The purpose of this page is to provide you with an overview of the built-in Automation Policies in Kion named Delete Orphans (and variants). You will find information on how these policies work as well as instructions on configuring these policies. This page is intended for a Kion administrator or technical user that is configuring and using this feature in the Kion platform.
Purpose
The purpose of these policies is to provide you with an easy means to delete clearly-identified waste in sandbox environments on a schedule. We do not recommend the use of this policy in production environments.
- Delete Orphans - Mark - generally means to tag a resource in such a way to indicate that it is a candidate for deletion.
- Delete Orphans - Sweep - generally means to delete a tagged resource after being tagged for a period of time.
We've taken care to ensure that the resources we identify as waste have attributes consistent with general waste. However, you should always test this configuration in your environment. Deleted resources cannot be recovered from your accounts and this must be considered in where you use this capability.
Default Configurations
By default, the Mark policies are configured to run each day at 2:00am ET. The Sweep policies are configured to run each day at 3:00am ET. Resources must be marked for at least 48 hours before deletion by default. This means that resources that are tagged by a Sweep action on a given day should not be targeted by the following Sweep action on the same day.
Targeted Resources
Mark and Sweep policies are targeted at specific resources that have specific configurations. There are no policies that will simply delete a resource for existing. Configuration criteria must be met in some way. Here are some examples of policies that are included by default:
- AWS
- AWS AMIs not referenced by any EC2 instance, launch template, or launch configuration.
- AWS Classic Load Balancers with no active registered instances.
- AWS EBS Volumes that are unattached.
- AWS Elastic IPs that are not associated with any resource.
- AWS ENIs that are not associated with any resource.
- AWS Internet Gateways that are not associated with any resource.
- AWS Target Groups that have no Load Balancers specified.
- Azure
- Azure Compute Disks that are not attached to any virtual machine.
- Azure Load Balancers that have no active targets.
- Azure Network Interfaces that are not associated with any resource.
- Azure Public IPs that are not associated with any resource.
Skipping Resources
If you wish to preserve a targeted resource within an account that would otherwise meet the criteria above, tag or label that resource with the automation-orphan-skip key and any value. This will cause the scan process to exclude this resource.
Adjusting Scan Times
The out of the box scheduled times are just the policy configuration objects. To change these times, follow these steps:
- Navigate to Automation > Automation Policies.
- In the By Keyword field, filter for “Delete Orphans”. This will produce a filtered list of results.
- For each result, follow these steps:
- Select the more options menu on the right-side of the listing and choose Edit.
- Scroll to the Frequency section of the page and adjust the schedule appropriately.
- NOTE: The scan time for the Mark operations should occur at least 1 hour before the Sweep operations in the cycle you select. We do not recommend using intervals for this policy.
- Select Continue.
- Do not make any changes on the second page and choose Update Automation Policy.
Activating
All you need to do to use this policy is activate it by applying the system-provided Cloud Rule to the appropriate scope. The system-provided Cloud Rule for this functionality is titled Delete Sandbox Orphaned Resources.
For hierarchical implementations, you can simply apply this Cloud Rule to the appropriate OU and allow it to be inherited down to Projects and Accounts.
For implementations that do not follow a hierarchy, we recommend labeling target Projects or OUs with a distinct Kion Label and then using Action Plans to apply this Cloud Rule.
NOTE: You must take care in how you target this Cloud Rule. This Cloud Rule can delete important resources after the waiting period.
Timing
Under normal performance conditions, scheduled tasks are expected to complete within 1 hour of the originally scheduled time.
Outcomes
The outcome of this operation can be found on the individual Automation Policy page under Impacted Resources. Here’s an example of checking the impact on AWS AMI resources:
- Navigate to Automation > Automation Policies.
- At the top, select Enabled to quickly see only the active policies.
- On the Enabled tab, type “AMI” in the By Keyword field to filter the policies down.
- In the list, select the Delete Orphans - Mark - AWS AMIs policy to see items marked for deletion or Delete Orphans - Sweep - AWS AMIs policy to see items deleted.
- On the policy’s details page, select the Impacted Resources tab. This page will display all of the impacted resource information about the modifications made by the policy.
Quick Start Instructions
NOTE: Following these steps will target resources to be deleted in the target accounts. You should not use this policy in production accounts. Deleted resources cannot be recovered from your accounts.
If you want to easily get started with these policies, you can follow the steps below:
- Navigate to a Project where you’d like to delete sandbox resources on a schedule.
- On the Project, select the Automation > Cloud Rules tabs.
- On the Cloud Rules tab, select Add Existing Cloud Rule button or the more options menu and choose Add Existing Cloud Rule.
- On the dialog that appears, choose Delete Sandbox Orphaned Resources as the Cloud Rule and then Confirm selection.
- This will apply the Cloud Rule that contains the necessary policies. These policies will now run on the assigned schedule.