diff --git a/pkg/config/config.go b/pkg/config/config.go index d87a1e8bb..c9a84c3f4 100644 --- a/pkg/config/config.go +++ b/pkg/config/config.go @@ -48,6 +48,7 @@ type DisableDeletionProtection struct { CloudformationStack bool `yaml:"CloudformationStack"` ELBv2 bool `yaml:"ELBv2"` QLDBLedger bool `yaml:"QLDBLedger"` + CognitoUserPool bool `yaml:"CognitoUserPool"` } type PresetDefinitions struct { diff --git a/resources/cognito-userpools.go b/resources/cognito-userpools.go index c1a5f8190..c6f6b3078 100644 --- a/resources/cognito-userpools.go +++ b/resources/cognito-userpools.go @@ -1,15 +1,20 @@ package resources import ( + "strings" + "github.com/aws/aws-sdk-go/aws" + "github.com/aws/aws-sdk-go/aws/awserr" "github.com/aws/aws-sdk-go/aws/session" "github.com/aws/aws-sdk-go/service/cognitoidentityprovider" + "github.com/rebuy-de/aws-nuke/v2/pkg/config" ) type CognitoUserPool struct { - svc *cognitoidentityprovider.CognitoIdentityProvider - name *string - id *string + svc *cognitoidentityprovider.CognitoIdentityProvider + name *string + id *string + featureFlags config.FeatureFlags } func init() { @@ -48,12 +53,47 @@ func ListCognitoUserPools(sess *session.Session) ([]Resource, error) { return resources, nil } -func (f *CognitoUserPool) Remove() error { +func (l *CognitoUserPool) FeatureFlags(ff config.FeatureFlags) { + l.featureFlags = ff +} +func (f *CognitoUserPool) Remove() error { _, err := f.svc.DeleteUserPool(&cognitoidentityprovider.DeleteUserPoolInput{ UserPoolId: f.id, }) + if err != nil { + awsErr, ok := err.(awserr.Error) + if ok && strings.Contains(awsErr.Message(), "Deletion protection must be inactivated first") && f.featureFlags.DisableDeletionProtection.CognitoUserPool { + err = f.DisableProtection() + if err != nil { + return err + } + _, err = f.svc.DeleteUserPool(&cognitoidentityprovider.DeleteUserPoolInput{ + UserPoolId: f.id, + }) + if err != nil { + return err + } + return nil + } + } + return err +} +func (e *CognitoUserPool) DisableProtection() error { + userPoolOutput, err := e.svc.DescribeUserPool(&cognitoidentityprovider.DescribeUserPoolInput{ + UserPoolId: e.id, + }) + if err != nil { + return err + } + userPool := userPoolOutput.UserPool + params := &cognitoidentityprovider.UpdateUserPoolInput{ + DeletionProtection: aws.String(cognitoidentityprovider.DeletionProtectionTypeInactive), + UserPoolId: e.id, + AutoVerifiedAttributes: userPool.AutoVerifiedAttributes, + } + _, err = e.svc.UpdateUserPool(params) return err }