working on aws
This commit is contained in:
n0mad1k
+235
-217
@@ -1,242 +1,260 @@
|
||||
---
|
||||
# AWS Cleanup Playbook (Fixed)
|
||||
# AWS Cleanup Playbook
|
||||
|
||||
- name: Clean up AWS infrastructure
|
||||
- name: Clean up AWS resources
|
||||
hosts: localhost
|
||||
connection: local
|
||||
gather_facts: false
|
||||
connection: local
|
||||
vars_files:
|
||||
- vars.yaml
|
||||
vars:
|
||||
aws_region: "{{ aws_region | default(aws_region_choices | random) }}"
|
||||
cleanup_redirector: "{{ (redirector_name is defined and redirector_name != '') | ternary(true, false) }}"
|
||||
cleanup_c2: "{{ (c2_name is defined and c2_name != '') | ternary(true, false) }}"
|
||||
confirm_cleanup: "{{ confirm_cleanup | default(true) }}"
|
||||
delay_seconds: 30
|
||||
# Initialize cleaned resources list
|
||||
cleaned_resources:
|
||||
instances: []
|
||||
security_groups: []
|
||||
key_pairs: []
|
||||
internet_gateways: []
|
||||
subnets: []
|
||||
route_tables: []
|
||||
vpcs: []
|
||||
delete_results: {}
|
||||
|
||||
tasks:
|
||||
- name: Validate required AWS credentials
|
||||
assert:
|
||||
that:
|
||||
- aws_access_key is defined and aws_access_key != ""
|
||||
- aws_secret_key is defined and aws_secret_key != ""
|
||||
fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key."
|
||||
|
||||
- name: Confirm cleanup if required
|
||||
- name: Confirm cleanup
|
||||
pause:
|
||||
prompt: "WARNING: This will permanently delete all infrastructure. Type 'yes' to continue"
|
||||
register: confirmation
|
||||
when: confirm_cleanup
|
||||
prompt: "This will delete all AWS resources for deployment ID {{ deployment_id }}. Continue? (yes/no)"
|
||||
register: confirm_deletion
|
||||
when: confirm_cleanup | default(true) | bool
|
||||
|
||||
- name: Check confirmation
|
||||
assert:
|
||||
that: confirm_deletion.user_input | default('yes') | lower == 'yes'
|
||||
fail_msg: "Cleanup cancelled by user"
|
||||
when: confirm_cleanup | default(true) | bool
|
||||
|
||||
# C2 server cleanup
|
||||
- name: Terminate C2 instances
|
||||
amazon.aws.ec2_instance:
|
||||
state: absent
|
||||
region: "{{ aws_region }}"
|
||||
filters:
|
||||
"tag:Name": "{{ c2_name }}"
|
||||
register: c2_instances_result
|
||||
when: cleanup_c2 | default(true) | bool
|
||||
|
||||
# Redirector cleanup
|
||||
- name: Terminate redirector instances
|
||||
amazon.aws.ec2_instance:
|
||||
state: absent
|
||||
region: "{{ aws_region }}"
|
||||
filters:
|
||||
"tag:Name": "{{ redirector_name }}"
|
||||
register: redirector_instances_result
|
||||
when: cleanup_redirector | default(true) | bool
|
||||
|
||||
- name: Exit if not confirmed
|
||||
meta: end_play
|
||||
when: confirm_cleanup and confirmation.user_input != 'yes'
|
||||
|
||||
# Find EC2 instances
|
||||
- name: Find redirector instance ID
|
||||
command: >
|
||||
aws ec2 describe-instances
|
||||
--filters "Name=tag:Name,Values={{ redirector_name }}"
|
||||
--query "Reservations[*].Instances[*].InstanceId"
|
||||
--output text
|
||||
--region {{ aws_region }}
|
||||
environment:
|
||||
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
||||
register: redirector_id_result
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
when: cleanup_redirector
|
||||
|
||||
- name: Find C2 instance ID
|
||||
command: >
|
||||
aws ec2 describe-instances
|
||||
--filters "Name=tag:Name,Values={{ c2_name }}"
|
||||
--query "Reservations[*].Instances[*].InstanceId"
|
||||
--output text
|
||||
--region {{ aws_region }}
|
||||
environment:
|
||||
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
||||
register: c2_id_result
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
when: cleanup_c2
|
||||
|
||||
- name: Set instance IDs as facts
|
||||
set_fact:
|
||||
redirector_instance_id: "{{ redirector_id_result.stdout | trim }}"
