From f6d08e84eb0e39ed5836753887437574c03b8b0e Mon Sep 17 00:00:00 2001 From: n0mad1k Date: Fri, 2 May 2025 12:06:09 -0400 Subject: [PATCH] still working on aws --- AWS/c2.yml | 113 +++++++++++++++++----- AWS/cleanup.yml | 213 +++++++++++++++++------------------------ AWS/infrastructure.yml | 92 ++++++++++++++++++ AWS/process_vpc.yml | 206 +++++++++++++++++++++++++++++++++++++++ AWS/redirector.yml | 125 +++++++----------------- 5 files changed, 510 insertions(+), 239 deletions(-) create mode 100644 AWS/infrastructure.yml create mode 100644 AWS/process_vpc.yml diff --git a/AWS/c2.yml b/AWS/c2.yml index e7ff45c..30afa85 100644 --- a/AWS/c2.yml +++ b/AWS/c2.yml @@ -1,5 +1,6 @@ + --- -# AWS C2 Deployment Playbook +# AWS C2 Deployment Playbook (Fixed) - name: Deploy AWS C2 server hosts: localhost @@ -23,13 +24,23 @@ - aws_access_key is defined and aws_access_key != "" - aws_secret_key is defined and aws_secret_key != "" fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key." + + # Select the region first - CRITICAL FIX + - name: Set region for AWS C2 server + set_fact: + aws_c2_region: "{{ aws_region | default(aws_region_choices | random if aws_region_choices is defined else 'us-east-1') }}" + + - name: Set AMI ID for the selected region + set_fact: + ami_id: "{{ ami_map[aws_c2_region] }}" + when: ami_map is defined and aws_c2_region in ami_map - name: Create EC2 key pair for C2 amazon.aws.ec2_key: access_key: "{{ aws_access_key }}" secret_key: "{{ aws_secret_key }}" name: "{{ c2_name }}" - region: "{{ aws_region }}" + region: "{{ aws_c2_region }}" state: present register: c2_key_pair @@ -40,12 +51,68 @@ mode: "0600" when: c2_key_pair.changed and c2_key_pair.key.private_key is defined + - name: Create VPC + amazon.aws.ec2_vpc_net: + name: "{{ c2_name }}-vpc" + cidr_block: "10.0.0.0/16" + region: "{{ aws_c2_region }}" + tags: + Name: "{{ c2_name }}-vpc" + c2_name: "{{ c2_name }}" + state: present + register: vpc_result + + - name: Store VPC ID + set_fact: + vpc_id: "{{ vpc_result.vpc.id }}" + + - name: Wait for VPC to be fully available + pause: + seconds: 10 + when: vpc_result.changed + + - name: Create internet gateway for VPC + amazon.aws.ec2_vpc_igw: + vpc_id: "{{ vpc_id }}" + region: "{{ aws_c2_region }}" + state: present + tags: + Name: "{{ c2_name }}-igw" + c2_name: "{{ c2_name }}" + register: igw_result + + - name: Create subnet in VPC + amazon.aws.ec2_vpc_subnet: + vpc_id: "{{ vpc_id }}" + cidr: "10.0.1.0/24" + region: "{{ aws_c2_region }}" + az: "{{ aws_c2_region }}a" + map_public: yes + tags: + Name: "{{ c2_name }}-subnet" + c2_name: "{{ c2_name }}" + register: subnet_result + + - name: Create routing table for internet access + amazon.aws.ec2_vpc_route_table: + vpc_id: "{{ vpc_id }}" + region: "{{ aws_c2_region }}" + tags: + Name: "{{ c2_name }}-rtb" + c2_name: "{{ c2_name }}" + routes: + - dest: "0.0.0.0/0" + gateway_id: "{{ igw_result.gateway_id }}" + subnets: + - "{{ subnet_result.subnet.id }}" + register: route_table_result + - name: Create a security group for the C2 server amazon.aws.ec2_security_group: name: "{{ c2_name }}-sg" description: "Security group for C2 server {{ c2_name }}" vpc_id: "{{ vpc_id }}" - region: "{{ aws_region }}" + region: "{{ aws_c2_region }}" rules: - proto: tcp ports: @@ -63,40 +130,37 @@ state: present register: security_group - - name: Set region for AWS C2 server - set_fact: - aws_c2_region: "{{ aws_region | default(region, true) | default('us-east-1', true) }}" - when: aws_region_choices is not defined or aws_region_choices|length == 0 - - - name: Set random region for AWS C2 server - set_fact: - aws_c2_region: "{{ aws_region_choices | random }}" - when: aws_region_choices is defined and aws_region_choices|length > 0 and aws_c2_region is not defined - - - name: Set AMI ID for the selected region - set_fact: - ami_id: "{{ ami_map[aws_redirector_region] }}" - when: ami_map is