Hacker News Reader

Comment by lvh | Hacker News Reader

I've used aws-nuke a bunch but the use case seems significantly diminished now that AWS Organizations has the ability to delete entire accounts.

View on HN

Last time I've checked it was a lengthy process involving attaching a credit card, leaving the organization and then deleting the account. Has it been changed?

I'm in the process of doing this now. You can close accounts from Control Tower without needing to log in as root to each separate account, adding a credit card, removing it from the org, and then closing it manually.

However, you can only close them from Control Tower at the rate of 2 to 3 per month, due to a hard limit quota which cannot be changed, even if you request it. Needless to say, this sucks when you've followed AWS's own best practices and created lots of accounts using Control Tower's "vending machine."

AWS's archaic account model is one reason we've switched to GCP.

It seems to me this cannot possibly be a hard limit. If it’s a hard limit it’s only because AWS wants to milk you dry.

To be exact, the hard limit is: you cannot delete more than 10% of your organization's accounts (capped at 200) via AWS Organization within a 30 day rolling window. You can always delete an account by going into it as the root user.

https://docs.aws.amazon.com/organizations/latest/userguide/o...

I suspect it’s a hard limit to prevent disgruntled (former) admin blast radius.

If that was the concern then surely they could enable support to restore accounts during some grace period. The machinery for that already exists for people who completely close their AWS accounts down.

Maybe it was quicker to implement with a hard limit, or there is some internal service that can't easily handle large volumes of account removals. But if it was Amazon losing money from this limitation instead of the customer I imagine it would be fixed pretty quickly.

Given that the potential disgruntled admin already has access to nukes, this seems useless.

It used to be, but there's an API now: https://aws.amazon.com/blogs/mt/aws-organizations-now-provid...

https://docs.aws.amazon.com/organizations/latest/APIReferenc...

Now has an API (with some caveats)

Reply on news.ycombinator.com