n0mad1k/CoM-c2itall
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

still working on aws

Browse Source
This commit is contained in:
n0mad1k
2025-05-02 12:06:09 -04:00
parent a86f9a9d25
commit f6d08e84eb
5 changed files with 510 additions and 239 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AWS/c2.yml
+91 -22
View File
@@ -1,5 +1,6 @@
---
# AWS C2 Deployment Playbook
# AWS C2 Deployment Playbook (Fixed)
- name: Deploy AWS C2 server
hosts: localhost
@@ -23,13 +24,23 @@
- aws_access_key is defined and aws_access_key != ""
- aws_secret_key is defined and aws_secret_key != ""
fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key."
# Select the region first - CRITICAL FIX
- name: Set region for AWS C2 server
set_fact:
aws_c2_region: "{{ aws_region | default(aws_region_choices | random if aws_region_choices is defined else 'us-east-1') }}"
- name: Set AMI ID for the selected region
set_fact:
ami_id: "{{ ami_map[aws_c2_region] }}"
when: ami_map is defined and aws_c2_region in ami_map
- name: Create EC2 key pair for C2
amazon.aws.ec2_key:
access_key: "{{ aws_access_key }}"
secret_key: "{{ aws_secret_key }}"
name: "{{ c2_name }}"
region: "{{ aws_region }}"
region: "{{ aws_c2_region }}"
state: present
register: c2_key_pair
@@ -40,12 +51,68 @@
mode: "0600"
when: c2_key_pair.changed and c2_key_pair.key.private_key is defined
- name: Create VPC
amazon.aws.ec2_vpc_net:
name: "{{ c2_name }}-vpc"
cidr_block: "10.0.0.0/16"
region: "{{ aws_c2_region }}"
tags:
Name: "{{ c2_name }}-vpc"
c2_name: "{{ c2_name }}"
state: present
register: vpc_result
- name: Store VPC ID
set_fact:
vpc_id: "{{ vpc_result.vpc.id }}"
- name: Wait for VPC to be fully available
pause:
seconds: 10
when: vpc_result.changed
- name: Create internet gateway for VPC
amazon.aws.ec2_vpc_igw:
vpc_id: "{{ vpc_id }}"
region: "{{ aws_c2_region }}"
state: present
tags:
Name: "{{ c2_name }}-igw"
c2_name: "{{ c2_name }}"
register: igw_result
- name: Create subnet in VPC
amazon.aws.ec2_vpc_subnet:
vpc_id: "{{ vpc_id }}"
cidr: "10.0.1.0/24"
region: "{{ aws_c2_region }}"
az: "{{ aws_c2_region }}a"
map_public: yes
tags:
Name: "{{ c2_name }}-subnet"
c2_name: "{{ c2_name }}"
register: subnet_result
- name: Create routing table for internet access
amazon.aws.ec2_vpc_route_table:
vpc_id: "{{ vpc_id }}"
region: "{{ aws_c2_region }}"
tags:
Name: "{{ c2_name }}-rtb"
c2_name: "{{ c2_name }}"
routes:
- dest: "0.0.0.0/0"
gateway_id: "{{ igw_result.gateway_id }}"
subnets:
- "{{ subnet_result.subnet.id }}"
register: route_table_result
- name: Create a security group for the C2 server
amazon.aws.ec2_security_group:
name: "{{ c2_name }}-sg"
description: "Security group for C2 server {{ c2_name }}"
vpc_id: "{{ vpc_id }}"
region: "{{ aws_region }}"
region: "{{ aws_c2_region }}"
rules:
- proto: tcp
ports:
@@ -63,40 +130,37 @@
state: present
register: security_group
- name: Set region for AWS C2 server
set_fact:
aws_c2_region: "{{ aws_region | default(region, true) | default('us-east-1', true) }}"
when: aws_region_choices is not defined or aws_region_choices|length == 0
- name: Set random region for AWS C2 server
set_fact:
aws_c2_region: "{{ aws_region_choices | random }}"
when: aws_region_choices is defined and aws_region_choices|length > 0 and aws_c2_region is not defined
- name: Set AMI ID for the selected region
