alexandrerocco

# Find the IAM username belonging to the command line parameter
# Useful for finding IAM user corresponding to a compromised AWS credential

# Requirements:
#
# Environmental variables:
#               AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
# python:
#               boto

alexandrerocco

#!/bin/bash
NODE="YOUR NODE NAME"
IFS=$'\n'
for line in $(curl -s 'localhost:9200/_cat/shards' | fgrep UNASSIGNED); do
  INDEX=$(echo $line | (awk '{print $1}'))
  SHARD=$(echo $line | (awk '{print $2}'))

  curl -XPOST 'localhost:9200/_cluster/reroute' -d '{
     "commands": [
        {

alexandrerocco

prefix=your-queue-prefix"
region="your-region"
queues=$(aws sqs list-queues --queue-name-prefix $prefix --region $region)
for q in ${queues[@]}
do
  if [ "${q:0:1}" == "\"" ]; then
          x=${q:1:${#q}-3}
          if [ $x != "QueueUrls" ]; then
                  aws sqs delete-queue --region $region --queue-url $x
          fi

alexandrerocco

# List key pairs on the account
aws ec2 describe-key-pairs --query 'KeyPairs[*].KeyName' --output table

# Find instances that uses a key pair you found out above
aws ec2 describe-instances --filters Name=instance-state-name,Values=running Name=key-name,Values="KP-NAME" --query 'Reservations[*].Instances[*].InstanceId'

# If you get an empty response, you can opt to delete it with:
aws ec2 delete-key-pair --key-name KP-NAME