diff --git a/astronomer/providers/amazon/aws/example_dags/example_aws_nuke.py b/astronomer/providers/amazon/aws/example_dags/example_aws_nuke.py index eb6950f54..2411d52f5 100644 --- a/astronomer/providers/amazon/aws/example_dags/example_aws_nuke.py +++ b/astronomer/providers/amazon/aws/example_dags/example_aws_nuke.py @@ -140,6 +140,15 @@ def check_dag_status(**kwargs: Any) -> None: f"sh $AIRFLOW_HOME/dags/example_delete_eks_cluster_and_nodes.sh {REGRESSION_CLUSTER_AWS_DEFAULT_REGION}", ) + terminate_oidc_providers = BashOperator( + task_id="terminate_oidc_providers", + bash_command=f"set -e; " + f"aws configure set aws_access_key_id {AWS_ACCESS_KEY_ID}; " + f"aws configure set aws_secret_access_key {AWS_SECRET_ACCESS_KEY}; " + f"aws configure set default.region {AWS_DEFAULT_REGION}; " + f"sh $AIRFLOW_HOME/dags/example_delete_oidc.sh", + ) + execute_aws_nuke = BashOperator( task_id="execute_aws_nuke", bash_command=f"aws configure set aws_access_key_id {AWS_ACCESS_KEY_ID}; " @@ -179,6 +188,7 @@ def check_dag_status(**kwargs: Any) -> None: >> [get_airflow_version, get_airflow_executor] >> terminate_running_emr_virtual_clusters >> terminate_dag_authoring_regression_clusters + >> terminate_oidc_providers >> execute_aws_nuke >> delete_stale_emr_vpcs >> delete_stale_emr_iam_roles diff --git a/astronomer/providers/amazon/aws/example_dags/example_delete_oidc.sh b/astronomer/providers/amazon/aws/example_dags/example_delete_oidc.sh new file mode 100755 index 000000000..6c17370a9 --- /dev/null +++ b/astronomer/providers/amazon/aws/example_dags/example_delete_oidc.sh @@ -0,0 +1,17 @@ +#!/bin/bash + +# List all OIDC providers +oidc_providers=$(aws iam list-open-id-connect-providers --output json | jq -r '.OpenIDConnectProviderList[].Arn') + +# Loop through each OIDC provider +for oidc_provider in $oidc_providers +do + # Check if the provider name contains "DO_NOT_DELETE" + if [[ $oidc_provider == *"DO_NOT_DELETE"* ]]; then + echo "Skipping deletion of OIDC provider: $oidc_provider" + else + # Delete the OIDC provider + aws iam delete-open-id-connect-provider --open-id-connect-provider-arn "$oidc_provider" + echo "Deleted OIDC provider: $oidc_provider" + fi +done