A Bash script to clean out the Identity Whitelist from Hashicorp Vault's AWS Auth Provider

clean_aws_cache.sh

#! /bin/bash

WHITELIST=$(vault list -format=json auth/aws-ec2/identity-whitelist | jq -r '.[]')

INSTANCES=$(aws ec2 describe-instances)
INSTANCE_LIST=$(echo $INSTANCES | jq -r '.Reservations[].Instances[] | .InstanceId')

for item in $WHITELIST; do
	if echo $INSTANCE_LIST | grep -w $item > /dev/null; then
		echo "Skipping..."
	else
		echo "Delete $item"
		curl -X DELETE -H "X-VAULT-TOKEN: $VAULT_TOKEN" $VAULT_ADDR/v1/auth/aws-ec2/identity-whitelist/$item
	fi
done