AWS Secure Document Pipeline - Part 4: Complete Resource Cleanup Guide

Learn how to safely and completely tear down all AWS resources from your document processing pipeline. Comprehensive cleanup guide with automated scripts, manual steps, and verification procedures.

AWS Services

October 26, 2025

AWS Secure Document Pipeline - Part 4: Complete Resource Cleanup Guide

Share This Post

Twitter LinkedIn Copy Link

AWS Secure Document Pipeline - Part 4: Complete Resource Cleanup Guide

Introduction

After successfully building and testing your secure document processing pipeline, it’s crucial to properly clean up all AWS resources to avoid unexpected charges. This comprehensive guide provides multiple approaches for safely tearing down your infrastructure while preserving any data you want to keep.

What You’ll Learn

How to safely delete AWS resources in the correct order
Automated cleanup scripts for efficient resource removal
Manual step-by-step cleanup procedures
Verification methods to ensure complete cleanup
Troubleshooting common deletion errors
Cost verification and billing monitoring

Prerequisites

Before starting cleanup:

AWS CLI configured with admin credentials
Terraform installed and project directory accessible
No active processes uploading/processing files
Backup any data you want to keep

⚠️ Important Warnings

This process is IRREVERSIBLE - All data will be permanently deleted
Follow the exact order - Skipping steps will cause deletion failures
Verify each step - Check that resources are actually deleted
Check AWS billing - Confirm no charges after 24 hours
Save any important data - Download files you need before cleanup

Estimated Time

Quick Cleanup (Terraform): 10-15 minutes
Manual Verification: 5-10 minutes
Total Time: 15-25 minutes

Prerequisites

Before starting cleanup:

AWS CLI configured with admin credentials
Terraform installed and project directory accessible
No active processes uploading/processing files
Backup any data you want to keep

Quick Start: Automated Cleanup Script

For fastest cleanup, use this automated script:

Create Cleanup Script

Create file: cleanup.sh (Linux/macOS/WSL)

#!/bin/bash

# Color codes for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

PROJECT_NAME="secure-doc-pipeline"
REGION="ap-south-1"

echo -e "${YELLOW}================================================${NC}"
echo -e "${YELLOW}   AWS Secure Document Pipeline Cleanup${NC}"
echo -e "${YELLOW}================================================${NC}"
echo ""
echo -e "${RED}WARNING: This will delete all project resources!${NC}"
echo -e "${RED}This action is IRREVERSIBLE!${NC}"
echo ""
read -p "Are you sure you want to continue? (type 'yes' to confirm): " CONFIRM

if [ "$CONFIRM" != "yes" ]; then
    echo "Cleanup cancelled."
    exit 0
fi

echo ""
echo -e "${GREEN}Starting cleanup process...${NC}"
echo ""

# Step 1: Remove Lambda triggers
echo "Step 1: Removing S3 bucket notifications..."
aws s3api put-bucket-notification-configuration \
    --bucket ${PROJECT_NAME}-internal-processing \
    --notification-configuration '{}' \
    --region ${REGION} 2>/dev/null || echo "Notification already removed or bucket doesn't exist"

# Step 2: Disable S3 replication
echo "Step 2: Disabling S3 replication..."
aws s3api delete-bucket-replication \
    --bucket ${PROJECT_NAME}-uploads \
    --region ${REGION} 2>/dev/null || echo "Replication already disabled"

aws s3api delete-bucket-replication \
    --bucket ${PROJECT_NAME}-processed-output \
    --region ${REGION} 2>/dev/null || echo "Replication already disabled"

# Step 3: Empty all S3 buckets
echo "Step 3: Emptying S3 buckets..."

BUCKETS=(
    "${PROJECT_NAME}-uploads"
    "${PROJECT_NAME}-internal-processing"
    "${PROJECT_NAME}-processed-output"
    "${PROJECT_NAME}-delivery"
    "${PROJECT_NAME}-compliance-logs"
    "${PROJECT_NAME}-cloudtrail-logs"
)

for bucket in "${BUCKETS[@]}"; do
    echo "  Emptying bucket: $bucket"

