import boto3

client = boto3.client('organizations')

# 異なるAWSアカウント/ロールのクレデンシャル取得を実行する
def sts_assume_role(account_id):
    role_arn = "arn:aws:iam::%s:role/AWSControlTowerExecution" % account_id
    session_name = "create-alias"

    client = boto3.client('sts')

    # AssumeRoleで一時クレデンシャルを取得
    response = client.assume_role(
        RoleArn=role_arn,
        RoleSessionName=session_name
    )
    
    iam_client = boto3.client(
        'iam',
        aws_access_key_id=response['Credentials']['AccessKeyId'],
        aws_secret_access_key=response['Credentials']['SecretAccessKey'],
        aws_session_token=response['Credentials']['SessionToken'],
    )


    return iam_client
 
# アカウントのエイリアスを取得する   
def get_account_aliases(account_id):
    iam = sts_assume_role(account_id)

    res = []
    # List account aliases through the pagination interface
    paginator = iam.get_paginator('list_account_aliases')
    for response in paginator.paginate():
        res = response["AccountAliases"]
    return res
    

# エイリアスが存在するアカウントIDのリストを取得する
def get_account_ids():
    # 全組織のアカウント情報を取得する
    pagenator = client.get_paginator('list_accounts')
    response_iterator = pagenator.paginate()
    
    row_value = []
    for response in response_iterator:
        for acct in response['Accounts']:
            # 取得するアカウント情報のリスト化
            row_value.append(acct['Id'])
    
    res = ""
    # アカウントIDのリストを空白区切りの文字列にする
    for index,value in enumerate(row_value):
        # 先頭の要素はスキップする
        if index == 0:
            res = value
            continue
        res = res + " " + value

    return res

def lambda_handler(event, context):
    account_list = get_account_ids()
    return {"accounts": account_list}

regions:
  # add `global` here to include IAM entities to be nuked
  # nukeでリソースを削除する対象のリージョンをリストアップします
  - ap-northeast-1 
  - us-east-1

account-blocklist:
  - 123456789012 # 削除対象から外すアカウントをリストアップします

# optional: restrict nuking to these resources
resource-types:
  excludes: # 削除の対象外とするリソースをリストアップします
    - IAMUser
    - IAMUserPolicyAttachment
    - IAMUserAccessKey
    - IAMLoginProfile
    - IAMGroup
    - IAMRolePolicy
    - IAMRolePolicyAttachment
    - IAMPolicy
    - IAMSAMLProvider
    - CloudTrailTrail
    - SNSTopic
    - LambdaFunction
    - CloudFormationStack
    - Budget

  targets: # 削除対象とするサービスをリストアップします
    - S3Bucket
    - S3Object
    - SQSQueue
    - RDSInstance
    - EC2Instance
    - EC2Image
    - EC2NATGateway
    - DynamoDBTableItem
    - DynamoDBTable

accounts:
  ACCOUNT: # ACCOUNTという文字列は後ほどCodeBuild内で実際のアカウントIDに書き換えられます
    filters: # 特定のタグがついたリソースを削除対象外にできます
      EC2Instance:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      S3Bucket:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      S3Object:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      SQSQueue:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      RDSInstance:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      EC2Image:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      EC2InternetGateway:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      EC2NATGateway:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      DynamoDBTableItem:
      - type: exact
        property: tag:DoNotNuke
        value: "true"
      DynamoDBTable:
      - type: exact
        property: tag:DoNotNuke
        value: "true"

feature-flags:
  disable-deletion-protection:
    RDSInstance: true
    EC2Instance: true

Parameters:
  AWSNukeDryRunFlag:
    Description: The dry run flag to run for the aws-nuke. By default it is set to True which will not delete any resources.
    Type: String
    Default: "true"
  AWSNukeVersion:
    Description:
      The aws-nuke latest version to be used from internal artifactory/S3. Make sure to check the latest releases
      and any resource additions added. As you update the version, you will have to handle filtering any new resources that gets
      updated with that new version.
    Type: String
    Default: 2.21.2
  AccountId:
    Description: The AWS account ID
    Type: String
  

