Optum · bjfish25 · Dec 10, 2024 · Dec 10, 2024 · Dec 10, 2024 · Dec 12, 2024
diff --git a/Makefile b/Makefile
@@ -7,11 +7,14 @@ docs-serve:
 docs-seed:
 	cp README.md docs/index.md
 
+build:
+	go build -ldflags '-s -w -extldflags="-static"' -o bin/aws-nuke main.go
+
 generate:
 	go generate ./...
 
 test:
 	go test ./...
 
 test-integration:
-	go test ./... -tags=integration
+	go test ./... -tags=integration
diff --git a/docs/features/name-expansion.md b/docs/features/name-expansion.md
@@ -0,0 +1,51 @@
+# Name Expansion
+
+This allows you to use wildcards in the resource names to match multiple resources. This is primarily useful when you
+want to target a group of resource type for either inclusion or exclusion. 
+
+Resource Name expansion is valid for use in the following areas:
+
+!!! warning
+This feature is currently **NOT** supported in filters.
+
+- cli includes/excludes
+- config resource types includes/excludes
+- account resource types includes/excludes
+
+## Examples
+
+### CLI
+
+```console
+aws-nuke run --config config.yaml --include "Cognito*"
+```
+
+This can also be used with `resource-types` subcommand to see what resource types are available, and you can specify
+multiple wildcard arguments.
+
+```console
+aws-nuke resource-types "Cognito*" "IAM*"
+```
+
+### Config
+
+```yaml
+resource-types:
+  includes:
+    - "Cognito*"
+  excludes:
+    - "OpsWorks*"
+```
+
+### Account Config
+
+```yaml
+accounts:
+  '012345678912':
+    resource-types:
+      includes:
+        - "Cognito*"
+      excludes:
+        - "OpsWorks*"
+```
+
diff --git a/docs/features/overview.md b/docs/features/overview.md
@@ -6,6 +6,8 @@ Some of the new features include:
 - [Run Against All Enabled Regions](enabled-regions.md)
 - [Bypass Alias Check - Allow the skip of an alias on an account](bypass-alias-check.md)
 - [Signed Binaries](signed-binaries.md)
+- [Filter Groups (Experimental)](filter-groups.md)
+- [Name Expansion](name-expansion.md)
 
 Additionally, there are a few new sub commands to the tool to help with setup and debugging purposes:
 

diff --git a/docs/index.md b/docs/index.md
@@ -18,6 +18,7 @@ This is not a comprehensive list, but here are some of the highlights:
 * New Feature: [Run Against All Enabled Regions](features/enabled-regions.md)
 * New Feature: [Bypass Alias Check - Allow the skip of an alias on an account](features/bypass-alias-check.md)
 * New Feature: [Filter Groups (Experimental)](features/filter-groups.md)
+* New Feature: [Name Expansion](features/name-expansion.md)
 * Breaking Change: `root` command no longer triggers the run, must use subcommand `run` (alias: `nuke`)
 * Completely rewrote the core of the tool as a dedicated library [libnuke](https://github.com/ekristen/libnuke)
   * This library has over 95% test coverage which makes iteration and new features easier to implement.

diff --git a/docs/installation.md b/docs/installation.md
@@ -3,7 +3,7 @@
 Preferred installation order is the following:
 
 1. [GitHub Release](#github-releases-preferred)
-2. [ekristen's homebrew tap](#ekristens-homebrew-tap-macoslinux)
+2. [Homebrew Tap](#ekristens-homebrew-tap-macoslinux)
 3. [Homebrew Core](#homebrew-core-macoslinux)
 
 Docker images are also available via the GitHub Container Registry.
@@ -13,18 +13,24 @@ Docker images are also available via the GitHub Container Registry.
 !!! success - "Recommended"
     This supports all operating systems and most architectures.
 
-You can download pre-compiled binaries from the [releases](https://github.com/ekristen/aws-nuke/releases) page.
+You can download pre-compiled binaries from the [releases](https://github.com/ekristen/aws-nuke/releases) page, or you can use my tool
+[distillery](https://github.com/ekristen/distillery) to download and install the latest version.
 