    # Delete all object versions
    aws s3api list-object-versions \
        --bucket "$bucket" \
        --region ${REGION} \
        --output json \
        --query '{Objects: Versions[].{Key:Key,VersionId:VersionId}}' 2>/dev/null | \
    jq -r '.Objects[]? | "\(.Key)\t\(.VersionId)"' | \
    while IFS=$'\t' read -r key versionId; do
        aws s3api delete-object --bucket "$bucket" --key "$key" --version-id "$versionId" --region ${REGION} 2>/dev/null
    done

    # Delete all delete markers
    aws s3api list-object-versions \
        --bucket "$bucket" \
        --region ${REGION} \
        --output json \
        --query '{Objects: DeleteMarkers[].{Key:Key,VersionId:VersionId}}' 2>/dev/null | \
    jq -r '.Objects[]? | "\(.Key)\t\(.VersionId)"' | \
    while IFS=$'\t' read -r key versionId; do
        aws s3api delete-object --bucket "$bucket" --key "$key" --version-id "$versionId" --region ${REGION} 2>/dev/null
    done

    # Delete remaining objects
    aws s3 rm s3://$bucket --recursive --region ${REGION} 2>/dev/null || echo "  Bucket $bucket already empty or doesn't exist"
done

echo ""
echo "Step 4: Waiting 10 seconds for AWS to process deletions..."
sleep 10

# Step 5: Run Terraform destroy
echo "Step 5: Running Terraform destroy..."
cd terraform 2>/dev/null || cd ../terraform 2>/dev/null || cd ./terraform 2>/dev/null

if [ -f "main.tf" ]; then
    terraform destroy -auto-approve
    TERRAFORM_EXIT=$?

    if [ $TERRAFORM_EXIT -eq 0 ]; then
        echo -e "${GREEN}Terraform destroy completed successfully!${NC}"
    else
        echo -e "${RED}Terraform destroy encountered errors. See output above.${NC}"
    fi
else
    echo -e "${RED}Error: terraform directory not found!${NC}"
    exit 1
fi

echo ""
echo -e "${GREEN}================================================${NC}"
echo -e "${GREEN}   Cleanup Process Completed!${NC}"
echo -e "${GREEN}================================================${NC}"
echo ""
echo "Next steps:"
echo "1. Run the verification script to confirm all resources are deleted"
echo "2. Check AWS Console for any remaining resources"
echo "3. Monitor billing for 24 hours to ensure no charges"

Make script executable:

chmod +x cleanup.sh

Run the script:

./cleanup.sh

Manual Cleanup: Step-by-Step Guide

If you prefer manual cleanup or the script fails, follow these steps:

Step 1: Remove Lambda Triggers

Remove S3 event notifications to prevent Lambda from being invoked during cleanup.

# Remove S3 notification configuration
aws s3api put-bucket-notification-configuration \
    --bucket secure-doc-pipeline-internal-processing \
    --notification-configuration '{}' \
    --region ap-south-1

Verification:

aws s3api get-bucket-notification-configuration \
    --bucket secure-doc-pipeline-internal-processing \
    --region ap-south-1

Expected: Empty configuration {}

Step 2: Disable S3 Replication

Disable replication rules to prevent errors during bucket deletion.

# Disable replication from uploads bucket
aws s3api delete-bucket-replication \
    --bucket secure-doc-pipeline-uploads \
    --region ap-south-1

# Disable replication from processed-output bucket
aws s3api delete-bucket-replication \
    --bucket secure-doc-pipeline-processed-output \
    --region ap-south-1

Verification:

aws s3api get-bucket-replication \
    --bucket secure-doc-pipeline-uploads \
    --region ap-south-1

Expected: Error message “ReplicationConfigurationNotFoundError” (this is good!)

Step 3: Empty All S3 Buckets

S3 buckets must be empty before they can be deleted. This includes all versions if versioning is enabled.

