Handling of "Explicit Denies"

[AlexanderMannsfeld0007]

Hi, thanks for the great tool. We are running a bigger AWS Organization, protecting resources deployed by us via SCPs, enabling teams not having to keep track of the resources deployed by us when nuking. Unfortunately the "explicit denies" when nuke is trying to delete protected resources results in an return-code >0. Therefor teams using nuke within their deployent-pipelines have a failed step, resulting in they still have to write configs filtering the already protected resources. Nice would be a parameter to steer the behaviour of nuke when running into access denies, eg like --ignore_explicit_denies. Thanks in advance & cheers.

[svenwltr]

Hello. The problem here is to detect those "explicit denies". As there is no unified API for this, we would have to implement another function to every resource, like we already do with filters and properties.

[AlexanderMannsfeld0007]

I see - is there any chance for a generic parameter to enforce return-code 0?