-## ekristen's Homebrew Tap (MacOS/Linux)
+```console
+dist install ekristen/aws-nuke
+```
+
+## Homebrew Tap (macOS)
 
 !!! info
-    I control this tap, and it sources the binaries directly from the GitHub releases. However, it only supports MacOS.
+    I control this tap, and it sources the binaries directly from the GitHub releases. However, it only supports MacOS
+    and it tends to lag a bit behind.
 
 ```console
 brew install ekristen/tap/aws-nuke
 ```
 
-## Homebrew Core (MacOS/Linux)
+## Homebrew Core (macOS/Linux)
 
 !!! note
     I do not control the Homebrew Core formula, so it may not be up to date. Additionally, it is not compiled with
@@ -50,3 +56,18 @@ To compile **aws-nuke** from source you need a working [Golang](https://golang.o
 goreleaser build --clean --snapshot --single-target
 ```
 
+## Verifying Binaries
+
+All the binaries are signed with [cosign](https://github.com/sigstore/cosign) and are signed with keyless signatures.
+You can verify the build using the public transparency log and the cosign binary.
+
+**Note:** swap out `VERSION` with `vX.Y.Z`.
+
+```console
+cosign verify-blob \
+  --signature https://github.com/ekristen/aws-nuke/releases/download/VERSION/checksums.txt.sig \
+  --certificate https://github.com/ekristen/aws-nuke/releases/download/VERSION/checksums.txt.pem \
+  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+  --certificate-identity "https://github.com/ekristen/aws-nuke/.github/workflows/goreleaser.yml@refs/tags/VERSION" \
+  https://github.com/ekristen/aws-nuke/releases/download/VERSION/checksums.txt
+```
diff --git a/docs/resources/cloud-formation-stack.md b/docs/resources/cloud-formation-stack.md
@@ -11,8 +11,16 @@ generated: true
 CloudFormationStack
 ```
 
+## Properties
 
 
+- `CreationTime`: No Description
+- `LastUpdatedTime`: No Description
+- `Name`: No Description
+- `Status`: No Description
+- `tag:<key>:`: This resource has tags with property `Tags`. These are key/value pairs that are
+	added as their own property with the prefix of `tag:` (e.g. [tag:example: "value"]) 
+
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property
     names to write filters for what you want to **keep** and omit from the nuke process.
@@ -28,6 +36,7 @@ The string value is always what is used in the output of the log format when a r
 ## Settings
 
 - `DisableDeletionProtection`
+- `CreateRoleToDeleteStack`
 
 
 ### DisableDeletionProtection
@@ -40,3 +49,14 @@ The string value is always what is used in the output of the log format when a r
 DisableDeletionProtection
 ```
 
+
+### CreateRoleToDeleteStack
+
+!!! note
+    There is currently no description for this setting. Often times settings are fairly self-explanatory. However, we
+    are working on adding descriptions for all settings.
+
+```text
+CreateRoleToDeleteStack
+```
+
diff --git a/docs/resources/cloud-watch-alarm.md b/docs/resources/cloud-watch-alarm.md
@@ -11,8 +11,14 @@ generated: true
 CloudWatchAlarm
 ```
 
+## Properties
 
 
+- `Name`: No Description
+- `Type`: No Description
+- `tag:<key>:`: This resource has tags with property `Tags`. These are key/value pairs that are
+	added as their own property with the prefix of `tag:` (e.g. [tag:example: "value"]) 
+
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property
     names to write filters for what you want to **keep** and omit from the nuke process.

diff --git a/docs/resources/cloud-watch-events-target.md b/docs/resources/cloud-watch-events-target.md
@@ -11,8 +11,13 @@ generated: true
 CloudWatchEventsTarget
 ```
 
+## Properties
 
 
+- `BusName`: The name of the event bus the rule applies to
+- `Name`: The name of the rule
+- `TargetID`: The ID of the target for the rule
+
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property
     names to write filters for what you want to **keep** and omit from the nuke process.

diff --git a/docs/resources/cloud-watch-logs-log-group.md b/docs/resources/cloud-watch-logs-log-group.md
@@ -11,8 +11,17 @@ generated: true
 CloudWatchLogsLogGroup
 ```
 
+## Properties
 
 
+- `CreatedTime`: The creation time of the log group in unix timestamp format
+- `CreationTime`: The creation time of the log group in RFC3339 format
+- `LastEvent`: The last event time of the log group in RFC3339 format
+- `Name`: The name of the log group
+- `RetentionInDays`: The number of days to retain log events in the log group
+- `tag:<key>:`: This resource has tags with property `Tags`. These are key/value pairs that are
+	added as their own property with the prefix of `tag:` (e.g. [tag:example: "value"]) 
+
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property
     names to write filters for what you want to **keep** and omit from the nuke process.