Option A: Using AWS CLI (Recommended)

# Empty uploads bucket
aws s3 rm s3://secure-doc-pipeline-uploads --recursive
aws s3api delete-objects --bucket secure-doc-pipeline-uploads \
    --delete "$(aws s3api list-object-versions --bucket secure-doc-pipeline-uploads \
    --query '{Objects: Versions[].{Key:Key,VersionId:VersionId}}' --max-items 1000)"

# Empty internal-processing bucket
aws s3 rm s3://secure-doc-pipeline-internal-processing --recursive
aws s3api delete-objects --bucket secure-doc-pipeline-internal-processing \
    --delete "$(aws s3api list-object-versions --bucket secure-doc-pipeline-internal-processing \
    --query '{Objects: Versions[].{Key:Key,VersionId:VersionId}}' --max-items 1000)"

# Empty processed-output bucket
aws s3 rm s3://secure-doc-pipeline-processed-output --recursive
aws s3api delete-objects --bucket secure-doc-pipeline-processed-output \
    --delete "$(aws s3api list-object-versions --bucket secure-doc-pipeline-processed-output \
    --query '{Objects: Versions[].{Key:Key,VersionId:VersionId}}' --max-items 1000)"

# Empty delivery bucket
aws s3 rm s3://secure-doc-pipeline-delivery --recursive
aws s3api delete-objects --bucket secure-doc-pipeline-delivery \
    --delete "$(aws s3api list-object-versions --bucket secure-doc-pipeline-delivery \
    --query '{Objects: Versions[].{Key:Key,VersionId:VersionId}}' --max-items 1000)"

# Empty compliance-logs bucket
aws s3 rm s3://secure-doc-pipeline-compliance-logs --recursive

# Empty cloudtrail-logs bucket
aws s3 rm s3://secure-doc-pipeline-cloudtrail-logs --recursive

Option B: Using Python Script

Create file: empty_buckets.py

import boto3
from botocore.exceptions import ClientError

s3 = boto3.resource('s3', region_name='ap-south-1')
project_name = 'secure-doc-pipeline'

buckets = [
    f'{project_name}-uploads',
    f'{project_name}-internal-processing',
    f'{project_name}-processed-output',
    f'{project_name}-delivery',
    f'{project_name}-compliance-logs',
    f'{project_name}-cloudtrail-logs'
]

for bucket_name in buckets:
    try:
        bucket = s3.Bucket(bucket_name)
        print(f'Emptying bucket: {bucket_name}')

        # Delete all object versions
        bucket.object_versions.all().delete()

        # Delete all objects
        bucket.objects.all().delete()

        print(f'  ✓ {bucket_name} emptied successfully')
    except ClientError as e:
        if e.response['Error']['Code'] == 'NoSuchBucket':
            print(f'  ⊗ {bucket_name} does not exist')
        else:
            print(f'  ✗ Error emptying {bucket_name}: {e}')

print('\nAll buckets processed!')

Run the script:

python empty_buckets.py

Verification:

# Check each bucket is empty
aws s3 ls s3://secure-doc-pipeline-uploads/
aws s3 ls s3://secure-doc-pipeline-internal-processing/
aws s3 ls s3://secure-doc-pipeline-processed-output/
aws s3 ls s3://secure-doc-pipeline-delivery/
aws s3 ls s3://secure-doc-pipeline-compliance-logs/
aws s3 ls s3://secure-doc-pipeline-cloudtrail-logs/

Expected: No output (empty buckets)

Step 4: Delete CloudTrail Trail

CloudTrail must be stopped and deleted before its associated resources.

# Stop logging
aws cloudtrail stop-logging \
    --name secure-doc-pipeline-trail \
    --region ap-south-1

# Delete the trail
aws cloudtrail delete-trail \
    --name secure-doc-pipeline-trail \
    --region ap-south-1

Verification:

aws cloudtrail list-trails --region ap-south-1

Expected: No trail named secure-doc-pipeline-trail

Step 5: Delete CloudWatch Resources

Remove alarms, dashboards, and log groups.

# Delete alarms
aws cloudwatch delete-alarms \
    --alarm-names \
        secure-doc-pipeline-lambda-errors \
        secure-doc-pipeline-lambda-throttles \
        secure-doc-pipeline-lambda-duration \
        secure-doc-pipeline-replication-lag \
        secure-doc-pipeline-s3-4xx-errors \
        secure-doc-pipeline-s3-5xx-errors \
    --region ap-south-1

# Delete dashboard
aws cloudwatch delete-dashboards \
    --dashboard-names secure-doc-pipeline-dashboard \
    --region ap-south-1

# Delete log groups
aws logs delete-log-group \
    --log-group-name /aws/lambda/secure-doc-pipeline-document-processor \
    --region ap-south-1

Verification:

aws cloudwatch describe-alarms --region ap-south-1 | grep secure-doc-pipeline
aws cloudwatch list-dashboards --region ap-south-1 | grep secure-doc-pipeline
aws logs describe-log-groups --region ap-south-1 | grep secure-doc-pipeline

Expected: No results

Remove email subscriptions before deleting the topic.