|
||||
cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [redirector_id_result.stdout | trim]}, recursive=True) }}"
|
||||
when: cleanup_redirector and redirector_id_result.stdout is defined and redirector_id_result.stdout | trim != ""
|
||||
|
||||
- name: Set C2 instance ID as fact
|
||||
set_fact:
|
||||
c2_instance_id: "{{ c2_id_result.stdout | trim }}"
|
||||
cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [c2_id_result.stdout | trim]}, recursive=True) }}"
|
||||
when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != ""
|
||||
|
||||
# Terminate EC2 instances
|
||||
- name: Terminate redirector instance
|
||||
# Tracker cleanup
|
||||
- name: Terminate tracker instances
|
||||
amazon.aws.ec2_instance:
|
||||
state: absent
|
||||
instance_ids:
|
||||
- "{{ redirector_instance_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
aws_access_key: "{{ aws_access_key }}"
|
||||
aws_secret_key: "{{ aws_secret_key }}"
|
||||
when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != ""
|
||||
register: redirector_termination
|
||||
|
||||
- name: Terminate C2 instance
|
||||
amazon.aws.ec2_instance:
|
||||
state: absent
|
||||
instance_ids:
|
||||
- "{{ c2_instance_id }}"
|
||||
region: "{{ aws_region }}"
|
||||
aws_access_key: "{{ aws_access_key }}"
|
||||
aws_secret_key: "{{ aws_secret_key }}"
|
||||
when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != ""
|
||||
register: c2_termination
|
||||
|
||||
- name: Wait for instances to be fully terminated
|
||||
filters:
|
||||
"tag:Name": "{{ tracker_name | default('t-' + deployment_id) }}"
|
||||
register: tracker_instances_result
|
||||
when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool
|
||||
|
||||
# We need to wait a bit for instances to terminate before we can clean up security groups
|
||||
- name: Wait for instances to terminate
|
||||
pause:
|
||||
seconds: 30
|
||||
when:
|
||||
- (redirector_termination is defined and redirector_termination.changed) or
|
||||
(c2_termination is defined and c2_termination.changed)
|
||||
|
||||
# Find VPCs
|
||||
- name: Find VPCs by redirector name
|
||||
command: >
|
||||
aws ec2 describe-vpcs
|
||||
--filters "Name=tag:Name,Values=*{{ redirector_name }}*"
|
||||
--query "Vpcs[].VpcId"
|
||||
--output text
|
||||
--region {{ aws_region }}
|
||||
environment:
|
||||
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
||||
register: redirector_vpcs
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
when: cleanup_redirector
|
||||
|
||||
- name: Find VPCs by C2 name
|
||||
command: >
|
||||
aws ec2 describe-vpcs
|
||||
--filters "Name=tag:Name,Values=*{{ c2_name }}*"
|
||||
--query "Vpcs[].VpcId"
|
||||
--output text
|
||||
--region {{ aws_region }}
|
||||
environment:
|
||||
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
||||
register: c2_vpcs
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
when: cleanup_c2
|
||||
|
||||
- name: Combine VPC IDs into a list
|
||||
set_fact:
|
||||
vpc_ids: "{{ ((redirector_vpcs.stdout | default('') | trim | split('\n') | select('string') | list) +
|
||||
(c2_vpcs.stdout | default('') | trim | split('\n') | select('string') | list)) | unique }}"
|
||||
when: (redirector_vpcs.stdout | default('') | trim != '') or (c2_vpcs.stdout | default('') | trim != '')
|
||||
|
||||
- name: Find shared infrastructure resources by deployment ID
|
||||
command: >
|
||||
aws ec2 describe-vpcs
|
||||
--filters "Name=tag:deployment_id,Values={{ deployment_id }}"
|
||||
--query "Vpcs[].VpcId"
|
||||
--output text
|
||||
--region {{ aws_region }}
|
||||
environment:
|
||||
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
||||
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
||||
register: infra_vpcs
|
||||
failed_when: false
|
||||
changed_when: false