defined and aws_redirector_region in ami_map - - name: Launch EC2 instance for C2 server amazon.aws.ec2_instance: name: "{{ c2_name }}" - key_name: "{{ aws_keypair_name }}" + key_name: "{{ c2_name }}" instance_type: "{{ instance_type | default('t2.medium') }}" - security_group: "{{ c2_name }}-sg" + vpc_subnet_id: "{{ subnet_result.subnet.id }}" + security_groups: + - "{{ security_group.group_id }}" image_id: "{{ ami_id }}" region: "{{ aws_c2_region }}" state: present wait: yes + volumes: + - device_name: "/dev/xvda" + ebs: + volume_size: 100 + delete_on_termination: true tags: Name: "{{ c2_name }}" - register: ec2 + register: c2_instance - name: Set c2_ip for later use set_fact: c2_ip: "{{ c2_instance.instances[0].public_ip_address }}" c2_instance_id: "{{ c2_instance.instances[0].instance_id }}" + - name: Wait for C2 instance initialization (longer delay) + pause: + seconds: 180 + when: c2_instance.changed + - name: Wait for C2 SSH to be available wait_for: host: "{{ c2_ip }}" @@ -105,6 +169,11 @@ timeout: 300 state: started + - name: Set correct permissions on SSH key + file: + path: "~/.ssh/{{ c2_name }}.pem" + mode: "0600" + - name: Add C2 to inventory add_host: name: "c2" @@ -112,7 +181,7 @@ ansible_host: "{{ c2_ip }}" ansible_user: "{{ ssh_user }}" ansible_ssh_private_key_file: "~/.ssh/{{ c2_name }}.pem" - ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" + ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes" - name: Configure C2 server hosts: c2servers diff --git a/AWS/cleanup.yml b/AWS/cleanup.yml index bded934..ec57cd7 100644 --- a/AWS/cleanup.yml +++ b/AWS/cleanup.yml @@ -1,6 +1,5 @@ --- -# AWS Cleanup Playbook -# Used to tear down AWS infrastructure +# AWS Cleanup Playbook (Fixed) - name: Clean up AWS infrastructure hosts: localhost @@ -13,6 +12,16 @@ cleanup_redirector: "{{ (redirector_name is defined and redirector_name != '') | ternary(true, false) }}" cleanup_c2: "{{ (c2_name is defined and c2_name != '') | ternary(true, false) }}" confirm_cleanup: "{{ confirm_cleanup | default(true) }}" + delay_seconds: 30 + # Initialize cleaned resources list + cleaned_resources: + instances: [] + security_groups: [] + key_pairs: [] + internet_gateways: [] + subnets: [] + route_tables: [] + vpcs: [] tasks: - name: Validate required AWS credentials @@ -32,7 +41,7 @@ meta: end_play when: confirm_cleanup and confirmation.user_input != 'yes' - # Find instance IDs for cleanup + # Find EC2 instances - name: Find redirector instance ID command: > aws ec2 describe-instances @@ -66,125 +75,24 @@ - name: Set instance IDs as facts set_fact: redirector_instance_id: "{{ redirector_id_result.stdout | trim }}" + cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [redirector_id_result.stdout | trim]}, recursive=True) }}" when: cleanup_redirector and redirector_id_result.stdout is defined and redirector_id_result.stdout | trim != "" - name: Set C2 instance ID as fact set_fact: c2_instance_id: "{{ c2_id_result.stdout | trim }}" + cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [c2_id_result.stdout | trim]}, recursive=True) }}" when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != "" - # Find VPCs with specific redirector tag - - name: Find VPCs with specific redirector tag - amazon.aws.ec2_vpc_net_info: - region: "{{ aws_region }}" - filters: - "tag:redirector_name": "{{ redirector_name }}" - register: tagged_vpcs_info - when: cleanup_redirector | default(false) | bool - - - name: Display matched VPCs for cleanup - debug: - msg: "Found {{ tagged_vpcs_info.vpcs | default([]) | length }} VPCs with tag redirector_name={{ redirector_name }} to clean up" - when: cleanup_redirector | default(false) | bool and tagged_vpcs_info is defined - - - name: Clean up each VPC and its dependencies - block: - - name: Get all subnets for target VPC - amazon.aws.ec2_vpc_subnet_info: - filters: - vpc-id: "{{ item.id }}" - "tag:redirector_name": "{{ redirector_name }}" - region: "{{ aws_region }}" - register: vpc_subnets - with_items: "{{ tagged_vpcs_info.vpcs }}" - - - name: Get all internet gateways for target VPC - amazon.aws.ec2_vpc_igw_info: - filters: - attachment.vpc-id: "{{ item.id }}" - region: "{{ aws_region }}" - register: vpc_igws - with_items: "{{ tagged_vpcs_info.vpcs }}" - - - name: Get all route tables for target VPC - amazon.aws.ec2_vpc_route_table_info: - filters: - vpc-id: "{{ item.id }}" - "tag:redirector_name": "{{ redirector_name }}" - region: "{{ aws_region }}" - register: vpc_route_tables - with_items: "{{ tagged_vpcs_info.vpcs }}" - - - name: Get security groups for target VPC - amazon.aws.ec2_security_group_info: - filters: - vpc-id: "{{ item.id }}" - group-name: "{{ redirector_name }}-sg" - region: "{{ aws_region }}" - register: vpc_security_groups - with_items: "{{ tagged_vpcs_info.vpcs }}" - - # Start deleting resources in proper dependency order - - name: Delete non-main route tables - amazon.aws.ec2_vpc_route_table: - route_table_id: "{{ item.route_table_id }}" - region: "{{ aws_region }}" - state: absent - loop: "{{ vpc_route_tables.results | map(attribute='route_tables') | flatten | selectattr('associations', 'defined') | list }}" - ignore_errors: yes - - - name: Detach internet gateways - shell: > - aws ec2 detach-internet-gateway - --region {{ aws_region }} - --internet-gateway-id {{ item.internet_gateway_id }} - --vpc-id {{ item.attachments[0].vpc_id }} - environment: - AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" - AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" - loop: "{{ vpc_igws.results | map(attribute='internet_gateways') | flatten | selectattr('attachments', 'defined') | list }}" - ignore_errors: yes - - - name: Delete internet gateways - amazon.aws.ec2_vpc_igw: - igw_id: "{{ item.internet_gateway_id }}" - region: "{{ aws_region }}" - state: absent - loop: "{{ vpc_igws.results | map(attribute='internet_gateways') | flatten | list }}" - ignore_errors: yes - - - name: Delete subnets - amazon.aws.ec2_vpc_subnet: - subnet_id: "{{ item.subnet_id }}" - region: "{{ aws_region }}" - state: absent - loop: "{{ vpc_subnets.results | map(attribute='subnets') | flatten | list }}" - ignore_errors: yes - - - name: Delete security groups - amazon.aws.ec2_security_group: - group_id: "{{ item.group_id }}" - region: "{{ aws_region }}" - state: absent - loop: "{{ vpc_security_groups.results | map(attribute='security_groups') | flatten | list }}" - ignore_errors: yes - - - name: Delete VPCs - amazon.aws.ec2_vpc_net: - vpc_id: "{{ item.id }}" - region: "{{ aws_region }}" - state: absent - loop: "{{ tagged_vpcs_info.vpcs }}" - ignore_errors: yes - when: cleanup_redirector | bool and tagged_vpcs_info is defined and tagged_vpcs_info.vpcs | default([]) | length > 0 - - # Instance, security group, and key pair cleanup + # Terminate EC2 instances - name: Terminate redirector instance amazon.aws.ec2_instance: state: absent instance_ids: - "{{ redirector_instance_id }}" region: "{{ aws_region }}" + aws_access_key: "{{ aws_access_key }}" + aws_secret_key: "{{ aws_secret_key }}" when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != "" register: redirector_termination @@ -194,6 +102,8 @@ instance_ids: - "{{ c2_instance_id }}" region: "{{ aws_region }}" + aws_access_key: "{{ aws_access_key }}" + aws_secret_key: "{{ aws_secret_key }}" when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != "" register: c2_termination @@ -204,36 +114,83 @@ - (redirector_termination is defined and redirector_termination.changed) or (c2_termination is defined and c2_termination.changed) - - name: Delete redirector security group - amazon.aws.ec2_group: - name: "{{ redirector_name }}-sg" - state: absent - region: "{{ aws_region }}" - ignore_errors: yes - when: cleanup_redirector and redirector_name is defined and redirector_name != "" + # Find VPCs + - name: Find VPCs by redirector name + command: > + aws ec2 describe-vpcs + --filters "Name=tag:Name,Values=*{{ redirector_name }}*" + --query "Vpcs[].VpcId" + --output text + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + register: redirector_vpcs + failed_when: false + changed_when: false + when: cleanup_redirector - - name: Delete C2 security group - amazon.aws.ec2_group: - name: "{{ c2_name }}-sg" - state: absent - region: "{{ aws_region }}" - ignore_errors: yes - when: cleanup_c2 and c2_name is defined and c2_name != "" + - name: Find VPCs by C2 name + command: > + aws ec2 describe-vpcs + --filters "Name=tag:Name,Values=*{{ c2_name }}*" + --query "Vpcs[].VpcId" + --output text + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + register: c2_vpcs + failed_when: false + changed_when: false + when: cleanup_c2 + - name: Combine VPC IDs into a list + set_fact: + vpc_ids: "{{ ((redirector_vpcs.stdout | default('') | trim | split('\n') | select('string') | list) + + (c2_vpcs.stdout | default('') | trim | split('\n') | select('string') | list)) | unique }}" + when: (redirector_vpcs.stdout | default('') | trim != '') or (c2_vpcs.stdout | default('') | trim != '') + + # Process each VPC + - name: Process each VPC + include_tasks: process_vpc.yml + loop: "{{ vpc_ids | default([]) }}" + loop_control: + loop_var: vpc_id + when: vpc_ids is defined and vpc_ids | length > 0 + + # Delete key pairs - name: Delete redirector key pair amazon.aws.ec2_key: name: "{{ redirector_name }}" state: absent region: "{{ aws_region }}" + aws_access_key: "{{ aws_access_key }}" + aws_secret_key: "{{ aws_secret_key }}" when: cleanup_redirector and redirector_name is defined and redirector_name != "" + register: redirector_key_deleted - name: Delete C2 key pair amazon.aws.ec2_key: name: "{{ c2_name }}" state: absent region: "{{ aws_region }}" + aws_access_key: "{{ aws_access_key }}" + aws_secret_key: "{{ aws_secret_key }}" when: cleanup_c2 and c2_name is defined and c2_name != "" + register: c2_key_deleted + - name: Track deleted key pairs for redirector + set_fact: + cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [redirector_name]}, recursive=True) }}" + when: redirector_key_deleted is defined and redirector_key_deleted.changed + + - name: Track deleted key pairs for C2 + set_fact: + cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [c2_name]}, recursive=True) }}" + when: c2_key_deleted is defined and c2_key_deleted.changed + + # Remove local key files - name: Remove redirector SSH key file file: path: "~/.ssh/{{ redirector_name }}.pem" @@ -246,10 +203,16 @@ state: absent when: cleanup_c2 and c2_name is defined and c2_name != "" + # Summary of cleanup - name: Cleanup complete message debug: msg: - "AWS infrastructure cleanup complete!" - "Resources that were cleaned up:" - - "{{ cleanup_redirector | ternary('- Redirector instance: ' + redirector_name, '') }}" - - "{{ cleanup_c2 | ternary('- C2 instance: ' + c2_name, '') }}" \ No newline at end of file + - "- Instances: {{ cleaned_resources.instances | length }} {{ cleaned_resources.instances | join(', ') }}" + - "- Security Groups: {{ cleaned_resources.security_groups | length }} {{ cleaned_resources.security_groups | join(', ') }}" + - "- Internet Gateways: {{ cleaned_resources.internet_gateways | length }} {{ cleaned_resources.internet_gateways | join(', ') }}" + - "- Subnets: {{ cleaned_resources.subnets | length }} {{ cleaned_resources.subnets | join(', ') }}" + - "- Route Tables: {{ cleaned_resources.route_tables | length }} {{ cleaned_resources.route_tables | join(', ') }}" + - "- VPCs: {{ cleaned_resources.vpcs | length }} {{ cleaned_resources.vpcs | join(', ') }}" + - "- Key Pairs: {{ cleaned_resources.key_pairs | length }} {{ cleaned_resources.key_pairs | join(', ') }}" \ No newline at end of file diff --git a/AWS/infrastructure.yml b/AWS/infrastructure.yml new