Deleting PPC

Prerequisites

Authentication

The deletion process uses OpenTofu to destroy AWS resources, such as EKS clusters, IAM roles, S3 buckets, and KMS keys. The AWS credentials must be exported as environment variables to authenticate these operations.

Note: While using temporary credentials, such as, using AWS STS, ensure the session token is included and that the credentials have not expired before proceeding.

To export the AWS credentials, run the following commands.

export AWS_ACCESS_KEY_ID=<your-access-key-id>
export AWS_SECRET_ACCESS_KEY=<your-secret-access-key>
export AWS_SESSION_TOKEN=<your-session-token>

To verify that the credentials are valid and the correct AWS identity is being used, run the following command.

aws sts get-caller-identity

Required Permissions

The same IAM principal (or one with equivalent permissions) that installed the cluster, can delete the cluster. The principal must have cluster-creator admin access to the EKS Kubernetes API.

The required IAM Permissions are listed in the following table:

Required tools

The following tools must be installed and available on the machine before proceeding with deletion:

• tofu (OpenTofu)
• kubectl (configured with cluster context)
• aws CLI
• helm

Cleaning up the EKS Resources

There are two ways to destroy all created resources, including the EKS cluster and related components.

Method 1: Using the bootstrap script

From the folder where bootstrap script is present, run the following command:

./bootstrap.sh --cloud aws destroy

Method 2: Using OpenTofu to delete all modules

This method displays how to delete a PPC cluster on AWS by destroying the OpenTofu modules in reverse order. Destroying modules one at a time gives full control and visibility over each stage.

Warning: This process is irreversible. All cluster resources, data, and backups stored in the S3 bucket will be permanently deleted.

The modules are located at:

~/iac/aws/cluster/modules/
├── 00_backup_bucket
├── 01_iam_roles
├── 02_eks_cluster
├── 03_node_group
├── 04_eks_addons
└── 05_helm_releases

These modules must be destroyed in reverse order: 05 → 04 → 03 → 02 → 01 → 00.

To delete the modules, perform the following steps:

1. To delete the helm releases resource, perform the following steps:

# Navigate to 05_helm_releases directory
cd /iac/aws/cluster/modules/05_helm_releases

# Initialize providers
tofu init  

# Delete the helm release
tofu destroy        # type "yes" when prompted

2. To delete the EKS Addons resource, run the following command.

# Navigate to 04_eks_addons directory
cd /iac/aws/cluster/modules/04_eks_addons

# Initialize providers
tofu init  

# Delete the eks addons
tofu destroy        # type "yes" when prompted

3. To delete the Node Group resource, run the following command.

# Navigate to 03_node_group directory
cd /iac/aws/cluster/modules/03_node_group

# Initialize providers
tofu init 

# Delete the node group
tofu destroy        # type "yes" when prompted

4. To delete the EKS Cluster resource, run the following command.

# Navigate to 02_eks_cluster directory
cd /iac/aws/cluster/modules/02_eks_cluster

# Initialize providers
tofu init 

# Delete the eks cluster
tofu destroy        # type "yes" when prompted

5. To delete the IAM Roles resource, run the following command.

# Navigate to 01_iam_roles directory
cd /iac/aws/cluster/modules/01_iam_roles

# Initialize providers
tofu init 

# Delete the iam roles
tofu destroy        # type "yes" when prompted

6. To delete the Backup Bucket (S3 + KMS) resource, perform the following steps.

# 1.Navigate to 00_backup_bucket directory
cd /iac/aws/cluster/modules/00_backup_bucket

# 2. Download the state file from S3 (synced there during install)
aws s3 cp \
  s3://<bucket-name>/infrastructure-manifest/<cluster-name>/states/00_backup_bucket.tfstate \
  ./terraform.tfstate

# 3. Initialize providers
tofu init

# 4. Enable force_destroy on the bucket (updates only the flag)
tofu apply -var="force_destroy_bucket=true"

# 5. Destroy all resources
tofu destroy -var="force_destroy_bucket=true"        # type "yes" when prompted

Note: After destroying all the modules, delete the CloudWatch Logs group created by EKS control plane logging using the following command.

aws logs delete-log-group \
 --log-group-name "/aws/eks/<cluster-name>/cluster" \
 --region <region>