set_fact:
ami_id: "{{ ami_map[aws_redirector_region] }}"
when: ami_map is defined and aws_redirector_region in ami_map
- name: Launch EC2 instance for C2 server
amazon.aws.ec2_instance:
name: "{{ c2_name }}"
key_name: "{{ aws_keypair_name }}"
key_name: "{{ c2_name }}"
instance_type: "{{ instance_type | default('t2.medium') }}"
security_group: "{{ c2_name }}-sg"
vpc_subnet_id: "{{ subnet_result.subnet.id }}"
security_groups:
- "{{ security_group.group_id }}"
image_id: "{{ ami_id }}"
region: "{{ aws_c2_region }}"
state: present
wait: yes
volumes:
- device_name: "/dev/xvda"
ebs:
volume_size: 100
delete_on_termination: true
tags:
Name: "{{ c2_name }}"
register: ec2
register: c2_instance
- name: Set c2_ip for later use
set_fact:
c2_ip: "{{ c2_instance.instances[0].public_ip_address }}"
c2_instance_id: "{{ c2_instance.instances[0].instance_id }}"
- name: Wait for C2 instance initialization (longer delay)
pause:
seconds: 180
when: c2_instance.changed
- name: Wait for C2 SSH to be available
wait_for:
host: "{{ c2_ip }}"
@@ -105,6 +169,11 @@
timeout: 300
state: started
- name: Set correct permissions on SSH key
file:
path: "~/.ssh/{{ c2_name }}.pem"
mode: "0600"
- name: Add C2 to inventory
add_host:
name: "c2"
@@ -112,7 +181,7 @@
ansible_host: "{{ c2_ip }}"
ansible_user: "{{ ssh_user }}"
ansible_ssh_private_key_file: "~/.ssh/{{ c2_name }}.pem"
ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o IdentitiesOnly=yes"
- name: Configure C2 server
hosts: c2servers
AWS/cleanup.yml
+88 -125
View File
@@ -1,6 +1,5 @@
---
# AWS Cleanup Playbook
# Used to tear down AWS infrastructure
# AWS Cleanup Playbook (Fixed)
- name: Clean up AWS infrastructure
hosts: localhost
@@ -13,6 +12,16 @@
cleanup_redirector: "{{ (redirector_name is defined and redirector_name != '') | ternary(true, false) }}"
cleanup_c2: "{{ (c2_name is defined and c2_name != '') | ternary(true, false) }}"
confirm_cleanup: "{{ confirm_cleanup | default(true) }}"
delay_seconds: 30
# Initialize cleaned resources list
cleaned_resources:
instances: []
security_groups: []
key_pairs: []
internet_gateways: []
subnets: []
route_tables: []
vpcs: []
tasks:
- name: Validate required AWS credentials
@@ -32,7 +41,7 @@
meta: end_play
when: confirm_cleanup and confirmation.user_input != 'yes'
# Find instance IDs for cleanup
# Find EC2 instances
- name: Find redirector instance ID
command: >
aws ec2 describe-instances
@@ -66,125 +75,24 @@
- name: Set instance IDs as facts
set_fact:
redirector_instance_id: "{{ redirector_id_result.stdout | trim }}"
cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [redirector_id_result.stdout | trim]}, recursive=True) }}"
when: cleanup_redirector and redirector_id_result.stdout is defined and redirector_id_result.stdout | trim != ""
- name: Set C2 instance ID as fact
set_fact:
c2_instance_id: "{{ c2_id_result.stdout | trim }}"
cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [c2_id_result.stdout | trim]}, recursive=True) }}"
when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != ""
# Find VPCs with specific redirector tag
- name: Find VPCs with specific redirector tag
amazon.aws.ec2_vpc_net_info:
region: "{{ aws_region }}"
filters:
"tag:redirector_name": "{{ redirector_name }}"
register: tagged_vpcs_info
when: cleanup_redirector | default(false) | bool
- name: Display matched VPCs for cleanup