|
||||
|
||||
- name: Add shared infrastructure VPCs to cleanup list
|
||||
set_fact:
|
||||
vpc_ids: "{{ vpc_ids | default([]) + (infra_vpcs.stdout | default('') | trim | split('\n') | select('string') | list) }}"
|
||||
when: infra_vpcs.stdout | default('') | trim != ''
|
||||
when: cleanup_c2 | default(true) | bool or cleanup_redirector | default(true) | bool or (cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool)
|
||||
|
||||
- name: Remove infrastructure state file if it exists
|
||||
file:
|
||||
path: "infrastructure_state.json"
|
||||
state: absent
|
||||
|
||||
# Process each VPC
|
||||
- name: Process each VPC
|
||||
include_tasks: process_vpc.yml
|
||||
loop: "{{ vpc_ids | default([]) }}"
|
||||
loop_control:
|
||||
loop_var: vpc_id
|
||||
when: vpc_ids is defined and vpc_ids | length > 0
|
||||
|
||||
# Delete key pairs
|
||||
- name: Delete redirector key pair
|
||||
amazon.aws.ec2_key:
|
||||
name: "{{ redirector_name }}"
|
||||
state: absent
|
||||
region: "{{ aws_region }}"
|
||||
aws_access_key: "{{ aws_access_key }}"
|
||||
aws_secret_key: "{{ aws_secret_key }}"
|
||||
when: cleanup_redirector and redirector_name is defined and redirector_name != ""
|
||||
register: redirector_key_deleted
|
||||
|
||||
- name: Delete C2 key pair
|
||||
- name: Delete C2 EC2 key pair
|
||||
amazon.aws.ec2_key:
|
||||
name: "{{ c2_name }}"
|
||||
state: absent
|
||||
region: "{{ aws_region }}"
|
||||
aws_access_key: "{{ aws_access_key }}"
|
||||
aws_secret_key: "{{ aws_secret_key }}"
|
||||
when: cleanup_c2 and c2_name is defined and c2_name != ""
|
||||
register: c2_key_deleted
|
||||
|
||||
- name: Track deleted key pairs for redirector
|
||||
set_fact:
|
||||
cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [redirector_name]}, recursive=True) }}"
|
||||
when: redirector_key_deleted is defined and redirector_key_deleted.changed
|
||||
|
||||
- name: Track deleted key pairs for C2
|
||||
set_fact:
|
||||
cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [c2_name]}, recursive=True) }}"
|
||||
when: c2_key_deleted is defined and c2_key_deleted.changed
|
||||
|
||||
# Remove local key files
|
||||
- name: Remove redirector SSH key file
|
||||
file:
|
||||
path: "~/.ssh/{{ redirector_name }}.pem"
|
||||
state: absent
|
||||
when: cleanup_redirector and redirector_name is defined and redirector_name != ""
|
||||
|
||||
- name: Remove C2 SSH key file
|
||||
file:
|
||||
path: "~/.ssh/{{ c2_name }}.pem"
|
||||
register: c2_key_result
|
||||
when: cleanup_c2 | default(true) | bool
|
||||
|
||||
- name: Delete redirector EC2 key pair
|
||||
amazon.aws.ec2_key:
|
||||
name: "{{ redirector_name }}"
|
||||
region: "{{ aws_region }}"
|
||||
state: absent
|
||||
when: cleanup_c2 and c2_name is defined and c2_name != ""
|
||||
|
||||
# Summary of cleanup
|
||||
- name: Cleanup complete message
|
||||
register: redirector_key_result
|
||||
when: cleanup_redirector | default(true) | bool
|
||||
|
||||
- name: Delete tracker EC2 key pair
|
||||
amazon.aws.ec2_key:
|
||||
name: "{{ tracker_name | default('t-' + deployment_id) }}"
|
||||
region: "{{ aws_region }}"
|
||||
state: absent
|
||||
register: tracker_key_result
|
||||
when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool
|
||||
|
||||
# Security Groups
|
||||
- name: Delete C2 security group
|
||||
amazon.aws.ec2_security_group:
|
||||
name: "{{ c2_name }}-sg"
|
||||
region: "{{ aws_region }}"
|
||||
state: absent
|
||||
register: c2_sg_result
|
||||
ignore_errors: yes
|
||||
when: cleanup_c2 | default(true) | bool
|
||||
|
||||
- name: Delete redirector security group
|
||||
amazon.aws.ec2_security_group:
|
||||
name: "{{ redirector_name }}-sg"
|
||||
region: "{{ aws_region }}"
|
||||
state: absent
|
||||
register: redirector_sg_result
|
||||
ignore_errors: yes
