Problem
AWS Nuke does not have a resource handler for Bedrock Imported Models (BedrockImportedModel). When a sandbox user imports a custom model (e.g., via bedrock:CreateModelImportJob), the model persists after cleanup indefinitely. The account transitions to "Available" with no errors, but Bedrock storage charges continue billing.
Impact
- 1 sandbox account had 2 imported Qwen2 models costing $3.90/month in storage
- Models persisted from May 19, 2026 until manually deleted on July 11, 2026
- Total wasted: ~$7.80 over 2 months
- Nuke reports SUCCESS (exit code 0) — completely silent failure
- Post-cleanup validation via Cost Explorer was the only way to detect this
Resource Details
Resource Type: Bedrock Imported Model (Custom Model Import)
Usage Type: USE1-Qwen2-CustomModelImport-Storage-v1:0
Region: us-east-1
Cost: $3.90/month per account (2 models)
Root Cause
aws-nuke resource scanner does not include Bedrock Imported Models in its resource type list. The cleanup completes "successfully" because Nuke never discovers these resources exist.
Workaround Applied
Manual deletion:
aws bedrock delete-imported-model --model-identifier <model-arn> --region us-east-1
Additionally deployed a post-cleanup validation Lambda that checks Cost Explorer 24h after cleanup to detect accounts with charges above baseline.
Recommended Fix
- Add
BedrockImportedModel resource type to the Nuke configuration/scanner
- Or: Add a post-cleanup validation step in the Account Cleaner Step Function that checks for non-zero Bedrock storage charges via CloudWatch metrics
Related
Environment
- ISB version: 1.2.12
- aws-nuke image: latest (as of July 2026)
- Region: us-east-1 (Bedrock imported models)
- Scale: 100 sandbox accounts
Problem
AWS Nuke does not have a resource handler for Bedrock Imported Models (
BedrockImportedModel). When a sandbox user imports a custom model (e.g., viabedrock:CreateModelImportJob), the model persists after cleanup indefinitely. The account transitions to "Available" with no errors, but Bedrock storage charges continue billing.Impact
Resource Details
Root Cause
aws-nukeresource scanner does not include Bedrock Imported Models in its resource type list. The cleanup completes "successfully" because Nuke never discovers these resources exist.Workaround Applied
Manual deletion:
Additionally deployed a post-cleanup validation Lambda that checks Cost Explorer 24h after cleanup to detect accounts with charges above baseline.
Recommended Fix
BedrockImportedModelresource type to the Nuke configuration/scannerRelated
Environment