# List subscriptions
aws sns list-subscriptions --region ap-south-1 | grep secure-doc-pipeline

# Unsubscribe (replace SUBSCRIPTION_ARN with actual ARN from above)
aws sns unsubscribe \
    --subscription-arn "arn:aws:sns:ap-south-1:ACCOUNT_ID:secure-doc-pipeline-alerts:SUBSCRIPTION_ID" \
    --region ap-south-1

Note: SNS topic will be deleted by Terraform in next step.

Step 7: Wait for AWS Propagation

Give AWS time to process all deletions.

echo "Waiting 30 seconds for AWS to process deletions..."
sleep 30

This prevents errors in the next step where Terraform might try to delete resources that are still being deleted.

Step 8: Run Terraform Destroy

Now use Terraform to delete all remaining infrastructure.

cd terraform

# Preview what will be destroyed
terraform plan -destroy

# Destroy all resources
terraform destroy -auto-approve

Expected output:

...
Destroy complete! Resources: XX destroyed.

If errors occur:

Note which resources failed to delete
Delete them manually (see troubleshooting section)
Run terraform destroy again

Step 9: Delete IAM Access Keys

Remove the access keys for the third-party user before the user is deleted (already deleted by Terraform, but verify).

# List access keys for third-party user
aws iam list-access-keys \
    --user-name secure-doc-pipeline-third-party-user \
    --region ap-south-1 2>/dev/null

# If any exist, delete them
aws iam delete-access-key \
    --user-name secure-doc-pipeline-third-party-user \
    --access-key-id ACCESS_KEY_ID \
    --region ap-south-1

Step 10: Schedule KMS Key Deletion

KMS keys cannot be deleted immediately. They must be scheduled for deletion (7-30 days).

# List all KMS keys for this project
aws kms list-aliases --region ap-south-1 | grep secure-doc-pipeline

# Schedule key deletion (replace KEY_ID with actual key IDs)
aws kms schedule-key-deletion \
    --key-id "arn:aws:kms:ap-south-1:ACCOUNT_ID:key/KEY_ID" \
    --pending-window-in-days 7 \
    --region ap-south-1

Note: Terraform should have already scheduled deletion. This is just verification.

To cancel deletion (if needed):

aws kms cancel-key-deletion \
    --key-id "arn:aws:kms:ap-south-1:ACCOUNT_ID:key/KEY_ID" \
    --region ap-south-1

Verification: Ensure Everything is Deleted

Run this comprehensive verification script:

Create file: verify_cleanup.sh

#!/bin/bash

PROJECT_NAME="secure-doc-pipeline"
REGION="ap-south-1"
ALL_CLEAN=true

echo "================================================"
echo "   Cleanup Verification"
echo "================================================"
echo ""

# Check S3 Buckets
echo "Checking S3 Buckets..."
BUCKETS=$(aws s3 ls | grep $PROJECT_NAME | wc -l)
if [ "$BUCKETS" -eq 0 ]; then
    echo "  ✓ No S3 buckets found"
else
    echo "  ✗ Found $BUCKETS S3 bucket(s) still exist"
    aws s3 ls | grep $PROJECT_NAME
    ALL_CLEAN=false
fi

# Check Lambda Functions
echo "Checking Lambda Functions..."
LAMBDAS=$(aws lambda list-functions --region $REGION | grep -c $PROJECT_NAME)
if [ "$LAMBDAS" -eq 0 ]; then
    echo "  ✓ No Lambda functions found"
else
    echo "  ✗ Found $LAMBDAS Lambda function(s) still exist"
    ALL_CLEAN=false
fi

# Check IAM Roles
echo "Checking IAM Roles..."
ROLES=$(aws iam list-roles | grep -c $PROJECT_NAME)
if [ "$ROLES" -eq 0 ]; then
    echo "  ✓ No IAM roles found"
else
    echo "  ✗ Found $ROLES IAM role(s) still exist"
    ALL_CLEAN=false
fi

