working on aws

AWS/cleanup.yml

@@ -32,6 +32,7 @@
       meta: end_play
       when: confirm_cleanup and confirmation.user_input != 'yes'
 
+    # Find instance IDs for cleanup
     - name: Find redirector instance ID
       command: >
         aws ec2 describe-instances
@@ -72,196 +73,118 @@
         c2_instance_id: "{{ c2_id_result.stdout | trim }}"
       when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != ""
 
-    - name: Get information about the redirector security group
+    # Find VPCs with specific redirector tag
-      amazon.aws.ec2_security_group_info:
+    - name: Find VPCs with specific redirector tag
-        filters:
-          tag:redirector_name: "{{ redirector_name }}"
-        region: "{{ aws_region }}"
-      register: sg_info
-      ignore_errors: yes
-      when: cleanup_redirector | bool
-
-    - name: Get information about the VPC
       amazon.aws.ec2_vpc_net_info:
-        filters:
-          tag:redirector_name: "{{ redirector_name }}"
         region: "{{ aws_region }}"
-      register: vpc_info
-      ignore_errors: yes
-      when: cleanup_redirector | bool
-
-    - name: Get subnet information
-      amazon.aws.ec2_vpc_subnet_info:
         filters:
-          tag:redirector_name: "{{ redirector_name }}"
+          "tag:redirector_name": "{{ redirector_name }}"
-        region: "{{ aws_region }}"
+      register: tagged_vpcs_info
-      register: subnet_info
+      when: cleanup_redirector | default(false) | bool
-      ignore_errors: yes
-      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0
 
-    - name: Get internet gateway information
+    - name: Display matched VPCs for cleanup
-      amazon.aws.ec2_vpc_igw_info:
+      debug:
-        filters:
+        msg: "Found {{ tagged_vpcs_info.vpcs | default([]) | length }} VPCs with tag redirector_name={{ redirector_name }} to clean up"
-          tag:redirector_name: "{{ redirector_name }}"
+      when: cleanup_redirector | default(false) | bool and tagged_vpcs_info is defined
-        region: "{{ aws_region }}"
-      register: igw_info
-      ignore_errors: yes
-      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0
 
-    - name: Get route table information
+    - name: Clean up each VPC and its dependencies
-      amazon.aws.ec2_vpc_route_table_info:
-        filters:
-          tag:redirector_name: "{{ redirector_name }}"
-        region: "{{ aws_region }}"
-      register: rtb_info
-      ignore_errors: yes
-      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0
-
-    - name: Ensure all internet gateways are detached and deleted
       block:
-        - name: Get all internet gateways for the VPC
+        - name: Get all subnets for target VPC
-          command: >
+          amazon.aws.ec2_vpc_subnet_info:
-            aws ec2 describe-internet-gateways 
+            filters:
-            --region {{ aws_region }} 
+              vpc-id: "{{ item.id }}"
-            --filters "Name=attachment.vpc-id,Values={{ vpc_info.vpcs[0].id }}" 
+              "tag:redirector_name": "{{ redirector_name }}"
-            --query "InternetGateways[*].InternetGatewayId" 
+            region: "{{ aws_region }}"
-            --output text
+          register: vpc_subnets
-          environment:
+          with_items: "{{ tagged_vpcs_info.vpcs }}"
-            AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
+          
-            AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
+        - name: Get all internet gateways for target VPC
-          register: igw_ids
+          amazon.aws.ec2_vpc_igw_info:
-          when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0
+            filters:
+              attachment.vpc-id: "{{ item.id }}"
+            region: "{{ aws_region }}"
+          register: vpc_igws
+          with_items: "{{ tagged_vpcs_info.vpcs }}"
+          
+        - name: Get all route tables for target VPC
+          amazon.aws.ec2_vpc_route_table_info:
+            filters:
+              vpc-id: "{{ item.id }}"
+              "tag:redirector_name": "{{ redirector_name }}"
+            region: "{{ aws_region }}"
+          register: vpc_route_tables
+          with_items: "{{ tagged_vpcs_info.vpcs }}"
+        
+        - name: Get security groups for target VPC
+          amazon.aws.ec2_security_group_info:
+            filters:
+              vpc-id: "{{ item.id }}"
+              group-name: "{{ redirector_name }}-sg"
+            region: "{{ aws_region }}"
+          register: vpc_security_groups
+          with_items: "{{ tagged_vpcs_info.vpcs }}"
+        
+        # Start deleting resources in proper dependency order
+        - name: Delete non-main route tables
+          amazon.aws.ec2_vpc_route_table:
+            route_table_id: "{{ item.route_table_id }}"
+            region: "{{ aws_region }}"
+            state: absent
+          loop: "{{ vpc_route_tables.results | map(attribute='route_tables') | flatten | selectattr('associations', 'defined') | list }}"
+          ignore_errors: yes
         