|
||||
when: cleanup_redirector | default(true) | bool
|
||||
|
||||
- name: Delete tracker security group
|
||||
amazon.aws.ec2_security_group:
|
||||
name: "{{ tracker_name | default('t-' + deployment_id) }}-sg"
|
||||
region: "{{ aws_region }}"
|
||||
state: absent
|
||||
register: tracker_sg_result
|
||||
ignore_errors: yes
|
||||
when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool
|
||||
|
||||
# VPC Resources
|
||||
- name: Get VPCs
|
||||
amazon.aws.ec2_vpc_net_info:
|
||||
region: "{{ aws_region }}"
|
||||
filters:
|
||||
"tag:deployment_id": "{{ deployment_id }}"
|
||||
register: vpc_info
|
||||
|
||||
- name: Get subnets
|
||||
amazon.aws.ec2_vpc_subnet_info:
|
||||
region: "{{ aws_region }}"
|
||||
filters:
|
||||
"tag:deployment_id": "{{ deployment_id }}"
|
||||
register: subnet_info
|
||||
|
||||
- name: Get route tables
|
||||
amazon.aws.ec2_vpc_route_table_info:
|
||||
region: "{{ aws_region }}"
|
||||
filters:
|
||||
"tag:deployment_id": "{{ deployment_id }}"
|
||||
register: route_table_info
|
||||
|
||||
- name: Get internet gateways
|
||||
amazon.aws.ec2_vpc_igw_info:
|
||||
region: "{{ aws_region }}"
|
||||
filters:
|
||||
"tag:deployment_id": "{{ deployment_id }}"
|
||||
register: igw_info
|
||||
|
||||
# Get and delete any remaining network interfaces in these VPCs
|
||||
- name: Get network interfaces in VPCs
|
||||
amazon.aws.ec2_eni_info:
|
||||
region: "{{ aws_region }}"
|
||||
filters:
|
||||
vpc-id: "{{ item.vpc_id }}"
|
||||
loop: "{{ vpc_info.vpcs }}"
|
||||
register: eni_info
|
||||
|
||||
- name: Delete network interfaces
|
||||
amazon.aws.ec2_eni:
|
||||
region: "{{ aws_region }}"
|
||||
eni_id: "{{ item.1.network_interface_id }}"
|
||||
state: absent
|
||||
force_detach: true
|
||||
loop: "{{ eni_info.results | subelements('network_interfaces', skip_missing=true) }}"
|
||||
register: eni_deleted
|
||||
ignore_errors: yes
|
||||
|
||||
# Delete VPC resources
|
||||
- name: Delete route tables
|
||||
amazon.aws.ec2_vpc_route_table:
|
||||
region: "{{ aws_region }}"
|
||||
vpc_id: "{{ item.vpc_id }}"
|
||||
route_table_id: "{{ item.id }}"
|
||||
state: absent
|
||||
loop: "{{ route_table_info.route_tables }}"
|
||||
register: route_tables_deleted
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Delete internet gateways
|
||||
amazon.aws.ec2_vpc_igw:
|
||||
region: "{{ aws_region }}"
|
||||
vpc_id: "{{ item.attachments[0].vpc_id }}"
|
||||
state: absent
|
||||
loop: "{{ igw_info.internet_gateways }}"
|
||||
register: igws_deleted
|
||||
ignore_errors: yes
|
||||
|
||||
- name: Delete subnets
|
||||
amazon.aws.ec2_vpc_subnet:
|
||||
region: "{{ aws_region }}"
|
||||
vpc_id: "{{ item.vpc_id }}"
|
||||
cidr: "{{ item.cidr_block }}"
|
||||
state: absent
|
||||
loop: "{{ subnet_info.subnets }}"
|
||||
register: subnets_deleted
|
||||
ignore_errors: yes
|
||||
|
||||
# Wait before trying to delete VPCs to allow AWS to catch up on dependency deletions
|
||||
- name: Wait for AWS to process subnet and gateway deletions
|
||||
pause:
|
||||
seconds: 15
|
||||
|
||||
- name: Delete VPCs
|
||||
amazon.aws.ec2_vpc_net:
|
||||
region: "{{ aws_region }}"
|
||||
vpc_id: "{{ item.id }}"
|
||||
state: absent
|
||||
loop: "{{ vpc_info.vpcs }}"
|
||||
register: vpcs_deleted
|
||||
ignore_errors: yes
|
||||
|
||||
# Create summary of deleted resources
|
||||
- name: Collect all deleted resources
|
||||
set_fact:
|
||||
resource_summary:
|
||||
ec2_instances:
|
||||
c2: "{{ c2_instances_result.instance_ids | default([]) }}"
|
||||
redirector: "{{ redirector_instances_result.instance_ids | default([]) }}"
|
||||
tracker: "{{ tracker_instances_result.instance_ids | default([]) }}"
|
||||
key_pairs:
|
||||
c2: "{{ c2_key_result.key.name | default('') | ternary([c2_key_result.key.name], []) }}"
|