# Check IAM Users
echo "Checking IAM Users..."
USERS=$(aws iam list-users | grep -c $PROJECT_NAME)
if [ "$USERS" -eq 0 ]; then
    echo "  ✓ No IAM users found"
else
    echo "  ✗ Found $USERS IAM user(s) still exist"
    ALL_CLEAN=false
fi

# Check CloudWatch Alarms
echo "Checking CloudWatch Alarms..."
ALARMS=$(aws cloudwatch describe-alarms --region $REGION | grep -c $PROJECT_NAME)
if [ "$ALARMS" -eq 0 ]; then
    echo "  ✓ No CloudWatch alarms found"
else
    echo "  ✗ Found $ALARMS CloudWatch alarm(s) still exist"
    ALL_CLEAN=false
fi

# Check CloudWatch Log Groups
echo "Checking CloudWatch Log Groups..."
LOGS=$(aws logs describe-log-groups --region $REGION | grep -c $PROJECT_NAME)
if [ "$LOGS" -eq 0 ]; then
    echo "  ✓ No CloudWatch log groups found"
else
    echo "  ✗ Found $LOGS CloudWatch log group(s) still exist"
    ALL_CLEAN=false
fi

# Check SNS Topics
echo "Checking SNS Topics..."
TOPICS=$(aws sns list-topics --region $REGION | grep -c $PROJECT_NAME)
if [ "$TOPICS" -eq 0 ]; then
    echo "  ✓ No SNS topics found"
else
    echo "  ✗ Found $TOPICS SNS topic(s) still exist"
    ALL_CLEAN=false
fi

# Check CloudTrail Trails
echo "Checking CloudTrail Trails..."
TRAILS=$(aws cloudtrail list-trails --region $REGION | grep -c $PROJECT_NAME)
if [ "$TRAILS" -eq 0 ]; then
    echo "  ✓ No CloudTrail trails found"
else
    echo "  ✗ Found $TRAILS CloudTrail trail(s) still exist"
    ALL_CLEAN=false
fi

# Check KMS Keys
echo "Checking KMS Keys..."
KEYS=$(aws kms list-aliases --region $REGION | grep -c $PROJECT_NAME)
if [ "$KEYS" -eq 0 ]; then
    echo "  ✓ No KMS keys found (or scheduled for deletion)"
else
    echo "  ! Found $KEYS KMS key alias(es) - These are scheduled for deletion"
    echo "    (This is normal - KMS keys take 7-30 days to fully delete)"
fi

echo ""
echo "================================================"

if [ "$ALL_CLEAN" = true ]; then
    echo "  ✓✓✓ CLEANUP SUCCESSFUL ✓✓✓"
    echo "================================================"
    echo ""
    echo "All resources have been deleted!"
    echo ""
    echo "Next steps:"
    echo "1. Check AWS Billing Console after 24 hours"
    echo "2. Verify no unexpected charges"
    echo "3. KMS keys will auto-delete in 7 days"
else
    echo "  ✗✗✗ CLEANUP INCOMPLETE ✗✗✗"
    echo "================================================"
    echo ""
    echo "Some resources still exist. See above for details."
    echo "You may need to manually delete these resources."
fi

Run verification:

chmod +x verify_cleanup.sh
./verify_cleanup.sh

Troubleshooting Common Deletion Errors

Error: “BucketNotEmpty”

Cause: S3 bucket still contains objects or versions

Solution:

# Force empty the bucket
aws s3 rm s3://BUCKET_NAME --recursive

# Delete all versions
aws s3api delete-objects --bucket BUCKET_NAME \
    --delete "$(aws s3api list-object-versions --bucket BUCKET_NAME \
    --query '{Objects: Versions[].{Key:Key,VersionId:VersionId}}')"

# Try deletion again
aws s3 rb s3://BUCKET_NAME

Error: “ReplicationConfigurationNotFound”

Cause: Trying to delete replication that doesn’t exist

Solution: This is actually fine. It means replication is already disabled. Continue with next step.

