Add execute-api to SCP Not-Deny Action for WebSocket API #59
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
PR Summary
I encountered an error when attempting to connect a WebSocket using a Sandbox account.
This was because the execute-api:ManageConnections command was being denied via SCP.
This PR adds execute-api to the AWS Nuke supported services list, enabling proper cleanup of WebSocket API resources.
Changes
Added execute-api:* to isb-aws-nuke-supported-services-scp.json
Updated corresponding test snapshots
Technical Background (from AWS official documentation)
WebSocket connections are automatically disconnected after a 10-minute idle timeout:
execute-api:ManageConnections is defined as an action, not a resource:
AWS Nuke does not target actions for deletion, so the execute-api:ManageConnections action itself will not be deleted. However, deleting the WebSocket API resource prevents new connections and existing connections will automatically time out and disconnect.
Expected Effects