debug:
msg: "Found {{ tagged_vpcs_info.vpcs | default([]) | length }} VPCs with tag redirector_name={{ redirector_name }} to clean up"
when: cleanup_redirector | default(false) | bool and tagged_vpcs_info is defined
- name: Clean up each VPC and its dependencies
block:
- name: Get all subnets for target VPC
amazon.aws.ec2_vpc_subnet_info:
filters:
vpc-id: "{{ item.id }}"
"tag:redirector_name": "{{ redirector_name }}"
region: "{{ aws_region }}"
register: vpc_subnets
with_items: "{{ tagged_vpcs_info.vpcs }}"
- name: Get all internet gateways for target VPC
amazon.aws.ec2_vpc_igw_info:
filters:
attachment.vpc-id: "{{ item.id }}"
region: "{{ aws_region }}"
register: vpc_igws
with_items: "{{ tagged_vpcs_info.vpcs }}"
- name: Get all route tables for target VPC
amazon.aws.ec2_vpc_route_table_info:
filters:
vpc-id: "{{ item.id }}"
"tag:redirector_name": "{{ redirector_name }}"
region: "{{ aws_region }}"
register: vpc_route_tables
with_items: "{{ tagged_vpcs_info.vpcs }}"
- name: Get security groups for target VPC
amazon.aws.ec2_security_group_info:
filters:
vpc-id: "{{ item.id }}"
group-name: "{{ redirector_name }}-sg"
region: "{{ aws_region }}"
register: vpc_security_groups
with_items: "{{ tagged_vpcs_info.vpcs }}"
# Start deleting resources in proper dependency order
- name: Delete non-main route tables
amazon.aws.ec2_vpc_route_table:
route_table_id: "{{ item.route_table_id }}"
region: "{{ aws_region }}"
state: absent
loop: "{{ vpc_route_tables.results | map(attribute='route_tables') | flatten | selectattr('associations', 'defined') | list }}"
ignore_errors: yes
- name: Detach internet gateways
shell: >
aws ec2 detach-internet-gateway
--region {{ aws_region }}
--internet-gateway-id {{ item.internet_gateway_id }}
--vpc-id {{ item.attachments[0].vpc_id }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
loop: "{{ vpc_igws.results | map(attribute='internet_gateways') | flatten | selectattr('attachments', 'defined') | list }}"
ignore_errors: yes
- name: Delete internet gateways
amazon.aws.ec2_vpc_igw:
igw_id: "{{ item.internet_gateway_id }}"
region: "{{ aws_region }}"
state: absent
loop: "{{ vpc_igws.results | map(attribute='internet_gateways') | flatten | list }}"
ignore_errors: yes
- name: Delete subnets
amazon.aws.ec2_vpc_subnet:
subnet_id: "{{ item.subnet_id }}"
region: "{{ aws_region }}"
state: absent
loop: "{{ vpc_subnets.results | map(attribute='subnets') | flatten | list }}"
ignore_errors: yes
- name: Delete security groups
amazon.aws.ec2_security_group:
group_id: "{{ item.group_id }}"
region: "{{ aws_region }}"
state: absent
loop: "{{ vpc_security_groups.results | map(attribute='security_groups') | flatten | list }}"
ignore_errors: yes
- name: Delete VPCs
amazon.aws.ec2_vpc_net:
vpc_id: "{{ item.id }}"
region: "{{ aws_region }}"
state: absent
loop: "{{ tagged_vpcs_info.vpcs }}"
ignore_errors: yes
when: cleanup_redirector | bool and tagged_vpcs_info is defined and tagged_vpcs_info.vpcs | default([]) | length > 0
# Instance, security group, and key pair cleanup
# Terminate EC2 instances
- name: Terminate redirector instance
amazon.aws.ec2_instance:
state: absent
instance_ids:
- "{{ redirector_instance_id }}"
region: "{{ aws_region }}"
aws_access_key: "{{ aws_access_key }}"
aws_secret_key: "{{ aws_secret_key }}"
when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != ""