Error: “ResourceInUseException” (CloudTrail)

Cause: CloudTrail is still logging

Solution:

# Stop logging first
aws cloudtrail stop-logging --name secure-doc-pipeline-trail

# Wait 10 seconds
sleep 10

# Then delete
aws cloudtrail delete-trail --name secure-doc-pipeline-trail

Error: “Cannot delete entity, must detach all policies first”

Cause: IAM user/role has attached policies

Solution:

# List attached policies
aws iam list-attached-user-policies --user-name secure-doc-pipeline-third-party-user

# Detach each policy
aws iam detach-user-policy \
    --user-name secure-doc-pipeline-third-party-user \
    --policy-arn POLICY_ARN

# Then delete user
aws iam delete-user --user-name secure-doc-pipeline-third-party-user

Error: “Cannot delete KMS key immediately”

Cause: KMS keys require a waiting period

Solution: This is expected. KMS keys are scheduled for deletion (7-30 days) and will auto-delete. No action needed.

Cost Verification

Check AWS Billing Console

Log in to AWS Console
Navigate to Billing Dashboard
Click on Bills
Check current month’s charges

Look for these services:

S3
Lambda
CloudWatch
KMS
CloudTrail
SNS

Expected after cleanup: $0.00 or minimal charges for current partial month

Set Up Billing Alert (Recommended)

# Create billing alarm
aws cloudwatch put-metric-alarm \
    --alarm-name "BillingAlertAfterCleanup" \
    --alarm-description "Alert if AWS charges exceed $1 after cleanup" \
    --metric-name EstimatedCharges \
    --namespace AWS/Billing \
    --statistic Maximum \
    --period 21600 \
    --threshold 1.0 \
    --comparison-operator GreaterThanThreshold \
    --evaluation-periods 1 \
    --dimensions Name=Currency,Value=USD

Final Cleanup Checklist

After running all cleanup steps, verify:

All S3 buckets deleted
Lambda function deleted
Lambda layer deleted
IAM roles deleted
IAM users deleted
IAM policies deleted
CloudWatch alarms deleted
CloudWatch dashboard deleted
CloudWatch log groups deleted
SNS topic deleted
SNS subscriptions removed
CloudTrail trail deleted
KMS keys scheduled for deletion
Local terraform state cleaned (terraform state list returns empty)
AWS billing shows $0 or minimal charges
No resources in AWS Console matching project name

Post-Cleanup: Remove Local Files (Optional)

Clean up your local project directory:

# Navigate to project root
cd /path/to/secure-doc-pipeline

# Remove Terraform state files
cd terraform
rm -f terraform.tfstate terraform.tfstate.backup
rm -rf .terraform/
rm -f .terraform.lock.hcl

# Go back to project root
cd ..

# Optionally remove the entire project
# BE CAREFUL - This deletes everything!
# cd ..
# rm -rf secure-doc-pipeline/

Emergency: Quick Nuclear Option

If nothing else works and you need to delete everything immediately:

#!/bin/bash
# DANGER: This force-deletes everything with no confirmation

PROJECT_NAME="secure-doc-pipeline"
REGION="ap-south-1"

# Force empty and delete all S3 buckets
for bucket in $(aws s3 ls | grep $PROJECT_NAME | awk '{print $3}'); do
    echo "Force deleting $bucket..."
    aws s3 rb s3://$bucket --force
done

# Delete all Lambda functions
for func in $(aws lambda list-functions --region $REGION | grep $PROJECT_NAME | jq -r '.Functions[].FunctionName'); do
    echo "Deleting Lambda: $func"
    aws lambda delete-function --function-name $func --region $REGION
done

# Delete all IAM roles
for role in $(aws iam list-roles | grep $PROJECT_NAME | jq -r '.Roles[].RoleName'); do
    echo "Deleting role: $role"
    # Detach policies first
    for policy in $(aws iam list-attached-role-policies --role-name $role | jq -r '.AttachedPolicies[].PolicyArn'); do
        aws iam detach-role-policy --role-name $role --policy-arn $policy
    done
    aws iam delete-role --role-name $role
done

# Continue for other resources...
echo "Emergency cleanup complete. Run verify_cleanup.sh to check."

⚠️ Use this only as a last resort!