file mode 100644 index 0000000..943e5f3 --- /dev/null +++ b/AWS/infrastructure.yml @@ -0,0 +1,92 @@ +--- +# AWS Shared Infrastructure Deployment Playbook + +- name: Deploy shared AWS infrastructure + hosts: localhost + gather_facts: false + connection: local + vars_files: + - vars.yaml + vars: + # Deployment identifiers + deployment_id: "{{ deployment_id | default('') }}" + infra_name: "infra-{{ deployment_id }}" + # Region settings + split_regions: "{{ c2_region is defined and redirector_region is defined and c2_region != redirector_region }}" + deployment_region: "{{ aws_region | default(aws_region_choices | random) }}" + + tasks: + - name: Validate AWS credentials + assert: + that: + - aws_access_key is defined and aws_access_key != "" + - aws_secret_key is defined and aws_secret_key != "" + fail_msg: "AWS credentials are required" + + - name: Skip shared infrastructure if using split regions + meta: end_play + when: split_regions | bool + + - name: Create shared VPC + amazon.aws.ec2_vpc_net: + name: "{{ infra_name }}-vpc" + cidr_block: "10.0.0.0/16" + region: "{{ deployment_region }}" + tags: + Name: "{{ infra_name }}-vpc" + deployment_id: "{{ deployment_id }}" + state: present + register: vpc_result + + - name: Store shared VPC ID + set_fact: + shared_vpc_id: "{{ vpc_result.vpc.id }}" + + - name: Create internet gateway + amazon.aws.ec2_vpc_igw: + vpc_id: "{{ shared_vpc_id }}" + region: "{{ deployment_region }}" + state: present + tags: + Name: "{{ infra_name }}-igw" + deployment_id: "{{ deployment_id }}" + register: igw_result + + - name: Create subnet + amazon.aws.ec2_vpc_subnet: + vpc_id: "{{ shared_vpc_id }}" + cidr: "10.0.1.0/24" + region: "{{ deployment_region }}" + az: "{{ deployment_region }}a" + map_public: yes + tags: + Name: "{{ infra_name }}-subnet" + deployment_id: "{{ deployment_id }}" + register: subnet_result + + - name: Create routing table + amazon.aws.ec2_vpc_route_table: + vpc_id: "{{ shared_vpc_id }}" + region: "{{ deployment_region }}" + tags: + Name: "{{ infra_name }}-rtb" + deployment_id: "{{ deployment_id }}" + routes: + - dest: "0.0.0.0/0" + gateway_id: "{{ igw_result.gateway_id }}" + subnets: + - "{{ subnet_result.subnet.id }}" + register: route_table_result + + - name: Write infrastructure info to state file + copy: + content: | + { + "vpc_id": "{{ shared_vpc_id }}", + "subnet_id": "{{ subnet_result.subnet.id }}", + "igw_id": "{{ igw_result.gateway_id }}", + "region": "{{ deployment_region }}", + "deployment_id": "{{ deployment_id }}" + } + dest: "infrastructure_state.json" + mode: "0600" \ No newline at end of file diff --git a/AWS/process_vpc.yml b/AWS/process_vpc.yml new file mode 100644 index 0000000..2fdff03 --- /dev/null +++ b/AWS/process_vpc.yml @@ -0,0 +1,206 @@ +--- +# VPC Cleanup Process +# Step 1: Route Tables +- name: Find all route tables for VPC {{ vpc_id }} + command: > + aws ec2 describe-route-tables + --filters "Name=vpc-id,Values={{ vpc_id }}" + --query "RouteTables[?Associations[0].Main != `true`].RouteTableId" + --output text + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + register: rt_ids + failed_when: false + changed_when: false + +- name: Process route tables + when: rt_ids.stdout | trim != "" + block: + - name: Find route table associations + command: > + aws ec2 describe-route-tables + --route-table-id {{ item }} + --query "RouteTables[].Associations[].RouteTableAssociationId" + --output text + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + register: rt_assocs + with_items: "{{ rt_ids.stdout.split() }}" + failed_when: false + changed_when: false + + - name: Disassociate route tables + command: > + aws ec2 disassociate-route-table + --association-id {{ item.1 }} + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + with_subelements: + - "{{ rt_assocs.results }}" + - stdout_lines + when: item.0.stdout | trim != "" + failed_when: false + ignore_errors: