Scheduling automatic deletion of AWS CloudFormation stacks
Have you ever set up a temporary AWS CloudFormation stack for demo or testing purposes and wished you could schedule automatic deletion of the stack rather than having to remember to clean it up after you are done? If so, this blog post is for you.
I present a mechanism to automatically delete your demonstration stacks after a configured Time to Live (TTL) has passed. The architecture diagram of the feature contains the following components:
- Computed cron expression: An AWS Lambda function that takes as an input a TTL value in minutes and computes a cron expression that will evaluate to true after the specified number of minutes have elapsed since the stack was launched.
- Cron Event rule: A CloudWatch Events rule that is set up with the computed cron expression and triggers the
Delete Named StackLambda function when the cron expression evaluates to true.
- Delete Named Stack: A Lambda function that takes as an input a
StackNameand runs the AWS CloudFormation
Important: For security reasons, the
Delete Named Stack Lambda function has been granted restricted permission to delete only the named stack. For this to work and successfully delete your stack, you must create the main stack using the Administrator service role for AWS CloudFormation. I have provided a template that you can use to provision the Administrator service role.
I have used an AWS CloudFormation template to build the feature. The template takes two inputs:
|Stack name that will be deleted after TTL minutes have elapsed.|
|Time to live
|TTL in minutes for the stack.|
You can view the full template by visiting the GitHub repository. Or keep reading to dive into the main components of the solution.
Generating the cron expression from TTL input
I have written a Lambda function, using Python 3.6 runtime, that computes the time delta from the current time until TT: and returns a cron expression string that is required for setting up the CloudWatch Events rule. Then I execute the
GenerateCronExpLambda function using an AWS CloudFormation custom resource:
Setting up the CloudWatch Events rule
I use the computed cron expression as the
ScheduleExpression property value when setting up
Deleting the AWS CloudFormation stack after TTL
I create a new Lambda function to delete the stack. It is invoked from the CloudWatch Events rule when TTL has elapsed. The stack name is passed as an environment variable to the Lambda function, and it references the input provided at the time of stack launch. I use the
Boto 3 CloudFormation API to delete the stack.
You can use the template in one of the following two ways:
The first way to use the template is to set up the scheduled automatic deletion of any stack that has already been created. For example, in the screenshot, ttl-stack will delete my-demo-stack after 120 minutes.
Note: my-demo-stack must have been created with Administrator service role.
The second way to use the template is to launch it as a nested stack from your main stack, passing in the name of the parent stack and a desired TTL value to the nested stack. When the TTL has elapsed,
DeleteCFNLambda will delete the main stack as well as clean up the nested stack. The following AWS CloudFormation template illustrates this. It creates one AWS Systems Manager parameter resource and consumes the TTL stack as a nested resource, passing its name as a reference and the TTL as 5 minutes.
I have presented a serverless solution packaged as an AWS CloudFormation template that can be used independently or as a nested resource in your CloudFormation stacks to automatically delete demo stacks after a configured amount of time.
If you want to dig deeper into the code, please check out the GitHub repository and create issues for providing feedback or suggesting enhancements. Open-source code contributions are welcome as pull requests.