Uninstalling
To uninstall the Hub, delete its stack. The products you installed with it are separate stacks and keep running.
Before you start
- Products that sign in through the Hub use the Hub's user pool, which is deleted with the stack. Move each of them to another sign-in method first: open Update / change settings on its stack page and choose another method. See signing in through the Hub.
- Product stacks are not deleted with the Hub. Delete any you no longer need from the Hub first, or later in the CloudFormation console.
- Export what you want to keep from the Hub's DynamoDB table, if anything. The table itself is kept (see below).
Delete the stack
In the CloudFormation console, select the Hub's stack and choose Delete. With the AWS CLI:
aws cloudformation delete-stack --region eu-west-2 --stack-name cloudcertainty-hub
aws cloudformation wait stack-delete-complete --region eu-west-2 --stack-name cloudcertainty-hubWith Terraform, remove the module and apply, or run terraform destroy.
The Hub never deletes its own stack: this is always your decision.
What stays
| What | Why |
|---|---|
The DynamoDB table, <NamePrefix>-table | Its deletion policy is RetainExceptOnCreate: it is kept when a working Hub's stack is deleted, so your settings and audit log survive. It is removed only when the very first install of the stack fails. The TableName output named it. |
| IAM Identity Center, its users and its groups | The stack never deletes them, including the CloudCertaintyHubAdmins group and the users the Hub created. |
The secrets of product sign-in clients, cc-hub-<stack name>-oidc-client | The Hub creates them while it runs, not the stack. Delete them in Secrets Manager when no product uses them. |
| Product stacks | Each is its own stack. |
Everything else the stack created is deleted with it: the roles, functions, log groups, user pool, HTTP API, web app, update topic and the artifacts bucket, which the stack empties first.
Product stacks afterwards
The Hub ran the product stacks it created with its deployer role, and that role is deleted with the Hub. CloudFormation uses a stack's service role for every later update or delete, so after the Hub is gone, update or delete those product stacks with another role, or with your own credentials, that can manage their resources.
Installing again
A new Hub with the same NamePrefix needs the table name, so it cannot be created while the old
table exists. Either delete the table first (after exporting anything you want to keep), or install
the new Hub with another NamePrefix.
Something unclear or missing? Email info@cloudcertainty.com.