cloudformation-stack.go

@@ -10,10 +10,12 @@ import (
 	"github.com/gotidy/ptr"
 	"github.com/sirupsen/logrus"
 
-	"github.com/aws/aws-sdk-go/aws"                    //nolint:staticcheck
-	"github.com/aws/aws-sdk-go/aws/awserr"             //nolint:staticcheck
-	"github.com/aws/aws-sdk-go/service/cloudformation" //nolint:staticcheck
-	"github.com/aws/aws-sdk-go/service/cloudformation/cloudformationiface"
+	"github.com/aws/aws-sdk-go/aws"                                        //nolint:staticcheck
+	"github.com/aws/aws-sdk-go/aws/awserr"                                 //nolint:staticcheck
+	"github.com/aws/aws-sdk-go/service/cloudformation"                     //nolint:staticcheck
+	"github.com/aws/aws-sdk-go/service/cloudformation/cloudformationiface" //nolint:staticcheck
+	"github.com/aws/aws-sdk-go/service/sts"                                //nolint:staticcheck
+	"github.com/aws/aws-sdk-go/service/sts/stsiface"                       //nolint:staticcheck
 
 	"github.com/aws/aws-sdk-go-v2/service/iam"
 	iamtypes "github.com/aws/aws-sdk-go-v2/service/iam/types"
@@ -40,17 +42,26 @@ func init() {
 		Settings: []string{
 			"DisableDeletionProtection",
 			"CreateRoleToDeleteStack",
+			"UseCurrentRoleToDeleteStack",
 		},
 	})
 }
 
+// iamRoleAPI is the subset of the IAM v2 client used by CloudFormationStack for role
+// create/delete operations. Defined as an interface to enable test mocking.
+type iamRoleAPI interface {
+	CreateRole(ctx context.Context, params *iam.CreateRoleInput, optFns ...func(*iam.Options)) (*iam.CreateRoleOutput, error)
+	DeleteRole(ctx context.Context, params *iam.DeleteRoleInput, optFns ...func(*iam.Options)) (*iam.DeleteRoleOutput, error)
+}
+
 type CloudFormationStackLister struct{}
 
 func (l *CloudFormationStackLister) List(_ context.Context, o interface{}) ([]resource.Resource, error) {
 	opts := o.(*nuke.ListerOpts)
 
 	svc := cloudformation.New(opts.Session)
 	iamSvc := iam.NewFromConfig(*opts.Config)
+	stsSvc := sts.New(opts.Session)
 
 	params := &cloudformation.DescribeStacksInput{}
 	resources := make([]resource.Resource, 0)
@@ -63,6 +74,7 @@ func (l *CloudFormationStackLister) List(_ context.Context, o interface{}) ([]re
 		for _, stack := range resp.Stacks {
 			newResource := &CloudFormationStack{
 				svc:               svc,
+				stsSvc:            stsSvc,
 				iamSvc:            iamSvc,
 				logger:            opts.Logger,
 				maxDeleteAttempts: CloudformationMaxDeleteAttempt,
@@ -94,21 +106,24 @@ func (l *CloudFormationStackLister) List(_ context.Context, o interface{}) ([]re
 }
 
 type CloudFormationStack struct {
-	svc               cloudformationiface.CloudFormationAPI
-	iamSvc            *iam.Client
-	settings          *settings.Setting
-	logger            *logrus.Entry
-	Name              *string
-	Status            *string
-	CreationTime      *time.Time
-	LastUpdatedTime   *time.Time
-	Tags              []*cloudformation.Tag
-	description       *string
-	parentID          *string
-	roleARN           *string
-	maxDeleteAttempts int
-	roleCreated       bool
-	roleName          string
+	svc                cloudformationiface.CloudFormationAPI
+	stsSvc             stsiface.STSAPI
+	iamSvc             iamRoleAPI
+	settings           *settings.Setting
+	logger             *logrus.Entry
+	Name               *string
+	Status             *string
+	CreationTime       *time.Time
+	LastUpdatedTime    *time.Time
+	Tags               []*cloudformation.Tag
+	description        *string
+	parentID           *string
+	roleARN            *string
+	callerRoleARN      *string
+	callerRoleResolved bool
+	maxDeleteAttempts  int
+	roleCreated        bool
+	roleName           string
 }
 
 func (r *CloudFormationStack) Filter() error {
@@ -150,10 +165,14 @@ func (r *CloudFormationStack) createRole(ctx context.Context) error {
 		},
 	})
 
+	if err != nil {
+		return err
+	}
+
 	r.roleCreated = true
 	r.roleName = roleParts[len(roleParts)-1]
 
-	return err
+	return nil
 }
 
 func (r *CloudFormationStack) removeRole(ctx context.Context) error {
@@ -167,6 +186,69 @@ func (r *CloudFormationStack) removeRole(ctx context.Context) error {
 	return err
 }
 
