By setting the filtered role and its policy attachments in the nuke.yaml, you can easily nuke everything except what's needed to recreate it all.