true + + - name: Delete route tables + command: > + aws ec2 delete-route-table + --route-table-id {{ item }} + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + with_items: "{{ rt_ids.stdout.split() }}" + register: deleted_rts + failed_when: false + ignore_errors: true + + - name: Update cleaned route tables + set_fact: + cleaned_resources: "{{ cleaned_resources | combine({'route_tables': cleaned_resources.route_tables + rt_ids.stdout.split()}, recursive=True) }}" + when: rt_ids.stdout | trim != "" + +# Step 2: Internet Gateways +- name: Find internet gateways for VPC {{ vpc_id }} + command: > + aws ec2 describe-internet-gateways + --filters "Name=attachment.vpc-id,Values={{ vpc_id }}" + --query "InternetGateways[].InternetGatewayId" + --output text + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + register: igw_ids + failed_when: false + changed_when: false + +- name: Process internet gateways + when: igw_ids.stdout | trim != "" + block: + - name: Detach internet gateways + command: > + aws ec2 detach-internet-gateway + --internet-gateway-id {{ item }} + --vpc-id {{ vpc_id }} + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + with_items: "{{ igw_ids.stdout.split() }}" + failed_when: false + ignore_errors: true + + - name: Delete internet gateways + command: > + aws ec2 delete-internet-gateway + --internet-gateway-id {{ item }} + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + with_items: "{{ igw_ids.stdout.split() }}" + register: deleted_igws + failed_when: false + ignore_errors: true + + - name: Update cleaned internet gateways + set_fact: + cleaned_resources: "{{ cleaned_resources | combine({'internet_gateways': cleaned_resources.internet_gateways + igw_ids.stdout.split()}, recursive=True) }}" + when: igw_ids.stdout | trim != "" + +# Step 3: Subnets +- name: Find subnets for VPC {{ vpc_id }} + command: > + aws ec2 describe-subnets + --filters "Name=vpc-id,Values={{ vpc_id }}" + --query "Subnets[].SubnetId" + --output text + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + register: subnet_ids + failed_when: false + changed_when: false + +- name: Delete subnets + command: > + aws ec2 delete-subnet + --subnet-id {{ item }} + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + with_items: "{{ subnet_ids.stdout.split() }}" + register: deleted_subnets + failed_when: false + ignore_errors: true + when: subnet_ids.stdout | trim != "" + +- name: Update cleaned subnets + set_fact: + cleaned_resources: "{{ cleaned_resources | combine({'subnets': cleaned_resources.subnets + subnet_ids.stdout.split()}, recursive=True) }}" + when: subnet_ids.stdout | trim != "" + +# Step 4: Security Groups (except default) +- name: Find non-default security groups for VPC {{ vpc_id }} + command: > + aws ec2 describe-security-groups + --filters "Name=vpc-id,Values={{ vpc_id }}" + --query "SecurityGroups[?GroupName != 'default'].GroupId" + --output text + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + register: sg_ids + failed_when: false + changed_when: false + +- name: Delete security groups + command: > + aws ec2 delete-security-group + --group-id {{ item }} + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + with_items: "{{ sg_ids.stdout.split() }}" + register: deleted_sgs + failed_when: false + ignore_errors: true + when: sg_ids.stdout | trim != "" + +- name: Update cleaned security groups + set_fact: + cleaned_resources: "{{ cleaned_resources | combine({'security_groups': cleaned_resources.security_groups + sg_ids.stdout.split()}, recursive=True) }}" + when: sg_ids.stdout | trim != "" + +# Step 5: Wait a bit and delete VPC +- name: Wait before trying to delete VPC + pause: + seconds: 10 + +- name: Delete VPC {{ vpc_id }} + command: > + aws ec2 delete-vpc + --vpc-id {{ vpc_id }} + --region {{ aws_region }} + environment: + AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" + AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" + register: deleted_vpc + failed_when: false + ignore_errors: true + +- name: Update cleaned VPCs + set_fact: + cleaned_resources: "{{ cleaned_resources | combine({'vpcs': cleaned_resources.vpcs + [vpc_id]}, recursive=True) }}" + when: deleted_vpc.rc == 0 \ No newline at end of file diff --git a/AWS/redirector.yml b/AWS/redirector.yml index 49321a0..ad83005 100644 --- a/AWS/redirector.yml +++ b/AWS/redirector.yml @@ -1,5 +1,5 @@ --- -# AWS Redirector-only Deployment Playbook +# AWS Redirector-only Deployment Playbook (Fixed) - name: Deploy AWS redirector hosts: localhost @@ -10,6 +10,7 @@ vars: # Default values for required variables ssh_user: "{{ ssh_user | default('kali') }}" + aws_region: "{{ aws_region | default(aws_region_choices | random) }}" instance_type: "{{ aws_instance_type | default('t2.micro') }}" # Generate random instance name if not provided @@ -26,19 +27,22 @@ - aws_secret_key is defined and aws_secret_key != "" fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key." - # Set a single consistent region variable early - - name: Set deployment region + # Select the region first - CRITICAL FIX + - name: Set region for AWS redirector set_fact: - aws_region: "{{ aws_region | default(aws_region_choices | random if aws_region_choices is defined and aws_region_choices | length > 0 else 'us-east-1') }}" + aws_redirector_region: "{{ aws_region | default(aws_region_choices | random if aws_region_choices is defined else 'us-east-1') }}" - - name: Display selected region - debug: - msg: "Deploying in AWS region: {{ aws_region }}" + - name: Set AMI ID for the selected region + set_fact: + ami_id: "{{ ami_map[aws_redirector_region] }}" + when: ami_map is defined and aws_redirector_region in ami_map - name: Create EC2 key pair for redirector amazon.aws.ec2_key: + access_key: "{{ aws_access_key }}" + secret_key: "{{ aws_secret_key }}" name: "{{ redirector_name }}" - region: "{{ aws_region }}" + region: "{{ aws_redirector_region }}" state: present register: redirector_key_pair @@ -49,56 +53,52 @@ mode: "0600" when: redirector_key_pair.changed and redirector_key_pair.key.private_key is defined - - name: Check if VPC exists with specified ID (if provided) - amazon.aws.ec2_vpc_net_info: - vpc_ids: "{{ vpc_id | default(omit) }}" - region: "{{ aws_region }}" - register: vpc_info - when: vpc_id is defined and vpc_id | length > 0 - - - name: Create VPC if not provided or not found + - name: Create VPC amazon.aws.ec2_vpc_net: name: "{{ redirector_name }}-vpc" cidr_block: "10.0.0.0/16" - region: "{{ aws_region }}" + region: "{{ aws_redirector_region }}" tags: Name: "{{ redirector_name }}-vpc" redirector_name: "{{ redirector_name }}" + state: present register: vpc_result - when: vpc_id is not defined or vpc_id | length == 0 or (vpc_info.vpcs | default([]) | length == 0) - - name: Set VPC ID from existing or newly created VPC + - name: Store VPC ID set_fact: - vpc_id: "{{ vpc_id if (vpc_id is defined and vpc_id | length > 0 and vpc_info.vpcs | default([]) | length > 0) else vpc_result.vpc.id }}" + vpc_id: "{{ vpc_result.vpc.id }}" + + - name: Wait for VPC to be fully available + pause: + seconds: 10 + when: vpc_result.changed - name: Create internet gateway for VPC amazon.aws.ec2_vpc_igw: vpc_id: "{{ vpc_id }}" - region: "{{ aws_region }}" + region: "{{ aws_redirector_region }}" state: present tags: Name: "{{ redirector_name }}-igw" redirector_name: "{{ redirector_name }}" register: igw_result - when: vpc_result.changed | default(false) - name: Create subnet in VPC amazon.aws.ec2_vpc_subnet: vpc_id: "{{ vpc_id }}" cidr: "10.0.1.0/24" - region: "{{ aws_region }}" - az: "{{ aws_region }}a" + region: "{{ aws_redirector_region }}" + az: "{{ aws_redirector_region }}a" map_public: yes tags: Name: "{{ redirector_name }}-subnet" redirector_name: "{{ redirector_name }}" register: subnet_result - when: vpc_result.changed | default(false) - name: Create routing table for internet access amazon.aws.ec2_vpc_route_table: vpc_id: "{{ vpc_id }}" - region: "{{ aws_region }}" + region: "{{ aws_redirector_region }}" tags: Name: "{{ redirector_name }}-rtb" redirector_name: "{{ redirector_name }}" @@ -108,19 +108,13 @@ subnets: - "{{ subnet_result.subnet.id }}" register: route_table_result - when: vpc_result.changed | default(false) and igw_result.changed | default(false) and subnet_result.changed | default(false) - - - name: Set AMI ID for the selected region - set_fact: - ami_id: "{{ ami_map[aws_region] }}" - when: ami_map is defined and aws_region in ami_map - name: Create security group for redirector amazon.aws.ec2_security_group: name: "{{ redirector_name }}-sg" description: "Security group for redirector {{ redirector_name }}" vpc_id: "{{ vpc_id }}" - region: "{{ aws_region }}" + region: "{{ aws_redirector_region }}" rules: - proto: tcp ports: @@ -140,17 +134,15 @@ name: "{{ redirector_name }}" key_name: "{{ redirector_name }}" instance_type: "{{ redirector_instance_type | default('t2.micro') }}" - vpc_subnet_id: "{{ subnet_result.subnet.id | default(omit) }}" - security_groups: - - "{{ redirector_name }}-sg" + vpc_subnet_id: "{{ subnet_result.subnet.id }}" + security_groups: + - "{{ security_group.group_id }}" image_id: "{{ ami_id }}" - region: "{{ aws_region }}" + region: "{{ aws_redirector_region }}" state: present wait: yes tags: Name: "{{ redirector_name }}" - redirector_name: "{{ redirector_name }}" - aws_region: "{{ aws_region }}" register: redirector_instance - name: Set redirector_ip for later use @@ -158,30 +150,14 @@ redirector_ip: "{{ redirector_instance.instances[0].public_ip_address }}" redirector_instance_id: "{{ redirector_instance.instances[0].instance_id }}" - # Added longer wait time for SSH to be available - name: Wait for redirector SSH to be available wait_for: host: "{{ redirector_ip }}" port: 22 - delay: 60 + delay: 30 timeout: 300 state: started - # Added SSH connection test to verify credentials - - name: Test SSH connection to instance - command: > - ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10 - -i ~/.ssh/{{ redirector_name }}.pem {{ ssh_user }}@{{ redirector_ip }} echo "SSH connection test" - register: ssh_test - retries: 5 - delay: 20 - until: ssh_test.rc == 0 - ignore_errors: yes - - - name: Display SSH connection status - debug: - msg: "{{ 'SSH connection successful' if ssh_test.rc == 0 else 'SSH connection failed - check key permissions' }}" - - name: Add redirector to inventory add_host: name: "redirector" @@ -189,39 +165,4 @@ ansible_host: "{{ redirector_ip }}" ansible_user: "{{ ssh_user }}" ansible_ssh_private_key_file: "~/.ssh/{{ redirector_name }}.pem" - ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" - -- name: Configure redirector server - hosts: redirectors - become: true - gather_facts: true - vars_files: - - vars.yaml - vars: - c2_ip: "{{ c2_ip | default('127.0.0.1') }}" - redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}" - tasks: - - name: Wait for apt to be available - apt: - update_cache: yes - register: apt_result - until: apt_result is success - retries: 5 - delay: 10 - - - name: Include common redirector configuration tasks - include_tasks: "../tasks/configure_redirector.yml" - - - name: Include common security hardening tasks - include_tasks: "../tasks/security_hardening.yml" - - - name: Print deployment summary - debug: - msg: - - "Redirector Deployment Complete!" - - "-------------------------------" - - "Redirector IP: {{ ansible_host }}" - - "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)" - - "Shell Handler Port: {{ shell_handler_port }}" - - "SSH Key: ~/.ssh/{{ redirector_name }}.pem" - when: not disable_summary | default(false) \ No newline at end of file + ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" \ No newline at end of file