Cloud Nuke — Wipe AWS Resources with a Single Command

What it is

Cloud Nuke is a CLI tool from Gruntwork that deletes AWS resources across all regions in a single command. It supports EC2 instances, S3 buckets, Lambda functions, IAM roles, VPCs, RDS databases, and dozens of other resource types. You can filter by resource type, region, age, and tags.

Cloud Nuke targets DevOps engineers and platform teams who manage sandbox, development, and testing AWS accounts. It solves the problem of resource sprawl where forgotten resources accumulate and generate unexpected cloud bills.

How it saves time or tokens

Manually deleting AWS resources through the console requires clicking through each service in each region. Cloud Nuke automates this across all regions and resource types in seconds. For organizations with multiple sandbox accounts, running Cloud Nuke on a schedule prevents cost surprises from forgotten resources.

How to use

1. Install Cloud Nuke via Homebrew or download the binary.
2. Configure AWS credentials.
3. Run the nuke command with appropriate filters.

# Install
brew install cloud-nuke

# Delete ALL resources in an account (dangerous)
cloud-nuke aws

# Delete resources older than 24 hours
cloud-nuke aws --older-than 24h

# Delete only specific resource types
cloud-nuke aws --resource-type ec2 --resource-type s3

# Delete resources in specific regions only
cloud-nuke aws --region us-east-1 --region eu-west-1

# Dry run (list what would be deleted)
cloud-nuke aws --dry-run

Example

# cloud-nuke config file for targeted cleanup
# .cloud-nuke.yml
ec2:
  include:
    names_regex:
      - 'dev-.*'
      - 'test-.*'
  exclude:
    names_regex:
      - 'prod-.*'

s3:
  include:
    names_regex:
      - '.*-sandbox-.*'

Related on TokRepo

• DevOps tools — Infrastructure management and automation tools
• Automation tools — Scheduled cleanup and maintenance automation

Common pitfalls

• Cloud Nuke deletes resources permanently. There is no undo. Always use --dry-run first and restrict to sandbox accounts. Never run against production AWS accounts.
• Some resources have deletion dependencies (e.g., VPCs cannot be deleted while ENIs are attached). Cloud Nuke handles most dependencies but may fail on complex resource graphs.
• IAM resource deletion can break other accounts if the IAM roles are used cross-account. Exclude IAM resources unless you are certain they are scoped to the target account.