diff --git a/docs/resources/ec2-tgw.md b/docs/resources/ec2-tgw.md
@@ -11,8 +11,15 @@ generated: true
 EC2TGW
 ```
 
+## Properties
 
 
+- `ID`: The ID of the transit gateway.
+- `OwnerId`: The ID of the AWS account that owns the transit gateway.
+- `State`: The state of the transit gateway.
+- `tag:<key>:`: This resource has tags with property `Tags`. These are key/value pairs that are
+	added as their own property with the prefix of `tag:` (e.g. [tag:example: "value"]) 
+
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property
     names to write filters for what you want to **keep** and omit from the nuke process.

diff --git a/docs/resources/kms-alias.md b/docs/resources/kms-alias.md
@@ -14,7 +14,11 @@ KMSAlias
 ## Properties
 
 
-- `Name`: No Description
+- `CreationDate`: The creation date of the KMS alias
+- `Name`: The name of the KMS alias
+- `TargetKeyID`: The KMS Key ID that the alias points to
+- `tag:<key>:`: This resource has tags with property `Tags`. These are key/value pairs that are
+	added as their own property with the prefix of `tag:` (e.g. [tag:example: "value"]) 
 
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property

diff --git a/docs/resources/kms-key.md b/docs/resources/kms-key.md
@@ -33,6 +33,19 @@ the filter.
 
 The string value is always what is used in the output of the log format when a resource is identified.
 
+## Settings
+
+- `IgnoreErrors`
+
+
+### IgnoreErrors
+
+KMS keys can be often in a state that can't be deleted if the KMS policy had been malformed. Give option to igore error in order to not fail the overall nuke.
+
+```text
+IgnoreErrors
+```
+
 ### DependsOn
 
 !!! important - Experimental Feature

diff --git a/docs/resources/neptune-cluster.md b/docs/resources/neptune-cluster.md
@@ -15,6 +15,9 @@ NeptuneCluster
 
 
 - `ID`: No Description
+- `Status`: No Description
+- `tag:<key>:`: This resource has tags with property `Tags`. These are key/value pairs that are
+	added as their own property with the prefix of `tag:` (e.g. [tag:example: "value"]) 
 
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property
@@ -28,3 +31,26 @@ the filter.
 
 The string value is always what is used in the output of the log format when a resource is identified.
 
+## Settings
+
+- `DisableDeletionProtection`
+
+
+### DisableDeletionProtection
+
+!!! note
+    There is currently no description for this setting. Often times settings are fairly self-explanatory. However, we
+    are working on adding descriptions for all settings.
+
+```text
+DisableDeletionProtection
+```
+
+### DependsOn
+
+!!! important - Experimental Feature
+    This resource depends on a resource using the experimental feature. This means that the resource will
+    only be deleted if all the resources of a particular type are deleted first or reach a terminal state.
+
+- [NeptuneInstance](./neptune-instance.md)
+
diff --git a/docs/resources/neptune-instance.md b/docs/resources/neptune-instance.md
@@ -14,8 +14,10 @@ NeptuneInstance
 ## Properties
 
 
+- `ClusterID`: No Description
 - `ID`: No Description
 - `Name`: No Description
+- `Status`: No Description
 - `tag:<key>:`: This resource has tags with property `Tags`. These are key/value pairs that are
 	added as their own property with the prefix of `tag:` (e.g. [tag:example: "value"]) 
 
@@ -31,3 +33,30 @@ the filter.
 
 The string value is always what is used in the output of the log format when a resource is identified.
 
+## Settings
+
+- `DisableClusterDeletionProtection`
+- `DisableDeletionProtection`
+
+
+### DisableClusterDeletionProtection
+
+!!! note
+    There is currently no description for this setting. Often times settings are fairly self-explanatory. However, we
+    are working on adding descriptions for all settings.
+
+```text
+DisableClusterDeletionProtection
+```
+
+
+### DisableDeletionProtection
+
+!!! note
+    There is currently no description for this setting. Often times settings are fairly self-explanatory. However, we
+    are working on adding descriptions for all settings.
+
+```text
+DisableDeletionProtection
+```
+
diff --git a/docs/resources/neptune-snapshot.md b/docs/resources/neptune-snapshot.md
@@ -14,7 +14,9 @@ NeptuneSnapshot
 ## Properties
 
 
+- `CreateTime`: No Description
 - `ID`: No Description
+- `Status`: No Description
 
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property

diff --git a/...esources/aws-network-firewall-firewall.md → docs/resources/network-firewall.md b/...esources/aws-network-firewall-firewall.md → docs/resources/network-firewall.md
@@ -2,13 +2,13 @@
 generated: true
 ---
 
-# AWS::NetworkFirewall::Firewall
+# NetworkFirewall
 
 
 ## Resource
 
 ```text
-AWS::NetworkFirewall::Firewall
+NetworkFirewall
 ```
 
 ### Alternative Resource

diff --git a/docs/resources/resource-explorer-2index.md b/docs/resources/resource-explorer-2index.md
@@ -11,8 +11,12 @@ generated: true
 ResourceExplorer2Index
 ```
 
+## Properties
 
 
+- `ARN`: No Description
+- `Type`: No Description
+
 !!! note - Using Properties
     Properties are what [Filters](../config-filtering.md) are written against in your configuration. You use the property
     names to write filters for what you want to **keep** and omit from the nuke process.