Support and Troubleshooting

If you encounter persistent issues:

Check Terraform state:

cd terraform
terraform state list
terraform state show RESOURCE_NAME

Check AWS Console manually for resources matching “secure-doc-pipeline”
AWS Support:
- Check AWS Support Center
- Create a support ticket if needed
Cost concerns:
- KMS keys: ~$4/month until deletion completes
- All other resources should be $0 after cleanup

Summary

You’ve successfully cleaned up all resources! Here’s what was removed:

✅ 5-6 S3 buckets (including CloudTrail logs bucket)
✅ 1 Lambda function
✅ 1 Lambda layer
✅ 4 KMS keys (scheduled for deletion)
✅ 2 IAM roles (replication, Lambda execution)
✅ 1 IAM user (third party)
✅ 3-4 IAM policies
✅ 6 CloudWatch alarms
✅ 1 CloudWatch dashboard
✅ 1+ CloudWatch log groups
✅ 1 SNS topic
✅ 1 CloudTrail trail
✅ Multiple S3 replication rules
✅ S3 bucket notifications

Estimated time to $0 monthly cost: Immediate (except KMS keys which are $0 after scheduled deletion)

Learning Outcomes

By completing this cleanup, you’ve learned:

✅ Proper order of AWS resource deletion
✅ How to handle dependencies between resources
✅ S3 versioning and object deletion complexity
✅ IAM policy detachment requirements
✅ KMS key deletion policies
✅ Terraform state management
✅ AWS billing verification
✅ Cost optimization and cleanup importance

Additional Resources

Document Version: 1.0
Last Updated: December 2024
Region: ap-south-1 (Mumbai)

Next Steps

Congratulations! You’ve successfully completed the entire AWS Secure Document Pipeline project:

What You’ve Accomplished

✅ Part 1: Built secure S3 infrastructure with replication
✅ Part 2: Created serverless Lambda document processing
✅ Part 3: Implemented enterprise security and monitoring
✅ Part 4: Safely cleaned up all resources

Skills You’ve Developed

Infrastructure as Code: Terraform for AWS resource management
Serverless Architecture: Lambda functions with S3 triggers
Security Best Practices: KMS encryption, IAM policies, CloudTrail
Monitoring & Alerting: CloudWatch alarms, SNS notifications
Cost Optimization: Resource cleanup and billing management
DevOps Workflows: Automated deployment and cleanup processes

Ready for Your Next Project?

You now have the knowledge to build production-ready AWS infrastructure. Consider these next steps:

Explore Advanced Features: API Gateway, DynamoDB, RDS
Implement CI/CD: GitHub Actions, AWS CodePipeline
Add More Security: AWS WAF, GuardDuty, Security Hub
Scale Your Architecture: Auto Scaling, Load Balancers, Multi-AZ

🎉 Project Complete! You’ve successfully built AND cleaned up a production-grade AWS infrastructure! 🎉

Share This Post

Twitter LinkedIn Copy Link

AWS Secure Document Pipeline - Part 4: Complete Resource Cleanup Guide

Table of Contents

Share This Post

AWS Secure Document Pipeline - Part 4: Complete Resource Cleanup Guide

Introduction

What You’ll Learn

Prerequisites

⚠️ Important Warnings

Estimated Time

Prerequisites

Quick Start: Automated Cleanup Script

Create Cleanup Script

Manual Cleanup: Step-by-Step Guide

Step 1: Remove Lambda Triggers

Step 2: Disable S3 Replication

Step 3: Empty All S3 Buckets

Option A: Using AWS CLI (Recommended)

Option B: Using Python Script

Step 4: Delete CloudTrail Trail

Step 5: Delete CloudWatch Resources

Step 6: Unsubscribe from SNS Topic

Step 7: Wait for AWS Propagation

Step 8: Run Terraform Destroy

Step 9: Delete IAM Access Keys

Step 10: Schedule KMS Key Deletion

Verification: Ensure Everything is Deleted

Troubleshooting Common Deletion Errors

Error: “BucketNotEmpty”

Error: “ReplicationConfigurationNotFound”

Error: “ResourceInUseException” (CloudTrail)

Error: “Cannot delete entity, must detach all policies first”

Error: “Cannot delete KMS key immediately”

Cost Verification

Check AWS Billing Console

Set Up Billing Alert (Recommended)

Final Cleanup Checklist

Post-Cleanup: Remove Local Files (Optional)

Emergency: Quick Nuclear Option

Support and Troubleshooting

Summary

Learning Outcomes

Additional Resources

Next Steps

What You’ve Accomplished

Skills You’ve Developed

Ready for Your Next Project?

Table of Contents

Share This Post