||||
redirector: "{{ redirector_key_result.key.name | default('') | ternary([redirector_key_result.key.name], []) }}"
|
||||
tracker: "{{ tracker_key_result.key.name | default('') | ternary([tracker_key_result.key.name], []) }}"
|
||||
security_groups:
|
||||
c2: "{{ c2_sg_result.group_id | default('') | ternary([c2_sg_result.group_id], []) }}"
|
||||
redirector: "{{ redirector_sg_result.group_id | default('') | ternary([redirector_sg_result.group_id], []) }}"
|
||||
tracker: "{{ tracker_sg_result.group_id | default('') | ternary([tracker_sg_result.group_id], []) }}"
|
||||
vpc_resources:
|
||||
route_tables: "{{ route_tables_deleted.results | default([]) | map(attribute='item.id', default='') | select() | list }}"
|
||||
internet_gateways: "{{ igws_deleted.results | default([]) | map(attribute='gateway_id', default='') | select() | list }}"
|
||||
subnets: "{{ subnets_deleted.results | default([]) | map(attribute='subnet.id', default='') | select() | list }}"
|
||||
network_interfaces: "{{ eni_deleted.results | default([]) | map(attribute='interface.id', default='') | select() | list }}"
|
||||
vpcs: "{{ vpcs_deleted.results | default([]) | map(attribute='vpc.id', default='') | select() | list }}"
|
||||
when: not disable_summary | default(false)
|
||||
|
||||
# Display summary of deleted resources
|
||||
- name: Display cleanup summary
|
||||
debug:
|
||||
msg:
|
||||
- "AWS infrastructure cleanup complete!"
|
||||
- "Resources that were cleaned up:"
|
||||
- "- Instances: {{ cleaned_resources.instances | length }} {{ cleaned_resources.instances | join(', ') }}"
|
||||
- "- Security Groups: {{ cleaned_resources.security_groups | length }} {{ cleaned_resources.security_groups | join(', ') }}"
|
||||
- "- Internet Gateways: {{ cleaned_resources.internet_gateways | length }} {{ cleaned_resources.internet_gateways | join(', ') }}"
|
||||
- "- Subnets: {{ cleaned_resources.subnets | length }} {{ cleaned_resources.subnets | join(', ') }}"
|
||||
- "- Route Tables: {{ cleaned_resources.route_tables | length }} {{ cleaned_resources.route_tables | join(', ') }}"
|
||||
- "- VPCs: {{ cleaned_resources.vpcs | length }} {{ cleaned_resources.vpcs | join(', ') }}"
|
||||
- "- Key Pairs: {{ cleaned_resources.key_pairs | length }} {{ cleaned_resources.key_pairs | join(', ') }}"
|
||||
- "=========================================================="
|
||||
- "CLEANUP SUMMARY FOR DEPLOYMENT ID: {{ deployment_id }}"
|
||||
- "=========================================================="
|
||||
- "EC2 INSTANCES DELETED:"
|
||||
- " C2: {{ resource_summary.ec2_instances.c2 }}"
|
||||
- " Redirector: {{ resource_summary.ec2_instances.redirector }}"
|
||||
- " Tracker: {{ resource_summary.ec2_instances.tracker }}"
|
||||
- ""
|
||||
- "KEY PAIRS DELETED:"
|
||||
- " C2: {{ resource_summary.key_pairs.c2 }}"
|
||||
- " Redirector: {{ resource_summary.key_pairs.redirector }}"
|
||||
- " Tracker: {{ resource_summary.key_pairs.tracker }}"
|
||||
- ""
|
||||
- "SECURITY GROUPS DELETED:"
|
||||
- " C2: {{ resource_summary.security_groups.c2 }}"
|
||||
- " Redirector: {{ resource_summary.security_groups.redirector }}"
|
||||
- " Tracker: {{ resource_summary.security_groups.tracker }}"
|
||||
- ""
|
||||
- "VPC RESOURCES DELETED:"
|
||||
- " Route Tables: {{ resource_summary.vpc_resources.route_tables }}"
|
||||
- " Internet Gateways: {{ resource_summary.vpc_resources.internet_gateways }}"
|
||||
- " Subnets: {{ resource_summary.vpc_resources.subnets }}"
|
||||
- " Network Interfaces: {{ resource_summary.vpc_resources.network_interfaces }}"
|
||||
- " VPCs: {{ resource_summary.vpc_resources.vpcs }}"
|
||||
- "=========================================================="
|
||||
when: not disable_summary | default(false)
|
||||
Reference in New Issue
Block a user