Explanation: Recursively nuke things from a CICD build agent running Terraform with Azure God mode permissions

exploit-explanation.tf

resource "null_resource" "nuke" {
  # Because we set this to timestamp, it *always* runs :D
  triggers = {
    party_like_its_jan_1_1970 = timestamp()
  }

  provisioner "local-exec" {
    # Pseudocode for some bash magic that:
    # 1. gets a list of all subscriptions
    # 2. For each subscription, list the resource groups
    # 3. For each resource group, delete the resource group
    # 4. Profit
    command = "echo 'pseudocode: get_all_subscriptions, for_each_subscription, delete_all_resource_groups' && echo '${timestamp()}'"
  }
}

output.console

$ terraform apply -auto-approve

null_resource.nuke: Refreshing state... [id=1485136337162939210]
null_resource.nuke: Destroying... [id=1485136337162939210]
null_resource.nuke: Destruction complete after 0s
null_resource.nuke: Creating...
null_resource.nuke: Provisioning with 'local-exec'...
null_resource.nuke (local-exec): Executing: ["/bin/sh" "-c" "echo 'pseudocode: get_all_subscriptions, for_each_subscription, delete_all_resource_groups' && echo '2020-10-30T16:10:08Z'"]
null_resource.nuke (local-exec): pseudocode: get_all_subscriptions, for_each_subscription, delete_all_resource_groups
null_resource.nuke (local-exec): 2020-10-30T16:10:08Z
null_resource.nuke: Creation complete after 0s [id=7128989191068266283]

$ terraform apply -auto-approve
null_resource.nuke: Refreshing state... [id=7128989191068266283]
null_resource.nuke: Destroying... [id=7128989191068266283]
null_resource.nuke: Destruction complete after 0s
null_resource.nuke: Creating...
null_resource.nuke: Provisioning with 'local-exec'...
null_resource.nuke (local-exec): Executing: ["/bin/sh" "-c" "echo 'pseudocode: get_all_subscriptions, for_each_subscription, delete_all_resource_groups' && echo '2020-10-30T16:10:10Z'"]
null_resource.nuke (local-exec): pseudocode: get_all_subscriptions, for_each_subscription, delete_all_resource_groups
null_resource.nuke (local-exec): 2020-10-30T16:10:10Z
null_resource.nuke: Creation complete after 0s [id=7938497186707537382]

Apply complete! Resources: 1 added, 0 changed, 1 destroyed.