         - name: Detach internet gateways
-          command: >
+          shell: >
             aws ec2 detach-internet-gateway 
             --region {{ aws_region }} 
-            --internet-gateway-id {{ item }} 
+            --internet-gateway-id {{ item.internet_gateway_id }} 
-            --vpc-id {{ vpc_info.vpcs[0].id }}
+            --vpc-id {{ item.attachments[0].vpc_id }}
           environment:
             AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
             AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
-          with_items: "{{ igw_ids.stdout_lines | default([]) }}"
+          loop: "{{ vpc_igws.results | map(attribute='internet_gateways') | flatten | selectattr('attachments', 'defined') | list }}"
-          when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 and igw_ids.stdout != ""
           ignore_errors: yes
         
         - name: Delete internet gateways
-          command: >
+          amazon.aws.ec2_vpc_igw:
-            aws ec2 delete-internet-gateway 
+            igw_id: "{{ item.internet_gateway_id }}"
-            --region {{ aws_region }} 
-            --internet-gateway-id {{ item }}
-          environment:
-            AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
-            AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
-          with_items: "{{ igw_ids.stdout_lines | default([]) }}"
-          when: igw_ids.stdout is defined and igw_ids.stdout != ""
-          ignore_errors: yes
-      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0
-      ignore_errors: yes
-
-    # Add this task to the cleanup script to get all VPCs with redirector tags
-    - name: Get all VPCs with redirector tags
-      amazon.aws.ec2_vpc_net_info:
-        region: "{{ aws_region }}"
-      register: all_vpcs_info
-      
-    # Add a task to identify VPCs to cleanup based on tags
-    - name: Identify redirector VPCs for cleanup
-      set_fact:
-        vpcs_to_cleanup: "{{ all_vpcs_info.vpcs | selectattr('tags.redirector_name', 'defined') | list }}"
-      when: all_vpcs_info.vpcs is defined
-      
-    # Enhanced VPC deletion with better dependency handling
-    - name: Delete all VPC resources
-      block:
-        - name: Delete associated subnets
-          amazon.aws.ec2_vpc_subnet:
-            vpc_id: "{{ item.id }}"
-            state: absent
             region: "{{ aws_region }}"
-          with_items: "{{ vpcs_to_cleanup }}"
+            state: absent
+          loop: "{{ vpc_igws.results | map(attribute='internet_gateways') | flatten | list }}"
           ignore_errors: yes
         
-        - name: Ensure all internet gateways are detached
+        - name: Delete subnets
-          shell: >
+          amazon.aws.ec2_vpc_subnet:
-            aws ec2 describe-internet-gateways --region {{ aws_region }} --filters "Name=attachment.vpc-id,Values={{ item.id }}" --query "InternetGateways[*].InternetGatewayId" --output text | 
+            subnet_id: "{{ item.subnet_id }}"
-            xargs -I % aws ec2 detach-internet-gateway --region {{ aws_region }} --internet-gateway-id % --vpc-id {{ item.id }}
+            region: "{{ aws_region }}"
-          with_items: "{{ vpcs_to_cleanup }}"
+            state: absent
+          loop: "{{ vpc_subnets.results | map(attribute='subnets') | flatten | list }}"
           ignore_errors: yes
           
