Best Practice to Remove Resources?

[dukarc]

Hi Folks,

We did our first test last week for the SDLC... with a simple instance creation/deletion attempt. Here was our assumption

ASSUMPTION:
Given A PR Is created with the code of an EC2 Instance
And the PR is merged with the auto apply label
When I revert that PR
Then GHA must delete the ec2 instance

REALITY:
When we revert the PR .. there is no cleanup of the instance that was deployed

QUESTION:
What is the best practice for cleaning things up that have been removed from IAC?

[milldr]

That behavior is expected — deleting code or reverting a PR doesn’t affect the Terraform state, so resources won’t be destroyed unless explicitly handled. Destroying resources can be risky and non-trivial, so it’s best to make the process intentional and traceable.

The recommended approach is to use the enabled variable built into all Cloud Posse modules and components. By setting enabled: false for a given component in a PR, you tell Terraform to remove all resources from state and therefore destroy all associated resources on the next apply. This provides an auditable way to deprovision infrastructure that we can trace through pull requests. Keep in mind, however, that this method doesn’t account for dependencies or enforce a specific destroy order, so some coordination may still be required.

Please see this tutorial for deleting components with Spacelift — many of the same concepts apply, even if you’re not using Spacelift:
https://docs.cloudposse.com/layers/spacelift/tutorials/how-to-destroy-a-component-using-atmos-or-spacelift

Alternatively, we have some customers that have created workflows specifically to orchestrate deployment and cleanup of developer environments. This is a more advanced pattern that's specific to the use case — happy to discuss further if that’s something you’re interested in exploring.

Finally for broader cleanup, tools like aws-nuke or cloud-nuke can be used to tear down entire environments. We use this in our testing sandbox accounts.

[osterman]

Also, this is a feature request from one of our enterprise customers—we’re currently waiting on approvals. 🤞

Deletion workflows should be available this quarter. The implementation is straightforward: we need a minor update to atmos describe affected so it returns deleted components between two commits, and then we’ll modify the GitHub Actions to pass the -destroy flag to atmos terraform plan.

In other words, we know how to do it—we’re just waiting on a customer to sponsor the development.