Run AWS Nuke with Debug Mode

Oct 13, 2025 by wbrum.org 106 views

Introduction

AWS Nuke is a powerful tool for cleaning up AWS resources. However, sometimes it can stall or fail to delete resources. In this article, we will explore the possible causes of this issue and provide solutions to resolve it.

Symptoms

The symptoms of this issue include:

AWS Nuke stalls or fails to delete resources
CloudFormation indicates that the resource has dependencies and cannot be deleted
The security token has expired, causing AWS Nuke to fail

Causes

There are several possible causes of this issue:

Dependencies: AWS Nuke may fail to delete resources if they have dependencies that cannot be deleted. This can include resources such as subnets, security groups, and IAM roles.
Security Token Expiration: AWS Nuke uses a security token to authenticate with AWS. If the token expires, AWS Nuke will fail to delete resources.
Configuration Issues: AWS Nuke requires a specific configuration to function correctly. If the configuration is incorrect, AWS Nuke may stall or fail to delete resources.

Solutions

To resolve this issue, you can try the following solutions:

Check Dependencies: Check the dependencies of the resources that AWS Nuke is trying to delete. If there are dependencies that cannot be deleted, you may need to delete them manually before running AWS Nuke again.
Refresh Security Token: Refresh the security token used by AWS Nuke to ensure that it is valid.
Check Configuration: Check the configuration of AWS Nuke to ensure that it is correct. You can check the configuration file to ensure that it is properly formatted and that all required settings are included.
Run AWS Nuke with Debug Mode: Run AWS Nuke with debug mode enabled to get more detailed error messages and to help diagnose the issue.

Example Configuration

Here is an example configuration file for AWS Nuke:

# MARK: - Disable deletion protection on everything except for CloudFormation stacks
settings:
  EC2Image:
    IncludeDisabled: true
    IncludeDeprecated: true
    DisableDeregistrationProtection: true
  EC2Instance:
    DisableStopProtection: true
    DisableDeletionProtection: true
  RDSInstance:
    DisableDeletionProtection: true
  # Do not delete Cfn stacks with deletion protection enabled
  CloudFormationStack:
    DisableDeletionProtection: false
  DynamoDBTable:
    DisableDeletionProtection: true
  CognitoUserPool:
    DisableDeletionProtection: true
  # Do not include service linked roles in the deletion process
  IAMRole:
    IncludeServiceLinkedRoles: false

# MARK: - Exclude specific resources from being nuked
resource-types:
  excludes:
    # MARK: - Nuke recommended exclusions
    - S3Object # Excluded because S3 bucket removal handles removing all S3Objects
    - ServiceCatalogTagOption # Excluded due to https://github.com/rebuy-de/aws-nuke/issues/515
    - ServiceCatalogTagOptionPortfolioAttachment # Excluded due to https://github.com/rebuy-de/aws-nuke/issues/515
    - FMSNotificationChannel # Excluded because it's not available
    - FMSPolicy # Excluded because it's not available
    - MachineLearningMLModel # Excluded due to ML being unavailable
    - MachineLearningDataSource # Excluded due to ML being unavailable
    - MachineLearningBranchPrediction # Excluded due to ML being unavailable
    - MachineLearningEvaluation # Excluded due to ML being unavailable
    - RoboMakerDeploymentJob # Deprecated Service
    - RoboMakerFleet # Deprecated Service
    - RoboMakerRobot # Deprecated Service
    - RoboMakerSimulationJob
    - RoboMakerRobotApplication
    - RoboMakerSimulationApplication
    - OpsWorksApp # Deprecated service
    - OpsWorksInstance # Deprecated service
    - OpsWorksLayer # Deprecated service
    - OpsWorksUserProfile # Deprecated service
    - OpsWorksCMBackup # Deprecated service
    - OpsWorksCMServer # Deprecated service
    - OpsWorksCMServerState # Deprecated service
    - CodeStarProject # Deprecated service
    - CodeStarConnection # Deprecated service
    - CodeStarNotification # Deprecated service
    - Cloud9Environment # Deprecated service
    - CloudSearchDomain # Deprecated service
    - RedshiftServerlessSnapshot # Deprecated service
    - RedshiftServerlessNamespace # Deprecated service
    - RedshiftServerlessWorkgroup # Deprecated service

Conclusion

Q: What are the common causes of AWS Nuke stalling or failing to delete resources?