-        - name: Delete all VPCs
+        - name: Delete security groups
+          amazon.aws.ec2_security_group:
+            group_id: "{{ item.group_id }}"
+            region: "{{ aws_region }}"
+            state: absent
+          loop: "{{ vpc_security_groups.results | map(attribute='security_groups') | flatten | list }}"
+          ignore_errors: yes
+        
+        - name: Delete VPCs
           amazon.aws.ec2_vpc_net:
             vpc_id: "{{ item.id }}"
-            state: absent
             region: "{{ aws_region }}"
-          with_items: "{{ vpcs_to_cleanup }}"
+            state: absent
+          loop: "{{ tagged_vpcs_info.vpcs }}"
           ignore_errors: yes
-      when: vpcs_to_cleanup is defined and vpcs_to_cleanup | length > 0      
+      when: cleanup_redirector | bool and tagged_vpcs_info is defined and tagged_vpcs_info.vpcs | default([]) | length > 0
-
-    - name: Delete route tables
-      amazon.aws.ec2_vpc_route_table:
-        route_table_id: "{{ item.id }}"
-        region: "{{ aws_region }}"
-        state: absent
-      loop: "{{ rtb_info.route_tables | default([]) }}"
-      ignore_errors: yes
-      when: rtb_info.route_tables is defined and rtb_info.route_tables | length > 0
-
-    - name: Detach internet gateway from VPC
-      amazon.aws.ec2_vpc_igw:
-        vpc_id: "{{ vpc_info.vpcs[0].id }}"
-        region: "{{ aws_region }}"
-        state: absent
-      ignore_errors: yes
-      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 and igw_info.internet_gateways is defined and igw_info.internet_gateways | length > 0
-
-    - name: Delete internet gateway
-      amazon.aws.ec2_vpc_igw:
-        igw_id: "{{ item.id }}"
-        region: "{{ aws_region }}"
-        state: absent
-      loop: "{{ igw_info.internet_gateways | default([]) }}"
-      ignore_errors: yes
-      when: igw_info.internet_gateways is defined and igw_info.internet_gateways | length > 0
-
-    - name: Delete subnets
-      amazon.aws.ec2_vpc_subnet:
-        vpc_id: "{{ vpc_info.vpcs[0].id }}"
-        cidr: "{{ item.cidr_block }}"
-        region: "{{ aws_region }}"
-        state: absent
-      loop: "{{ subnet_info.subnets | default([]) }}"
-      ignore_errors: yes
-      when: subnet_info.subnets is defined and subnet_info.subnets | length > 0
-
-    - name: Delete security groups
-      amazon.aws.ec2_security_group:
-        group_id: "{{ item.group_id }}"
-        region: "{{ aws_region }}"
-        state: absent
-      loop: "{{ sg_info.security_groups | default([]) }}"
-      ignore_errors: yes
-      when: sg_info.security_groups is defined and sg_info.security_groups | length > 0
-
-    - name: Delete VPC
-      amazon.aws.ec2_vpc_net:
-        vpc_id: "{{ vpc_info.vpcs[0].id }}"
-        region: "{{ aws_region }}"
-        state: absent
-      ignore_errors: yes
-      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0
-
-
-
 
+    # Instance, security group, and key pair cleanup
     - name: Terminate redirector instance
       amazon.aws.ec2_instance:
         state: absent
         instance_ids:
           - "{{ redirector_instance_id }}"
         region: "{{ aws_region }}"
-        aws_access_key: "{{ aws_access_key }}"
-        aws_secret_key: "{{ aws_secret_key }}"
       when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != ""
       register: redirector_termination
 
@@ -271,8 +194,6 @@
         instance_ids:
           - "{{ c2_instance_id }}"
         region: "{{ aws_region }}"
-        aws_access_key: "{{ aws_access_key }}"
-        aws_secret_key: "{{ aws_secret_key }}"
       when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != ""
       register: c2_termination
 
@@ -288,8 +209,6 @@
         name: "{{ redirector_name }}-sg"
         state: absent
         region: "{{ aws_region }}"
-        aws_access_key: "{{ aws_access_key }}"
-        aws_secret_key: "{{ aws_secret_key }}"
       ignore_errors: yes
       when: cleanup_redirector and redirector_name is defined and redirector_name != ""
 
@@ -298,8 +217,6 @@
         name: "{{ c2_name }}-sg"
         state: absent
         region: "{{ aws_region }}"
-        aws_access_key: "{{ aws_access_key }}"
-        aws_secret_key: "{{ aws_secret_key }}"
       ignore_errors: yes
       when: cleanup_c2 and c2_name is defined and c2_name != ""
 
@@ -308,8 +225,6 @@
         name: "{{ redirector_name }}"
         state: absent
         region: "{{ aws_region }}"
-        aws_access_key: "{{ aws_access_key }}"
-        aws_secret_key: "{{ aws_secret_key }}"
       when: cleanup_redirector and redirector_name is defined and redirector_name != ""
 
     - name: Delete C2 key pair
@@ -317,8 +232,6 @@
         name: "{{ c2_name }}"
         state: absent
         region: "{{ aws_region }}"
-        aws_access_key: "{{ aws_access_key }}"
-        aws_secret_key: "{{ aws_secret_key }}"
       when: cleanup_c2 and c2_name is defined and c2_name != ""
 
     - name: Remove redirector SSH key file

AWS/redirector.yml

@@ -10,7 +10,6 @@
   vars:
     # Default values for required variables
     ssh_user: "{{ ssh_user | default('kali') }}"
-    aws_region: "{{ aws_region | default(aws_region_choices | random) }}"
     instance_type: "{{ aws_instance_type | default('t2.micro') }}"
     
     # Generate random instance name if not provided
@@ -27,10 +26,17 @@
           - aws_secret_key is defined and aws_secret_key != ""
         fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key."
     