+// resolveCallerRoleARN lazily resolves the caller's IAM role ARN from STS on first call.
+// This is only invoked when UseCurrentRoleToDeleteStack is enabled, avoiding unnecessary
+// STS API calls for users who don't use this setting.
+// Note: IAM roles with path prefixes (e.g. /my-path/MyRole) cannot be fully reconstructed
+// from the STS assumed-role ARN because STS omits the path component.
+func (r *CloudFormationStack) resolveCallerRoleARN() *string {
+	if r.callerRoleResolved {
+		return r.callerRoleARN
+	}
+	r.callerRoleResolved = true
+
+	identity, err := r.stsSvc.GetCallerIdentity(&sts.GetCallerIdentityInput{})
+	if err != nil {
+		r.logger.Warnf("CloudFormationStack stackName=%s failed to resolve caller role ARN: %s", *r.Name, err.Error())
+		return nil
+	}
+	if identity.Arn == nil {
+		r.logger.Warnf("CloudFormationStack stackName=%s GetCallerIdentity returned nil ARN", *r.Name)
+		return nil
+	}
+
+	// Convert assumed-role ARN (arn:<partition>:sts::<ACCT>:assumed-role/ROLE/SESSION)
+	// to role ARN (arn:<partition>:iam::<ACCT>:role/ROLE)
+	arnStr := *identity.Arn
+	if !strings.Contains(arnStr, ":assumed-role/") {
+		r.logger.Warnf("CloudFormationStack stackName=%s caller ARN is not an assumed-role ARN (%s), cannot resolve role ARN", *r.Name, arnStr)
+		return nil
+	}
+
+	parts := strings.Split(arnStr, ":")
+	if len(parts) < 6 {
+		r.logger.Warnf("CloudFormationStack stackName=%s caller ARN has unexpected format (%s)", *r.Name, arnStr)
+		return nil
+	}
+
+	partition := parts[1]
+	accountID := parts[4]
+	rolePart := strings.Split(parts[5], "/")
+	if len(rolePart) < 2 {
+		r.logger.Warnf("CloudFormationStack stackName=%s caller ARN resource segment has unexpected format (%s)", *r.Name, parts[5])
+		return nil
+	}
+
+	roleARN := fmt.Sprintf("arn:%s:iam::%s:role/%s", partition, accountID, rolePart[1])
+	r.callerRoleARN = &roleARN
+	return r.callerRoleARN
+}
+
+// applyRoleOverride sets the RoleARN on a DeleteStackInput if UseCurrentRoleToDeleteStack is enabled.
+func (r *CloudFormationStack) applyRoleOverride(input *cloudformation.DeleteStackInput) {
+	if !r.settings.GetBool("UseCurrentRoleToDeleteStack") {
+		return
+	}
+	callerRole := r.resolveCallerRoleARN()
+	if callerRole != nil {
+		r.logger.Infof("CloudFormationStack stackName=%s UseCurrentRoleToDeleteStack: overriding RoleARN with %s", *r.Name, *callerRole)
+		input.RoleARN = callerRole
+	} else {
+		r.logger.Warnf("CloudFormationStack stackName=%s UseCurrentRoleToDeleteStack enabled "+
+			"but callerRoleARN could not be resolved, falling back to default role behavior", *r.Name)
+	}
+}
+
 func (r *CloudFormationStack) removeWithAttempts(ctx context.Context, attempt int) error {
 	if err := r.doRemove(); err != nil {
 		r.logger.Errorf("CloudFormationStack stackName=%s attempt=%d maxAttempts=%d delete failed: %s",
@@ -270,7 +352,8 @@ func (r *CloudFormationStack) doRemove() error { //nolint:gocyclo
 			StackName: r.Name,
 		})
 	} else if *stack.StackStatus == cloudformation.StackStatusDeleteFailed {
-		r.logger.Infof("CloudFormationStack stackName=%s delete failed. Attempting to retain and delete stack", *r.Name)
+		r.logger.Infof("CloudFormationStack stackName=%s delete failed (reason=%s). Attempting to retain and delete stack",
+			*r.Name, ptr.ToString(stack.StackStatusReason))
 		// This means the CFS has undetectable resources.
 		// In order to move on with nuking, we retain them in the deletion.
 		retainableResources, err := r.svc.ListStackResources(&cloudformation.ListStackResourcesInput{
@@ -282,16 +365,22 @@ func (r *CloudFormationStack) doRemove() error { //nolint:gocyclo
 
 		retain := make([]*string, 0)
 
-		for _, r := range retainableResources.StackResourceSummaries {
-			if *r.ResourceStatus != cloudformation.ResourceStatusDeleteComplete {
-				retain = append(retain, r.LogicalResourceId)
+		for _, res := range retainableResources.StackResourceSummaries {
+			if *res.ResourceStatus != cloudformation.ResourceStatusDeleteComplete {
+				retain = append(retain, res.LogicalResourceId)
+				r.logger.Infof("CloudFormationStack stackName=%s retaining resource %s (type=%s, status=%s, reason=%s)",
+					*r.Name, ptr.ToString(res.LogicalResourceId), ptr.ToString(res.ResourceType),
+					ptr.ToString(res.ResourceStatus), ptr.ToString(res.ResourceStatusReason))
 			}
 		}
 
-		if _, err = r.svc.DeleteStack(&cloudformation.DeleteStackInput{
+		deleteInput := &cloudformation.DeleteStackInput{
 			StackName:       r.Name,
 			RetainResources: retain,
-		}); err != nil {
+		}
+		r.applyRoleOverride(deleteInput)
+
+		if _, err = r.svc.DeleteStack(deleteInput); err != nil {
 			return err
 		}
 
@@ -301,9 +390,14 @@ func (r *CloudFormationStack) doRemove() error { //nolint:gocyclo
 	} else {
 		if err := r.waitForStackToStabilize(*stack.StackStatus); err != nil {
 			return err
-		} else if _, err := r.svc.DeleteStack(&cloudformation.DeleteStackInput{
+		}
+
+		deleteInput := &cloudformation.DeleteStackInput{
 			StackName: r.Name,
-		}); err != nil {
+		}
+		r.applyRoleOverride(deleteInput)
+
+		if _, err := r.svc.DeleteStack(deleteInput); err != nil {
 			return err
 		} else if err := r.svc.WaitUntilStackDeleteComplete(&cloudformation.DescribeStacksInput{
 			StackName: r.Name,