A: The common causes of AWS Nuke stalling or failing to delete resources include:

Dependencies: AWS Nuke may fail to delete resources if they have dependencies that cannot be deleted.
Security Token Expiration: AWS Nuke uses a security token to authenticate with AWS. If the token expires, AWS Nuke will fail to delete resources.
Configuration Issues: AWS Nuke requires a specific configuration to function correctly. If the configuration is incorrect, AWS Nuke may stall or fail to delete resources.

Q: How can I check dependencies of resources that AWS Nuke is trying to delete?

A: To check dependencies of resources that AWS Nuke is trying to delete, you can use the AWS Management Console or the AWS CLI. You can also use tools such as AWS CloudFormation or AWS Resource Groups to help identify dependencies.

Q: How can I refresh the security token used by AWS Nuke?

A: To refresh the security token used by AWS Nuke, you can use the AWS CLI command aws sts get-session-token to obtain a new security token. You can then update the AWS Nuke configuration file with the new security token.

Q: How can I check the configuration of AWS Nuke?

A: To check the configuration of AWS Nuke, you can review the AWS Nuke configuration file. You can also use tools such as AWS CloudFormation or AWS Resource Groups to help identify configuration issues.

Q: What are some common configuration issues that can cause AWS Nuke to stall or fail?

A: Some common configuration issues that can cause AWS Nuke to stall or fail include:

Incorrect AWS region or account ID
Missing or incorrect AWS credentials
Incorrect or missing AWS Nuke configuration settings
Conflicting or duplicate AWS Nuke configuration settings

Q: How can I run AWS Nuke with debug mode enabled?

A: To run AWS Nuke with debug mode enabled, you can add the --debug flag to the AWS Nuke command. This will enable debug logging and provide more detailed error messages.

Q: What are some best practices for using AWS Nuke to clean up AWS resources?

A: Some best practices for using AWS Nuke to clean up AWS resources include:

Regularly reviewing and updating AWS Nuke configuration settings
Using AWS Nuke with debug mode enabled to identify and resolve issues
Checking dependencies and security token expiration before running AWS Nuke
Using AWS CloudFormation or AWS Resource Groups to help identify and resolve configuration issues

Q: Can I use AWS Nuke to delete resources that are not listed in the AWS Nuke configuration file?

A: Yes, you can use AWS Nuke to delete resources that are not listed in the AWS Nuke configuration file. However, you will need to add the resource type to the resource-types section of the AWS Nuke configuration file.

Q: How can I customize the AWS Nuke configuration file to meet my specific needs?

A: You can customize the AWS Nuke configuration file by adding or modifying settings in the settings and resource-types sections. You can also use AWS CloudFormation or AWS Resource Groups to help identify and resolve configuration issues.

Q: What are some common issues that can occur when using AWS Nuke to delete resources?

A: Some common issues that can occur when using AWS Nuke to delete resources include:

Dependencies: AWS Nuke may fail to delete resources if they have dependencies that cannot be deleted.
Security Token Expiration: AWS Nuke uses a security token to authenticate with AWS. If the token expires, AWS Nuke will fail to delete resources.
Configuration Issues: AWS Nuke requires a specific configuration to function correctly. If the configuration is incorrect, AWS Nuke may stall or fail to delete resources.

Q: How can I troubleshoot issues with AWS Nuke?

A: To troubleshoot issues with AWS Nuke, you can use the AWS Management Console or the AWS CLI to review logs and error messages. You can also use tools such as AWS CloudFormation or AWS Resource Groups to help identify and resolve configuration issues.