+    # Set a single consistent region variable early
+    - name: Set deployment region
+      set_fact:
+        aws_region: "{{ aws_region | default(aws_region_choices | random if aws_region_choices is defined and aws_region_choices | length > 0 else 'us-east-1') }}"
+    
+    - name: Display selected region
+      debug:
+        msg: "Deploying in AWS region: {{ aws_region }}"
+
     - name: Create EC2 key pair for redirector
       amazon.aws.ec2_key:
-        access_key: "{{ aws_access_key }}"
-        secret_key: "{{ aws_secret_key }}"
         name: "{{ redirector_name }}"
         region: "{{ aws_region }}"
         state: present
@@ -63,7 +69,7 @@
 
     - name: Set VPC ID from existing or newly created VPC
       set_fact:
-        vpc_id: "{{ vpc_id if (vpc_id is defined and vpc_id | length > 0 and vpc_info.vpcs | length > 0) else vpc_result.vpc.id }}"
+        vpc_id: "{{ vpc_id if (vpc_id is defined and vpc_id | length > 0 and vpc_info.vpcs | default([]) | length > 0) else vpc_result.vpc.id }}"
 
     - name: Create internet gateway for VPC
       amazon.aws.ec2_vpc_igw:
@@ -104,27 +110,17 @@
       register: route_table_result
       when: vpc_result.changed | default(false) and igw_result.changed | default(false) and subnet_result.changed | default(false)
 
-    - name: Set region for AWS redirector
-      set_fact:
-        aws_redirector_region: "{{ aws_region | default(region, true) | default('us-east-1', true) }}"
-      when: aws_region_choices is not defined or aws_region_choices|length == 0
-
-    - name: Set random region for AWS redirector
-      set_fact:
-        aws_redirector_region: "{{ aws_region_choices | random }}"
-      when: aws_region_choices is defined and aws_region_choices|length > 0 and aws_redirector_region is not defined
-
     - name: Set AMI ID for the selected region
       set_fact:
-        ami_id: "{{ ami_map[aws_redirector_region] }}"
+        ami_id: "{{ ami_map[aws_region] }}"
-      when: ami_map is defined and aws_redirector_region in ami_map
+      when: ami_map is defined and aws_region in ami_map
 
     - name: Create security group for redirector
       amazon.aws.ec2_security_group:
         name: "{{ redirector_name }}-sg"
         description: "Security group for redirector {{ redirector_name }}"
         vpc_id: "{{ vpc_id }}"
-        region: "{{ aws_redirector_region }}"
+        region: "{{ aws_region }}"
         rules:
           - proto: tcp
             ports:
@@ -145,29 +141,47 @@
         key_name: "{{ redirector_name }}"
         instance_type: "{{ redirector_instance_type | default('t2.micro') }}"
         vpc_subnet_id: "{{ subnet_result.subnet.id | default(omit) }}"
-        security_group_ids: 
+        security_groups:
-          - "{{ security_group.group_id }}"
+          - "{{ redirector_name }}-sg"
         image_id: "{{ ami_id }}"
-        region: "{{ aws_redirector_region }}"
+        region: "{{ aws_region }}"
         state: present
         wait: yes
         tags:
           Name: "{{ redirector_name }}"
-      register: ec2
+          redirector_name: "{{ redirector_name }}"
+          aws_region: "{{ aws_region }}"
+      register: redirector_instance
 
     - name: Set redirector_ip for later use
       set_fact:
         redirector_ip: "{{ redirector_instance.instances[0].public_ip_address }}"
         redirector_instance_id: "{{ redirector_instance.instances[0].instance_id }}"
 
+    # Added longer wait time for SSH to be available
     - name: Wait for redirector SSH to be available
       wait_for:
         host: "{{ redirector_ip }}"
         port: 22
-        delay: 30
+        delay: 60
         timeout: 300
         state: started
 
+    # Added SSH connection test to verify credentials
+    - name: Test SSH connection to instance
+      command: >
+        ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10
+        -i ~/.ssh/{{ redirector_name }}.pem {{ ssh_user }}@{{ redirector_ip }} echo "SSH connection test"
+      register: ssh_test
+      retries: 5
+      delay: 20
+      until: ssh_test.rc == 0
+      ignore_errors: yes
+
+    - name: Display SSH connection status
+      debug:
+        msg: "{{ 'SSH connection successful' if ssh_test.rc == 0 else 'SSH connection failed - check key permissions' }}"
+
     - name: Add redirector to inventory
       add_host:
         name: "redirector"