AWS Batch Job - clean up history

Question

Hello,

In one of my company's AWS account we have vulnerable information leak issue. AWS Batch jobs were launched with ENV variables and this variables contains very important and vulnerable details. We would like to wipe out this history from the account. How can we do that ?

Thanks

Yaniv Rozenboim · Accepted Answer

There is no API to clear the AWS batch job history.

The job state for `SUCCEEDED` and `FAILED` jobs is persisted in AWS Batch for at least 7 days (see [here](https://docs.aws.amazon.com/batch/latest/userguide/job_states.html) and [here](https://aws.amazon.com/about-aws/whats-new/2022/09/aws-batch-extends-job-report-retention-period-24-hours-7-days/)).

If this account is a member of an organization you can create and associate SCP (Service Control Policy) to this account that will prevent any principal from describing that job (and remove the SCP after 7 days has passed).

Example:
```
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "batch:DescribeJobs",
            "Resource": "arn:aws:batch:REGION:ACCOUNT_ID:job/JOB_ID"
        }
    ]
}
```

AWS Batch Job - clean up history

Relevant content