Resources:
  NukeCodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: NO_ARTIFACTS
      BadgeEnabled: false
      Description: Builds a container to run AWS-Nuke for all accounts within the specified account/regions
      Environment:
        ComputeType: BUILD_GENERAL1_2XLARGE
        Image: aws/codebuild/docker:18.09.0
        ImagePullCredentialsType: CODEBUILD
        PrivilegedMode: true
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: AWS_NukeDryRun
            Type: PLAINTEXT
            Value: !Ref AWSNukeDryRunFlag
          - Name: AWS_NukeVersion
            Type: PLAINTEXT
            Value: !Ref AWSNukeVersion
          - Name: AccountId
            Type: PLAINTEXT
            Value: !Ref AccountId
          - Name: NukeCodeBuildProjectName
            Type: PLAINTEXT
            Value: !Sub "AccountNuker-codeBuild"
      LogsConfig:
        CloudWatchLogs:
          GroupName: !Sub "AccountNuker-logs"
          Status: ENABLED
      Name: !Sub "AccountNuker-${AWS::StackName}"
      ServiceRole: arn:aws:iam::<管理アカウントのアカウントID>:role/CodeBuildExecNukeRole
      TimeoutInMinutes: 120
      Source:
        BuildSpec: |
          version: 0.2
          phases:
            pre_build:
              commands:
                  - export AWS_NUKE_VERSION=$AWS_NukeVersion
                  - apt-get install -y wget
                  - apt-get install jq
                  - wget https://github.com/rebuy-de/aws-nuke/releases/download/v$AWS_NUKE_VERSION/aws-nuke-v$AWS_NUKE_VERSION-linux-amd64.tar.gz --no-check-certificate
                  - tar xvf aws-nuke-v$AWS_NUKE_VERSION-linux-amd64.tar.gz
                  - chmod +x aws-nuke-v$AWS_NUKE_VERSION-linux-amd64
                  - mv aws-nuke-v$AWS_NUKE_VERSION-linux-amd64 /usr/local/bin/aws-nuke
                  - aws-nuke version
                  - echo "Setting aws cli profile with config file for role assumption using metadata"
                  - aws configure set profile.nuke.credential_source "EcsContainer"
                  - export AWS_PROFILE=nuke
                  - export AWS_DEFAULT_PROFILE=nuke
                  - export AWS_SDK_LOAD_CONFIG=1
            build:
              commands:
                  - echo "Getting nuke generic config file from S3";
                  - aws s3 cp s3://<設定ファイル用のバケット名>/nuke_config.yaml .
                  - echo "Configured nuke_config.yaml";
                  - echo " ------------------------------------------------ " >> error_log.txt
                  - echo "Running Nuke on Account";
                  - |
                    for i in $AccountId;
                      do
                        aws configure set profile.nuke.role_arn arn:aws:iam::$i:role/AWSControlTowerExecution
                        touch nuke_config_$i.yaml
                        cp nuke_config.yaml nuke_config_$i.yaml
                        sed -i "s/ACCOUNT/$i/g" nuke_config_$i.yaml
                        log_file=aws-nuke-$(date +%Y%m%d%I%M%S).log
                        if [ "$AWS_NukeDryRun" = "true" ]; then
                          aws-nuke -c nuke_config_$i.yaml --quiet --force --profile nuke 2>&1 |tee -a $log_file;
                        elif [ "$AWS_NukeDryRun" = "false" ]; then
                          aws-nuke -c nuke_config_$i.yaml --quiet --force --no-dry-run --profile nuke 2>&1 |tee -a $log_file;
                        else
                          echo "Couldn't determine Dryrun flag...exiting"
                          exit 1
                        fi;
                        aws s3 cp $log_file s3://<ログ用のバケット名>/$i/
                        nuke_pid=$!;
                        wait $nuke_pid;
                        echo "Checking if Nuke Process completed for account"
                        if cat $log_file | grep -F "Error:"; then
                          echo "Nuke errored due to no AWS account alias set up - exiting"
                          cat $log_file >> error_log.txt
                          aws s3 cp error_log.txt s3://<ログ用のバケット名>/$i/error/
                          exit 1
                        else
                          echo "Nuke completed Successfully - Continuing"
                        fi
                      done

        Type: NO_SOURCE

{
  "Comment": "AWS Nuke Account Cleanser",
  "StartAt": "GetAccountIds",
  "States": {
    "GetAccountIds": {
      "Type": "Task",
      "Resource": "arn:aws:states:::lambda:invoke",
      "Parameters": {
        "FunctionName": "<アカウントID取得Lambdaの関数名>"
      },
      "ResultPath": "$.accountList",
      "Next": "NukeCodeBuildJob"
    },
    "NukeCodeBuildJob": {
      "Type": "Task",
      "Resource": "arn:aws:states:::codebuild:startBuild.sync",
      "Parameters": {
        "ProjectName": "<CodeBuildプロジェクトのARN>",
        "EnvironmentVariablesOverride": [
          {
            "Name": "AccountId",
            "Type": "PLAINTEXT",
            "Value.$": "$.accountList.Payload.accounts"
          },
          {
            "Name": "AWS_NukeDryRun",
            "Type": "PLAINTEXT",
            "Value.$": "$.InputPayLoad.nuke_dry_run"
          },
          {
            "Name": "AWS_NukeVersion",
            "Type": "PLAINTEXT",
            "Value.$": "$.InputPayLoad.nuke_version"
          }
        ]
      },
      "Next": "NukeStatusCheck",
      "ResultSelector": {
        "NukeBuildOutput.$": "$.Build"
      },
      "ResultPath": "$.AccountCleanserRegionOutput",
      "Retry": [
        {
          "ErrorEquals": [
            "States.TaskFailed"
          ],
          "BackoffRate": 1,
          "IntervalSeconds": 1,
          "MaxAttempts": 0
        }
      ],
      "Catch": [
        {
          "ErrorEquals": [
            "States.ALL"
          ],
          "Next": "NukeFailed",
          "ResultPath": "$.AccountCleanserRegionOutput"
        }
      ]
    },
    "NukeStatusCheck":{
      "Type": "Choice",
      "Choices": [
        {
          "Variable": "$.AccountCleanserRegionOutput.NukeBuildOutput.BuildStatus",
          "StringEquals": "SUCCEEDED",
          "Next": "NukeSuccess"
        },
        {
          "Variable": "$.AccountCleanserRegionOutput.NukeBuildOutput.BuildStatus",
          "StringEquals": "FAILED",
          "Next": "NukeFailed"
        }
      ],
      "Default": "NukeSuccess"
    },
    "NukeSuccess":{
      "Type": "Succeed",
    },
    "NukeFailed":{
      "Type": "Fail",
      "Cause": "nukeの実行に失敗しました。",
    }
  }
}