Clean up old AMIs and snapshots

#!/usr/bin/env bash
# Deregister AMIs older than N days that you own, then delete their snapshots.
# Dry run by default to prevent accidental deletion.
set -euo pipefail

REGION="${AWS_REGION:-us-east-1}"
MAX_AGE_DAYS="${MAX_AGE_DAYS:-30}"
DRY_RUN="${DRY_RUN:-true}"   # set DRY_RUN=false to actually delete

command -v aws >/dev/null 2>&1 || { echo "aws CLI not found"; exit 1; }

CUTOFF="$(date -u -d "${MAX_AGE_DAYS} days ago" +%s)"

# List self-owned AMIs with their creation date and ID.
aws ec2 describe-images --region "${REGION}" --owners self \
  --query "Images[].[ImageId, CreationDate]" --output text |
while IFS=$'\t' read -r ami created; do
  created_epoch="$(date -u -d "${created}" +%s)"
  [ "${created_epoch}" -ge "${CUTOFF}" ] && continue   # too new, keep it

  echo "Old AMI: ${ami} (created ${created})"

  # Capture the snapshot IDs backing this AMI before we deregister it.
  snaps="$(aws ec2 describe-images --region "${REGION}" --image-ids "${ami}" \
    --query "Images[].BlockDeviceMappings[].Ebs.SnapshotId" --output text)"

  if [ "${DRY_RUN}" = "true" ]; then
    echo "  [DRY RUN] would deregister ${ami} and delete snapshots: ${snaps:-none}"
    continue
  fi

  # Deregister the AMI first; snapshots cannot be deleted while in use.
  aws ec2 deregister-image --region "${REGION}" --image-id "${ami}"
  for snap in ${snaps}; do
    aws ec2 delete-snapshot --region "${REGION}" --snapshot-id "${snap}"
    echo "  deleted snapshot ${snap}"
  done
  echo "  deregistered ${ami}"
done