[DirectoryService] AWS Managed Microsoft AD fails to nuke if AD is shared with other accounts

[alpaca012]

As per title, DirectoryServiceDirectory (AWS Managed Microsoft AD) fails to delete without any explanation why.

Upon investigation, it was because it is shared with other AWS accounts. Using the unshare-directory on AWS CLI, aws ds unshare-directory --directory-id d-xxxxxxxx --unshare-target Id=<account_id>,Type=ACCOUNT, the account(s) are successfully unlinked.

After that, running aws-nuke deletes the AD successfully.

[ekristen]

Do you know if there's any way to programmatically know what accounts the directory is shared with, or is this information you have to know some other way?

[alpaca012]

Do you know if there's any way to programmatically know what accounts the directory is shared with, or is this information you have to know some other way?

We can use ds describe-shared-directories. Here is the link to the CLI reference

$ aws ds describe-shared-directories --owner-directory-id d-xxxxxxxxxx
{
    "SharedDirectories": [
        {
            "OwnerAccountId": "REDACTED",
            "OwnerDirectoryId": "d-xxxxxxxxxx",
            "ShareMethod": "HANDSHAKE",
            "SharedAccountId": "REDACTED",
            "SharedDirectoryId": "d-yyyyyyyyyy",
            "ShareStatus": "REDACTED",
            "ShareNotes": "REDACTED",
            "CreatedDateTime": "REDACTED",
            "LastUpdatedDateTime": "REDACTED"
        }
    ]
}

We can get the shared account IDs from the SharedAccountId key.

[ekristen]

tracked via ekristen/aws-nuke#349

---

Please see the copy of the notice from the README about the deprecation of this project. Sven was kind enough to grant me access to help triage and close issues and pull requests that have already been addressed in the actively maintained fork. Some additional information is located in the welcome issue for more information.

Caution

This repository for aws-nuke is no longer being actively maintained. We recommend users to switch to the actively maintained fork of this project at ekristen/aws-nuke.
We appreciate all the support and contributions we've received throughout the life of this project. We believe that the fork will continue to provide the functionality and support that you have come to expect from aws-nuke.
Please note that this deprecation means we will not be addressing issues, accepting pull requests, or making future releases from this repository.
Thank you for your understanding and support.