5113 dce wafv2 nuke

.gitignore

@@ -2,4 +2,4 @@
 /aws-nuke
 /aws-nuke-*
 /dist
-/releases
+/releases

go.mod

@@ -28,6 +28,8 @@ require (
 	gopkg.in/yaml.v3 v3.0.1
 )
 
+require github.com/kr/pretty v0.3.1 // indirect
+
 require (
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.8 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.15 // indirect
@@ -41,13 +43,12 @@ require (
 	github.com/gemnasium/logrus-graylog-hook/v3 v3.1.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
-	github.com/kr/text v0.2.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	golang.org/x/mod v0.11.0 // indirect
-	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/sys v0.23.0 // indirect
 	golang.org/x/tools v0.7.0 // indirect
 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 )

go.sum

@@ -56,8 +56,9 @@ github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHW
 github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
 github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
@@ -69,13 +70,16 @@ github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWE
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mb0/glob v0.0.0-20160210091149-1eb79d2de6c4 h1:NK3O7S5FRD/wj7ORQ5C3Mx1STpyEMuFe+/F0Lakd1Nk=
 github.com/mb0/glob v0.0.0-20160210091149-1eb79d2de6c4/go.mod h1:FqD3ES5hx6zpzDainDaHgkTIqrPaI9uX4CVWqYZoQjY=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rebuy-de/rebuy-go-sdk/v4 v4.5.1 h1:7QWjC0uku9pIqTXS664clCMjqhZLjO/sUV7yTJJwzAk=
 github.com/rebuy-de/rebuy-go-sdk/v4 v4.5.1/go.mod h1:ZSfnIcE8RFKz7IO6AFZjETDbPyMdUjtxCea9R7Q6pQE=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sirupsen/logrus v1.3.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
@@ -103,8 +107,8 @@ golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
-golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.23.0 h1:YfKFowiIMvtgl1UERQoTPPToxltDeZfbj4H7dVUCwmM=
+golang.org/x/sys v0.23.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.7.0 h1:W4OVu8VVOaIO0yzWMNdepAulS7YfoS3Zabrm8DOXXU4=

resources/wafv2-webacls.go

@@ -3,6 +3,7 @@ package resources
 import (
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/session"
+	"github.com/aws/aws-sdk-go/service/cloudfront"
 	"github.com/aws/aws-sdk-go/service/wafv2"
 	"github.com/rebuy-de/aws-nuke/v2/pkg/types"
 )
@@ -77,14 +78,108 @@ func getWebACLs(svc *wafv2.WAFV2, params *wafv2.ListWebACLsInput) ([]Resource, e
 	return resources, nil
 }
 
+// List cloudfront distributions associated with the cloudfront   WebACL
+func (f *WAFv2WebACL) ListAssociatedCloudfrontDistributions() ([]*string, error) {
+	sess := session.Must(session.NewSession())
+	cf := cloudfront.New(sess)
+	params := &cloudfront.ListDistributionsByWebACLIdInput{
+		WebACLId: f.ID,
+	}
+
+	var distributions []*string
+	for {
+
+		resp, err := cf.ListDistributionsByWebACLId(params)
+		if err != nil {
+			return nil, err
+		}
+
+		for _, distribution := range resp.DistributionList.Items {
+			if *distribution.WebACLId == *f.ID {
+				distributions = append(distributions, distribution.Id)
+			}
+		}
+
+		if resp.DistributionList.NextMarker == nil {
+			break
+		}
+
+		params.Marker = resp.DistributionList.NextMarker
+	}
+	return distributions, nil
+}
+
+func (f *WAFv2WebACL) RemoveAssociatedCloudfrontDistributions() error {
+
+	distributions, err := f.ListAssociatedCloudfrontDistributions()
+	if err != nil {
+		return err
+	}
+
+	cf := cloudfront.New(session.Must(session.NewSession()))
+	for _, distribution := range distributions {
+		_, err := cf.UpdateDistribution(&cloudfront.UpdateDistributionInput{
+			Id: distribution,
+			DistributionConfig: &cloudfront.DistributionConfig{
+				WebACLId: f.ID,
+			},
+			IfMatch: nil,
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	for _, distribution := range distributions {
+		_, err := f.svc.DisassociateWebACL(&wafv2.DisassociateWebACLInput{
+			ResourceArn: distribution,
+		})
+		if err != nil {
+			return err
+		}
+
+	}
+	return nil
+}
+
+func (f *WAFv2WebACL) RemoveAssociatedResources() error {
+	err := f.RemoveAssociatedCloudfrontDistributions()
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func UpdateDistribution(svc *cloudfront.CloudFront, distributionID *string, webACLID *string) error {
+	_, err := svc.UpdateDistribution(&cloudfront.UpdateDistributionInput{
+		Id: distributionID,
+		DistributionConfig: &cloudfront.DistributionConfig{
+			WebACLId: webACLID,
+		},
+		IfMatch: nil,
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
 func (f *WAFv2WebACL) Remove() error {
-	_, err := f.svc.DeleteWebACL(&wafv2.DeleteWebACLInput{
+	err := f.RemoveAssociatedResources()
+	if err != nil {
+		return err
+	}
+	err = UpdateDistribution(cloudfront.New(session.Must(session.NewSession())), f.ID, nil)
+
+	_, err = f.svc.DeleteWebACL(&wafv2.DeleteWebACLInput{
 		Id:        f.ID,
 		Name:      f.name,
 		Scope:     f.scope,
 		LockToken: f.lockToken,
 	})
-
+	if err != nil {
+		return err
+	}
 	return err
 }