register: redirector_termination
@@ -194,6 +102,8 @@
instance_ids:
- "{{ c2_instance_id }}"
region: "{{ aws_region }}"
aws_access_key: "{{ aws_access_key }}"
aws_secret_key: "{{ aws_secret_key }}"
when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != ""
register: c2_termination
@@ -204,36 +114,83 @@
- (redirector_termination is defined and redirector_termination.changed) or
(c2_termination is defined and c2_termination.changed)
- name: Delete redirector security group
amazon.aws.ec2_group:
name: "{{ redirector_name }}-sg"
state: absent
region: "{{ aws_region }}"
ignore_errors: yes
when: cleanup_redirector and redirector_name is defined and redirector_name != ""
# Find VPCs
- name: Find VPCs by redirector name
command: >
aws ec2 describe-vpcs
--filters "Name=tag:Name,Values=*{{ redirector_name }}*"
--query "Vpcs[].VpcId"
--output text
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
register: redirector_vpcs
failed_when: false
changed_when: false
when: cleanup_redirector
- name: Delete C2 security group
amazon.aws.ec2_group:
name: "{{ c2_name }}-sg"
state: absent
region: "{{ aws_region }}"
ignore_errors: yes
when: cleanup_c2 and c2_name is defined and c2_name != ""
- name: Find VPCs by C2 name
command: >
aws ec2 describe-vpcs
--filters "Name=tag:Name,Values=*{{ c2_name }}*"
--query "Vpcs[].VpcId"
--output text
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
register: c2_vpcs
failed_when: false
changed_when: false
when: cleanup_c2
- name: Combine VPC IDs into a list
set_fact:
vpc_ids: "{{ ((redirector_vpcs.stdout | default('') | trim | split('\n') | select('string') | list) +
(c2_vpcs.stdout | default('') | trim | split('\n') | select('string') | list)) | unique }}"
when: (redirector_vpcs.stdout | default('') | trim != '') or (c2_vpcs.stdout | default('') | trim != '')
# Process each VPC
- name: Process each VPC
include_tasks: process_vpc.yml
loop: "{{ vpc_ids | default([]) }}"
loop_control:
loop_var: vpc_id
when: vpc_ids is defined and vpc_ids | length > 0
# Delete key pairs
- name: Delete redirector key pair
amazon.aws.ec2_key:
name: "{{ redirector_name }}"
state: absent
region: "{{ aws_region }}"
aws_access_key: "{{ aws_access_key }}"
aws_secret_key: "{{ aws_secret_key }}"
when: cleanup_redirector and redirector_name is defined and redirector_name != ""
register: redirector_key_deleted
- name: Delete C2 key pair
amazon.aws.ec2_key:
name: "{{ c2_name }}"
state: absent
region: "{{ aws_region }}"
aws_access_key: "{{ aws_access_key }}"
aws_secret_key: "{{ aws_secret_key }}"
when: cleanup_c2 and c2_name is defined and c2_name != ""
register: c2_key_deleted
- name: Track deleted key pairs for redirector
set_fact:
cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [redirector_name]}, recursive=True) }}"
when: redirector_key_deleted is defined and redirector_key_deleted.changed
- name: Track deleted key pairs for C2
set_fact:
cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [c2_name]}, recursive=True) }}"
when: c2_key_deleted is defined and c2_key_deleted.changed
# Remove local key files
- name: Remove redirector SSH key file
file:
path: "~/.ssh/{{ redirector_name }}.pem"
@@ -246,10 +203,16 @@
state: absent
when: cleanup_c2 and c2_name is defined and c2_name != ""
# Summary of cleanup
- name: Cleanup complete message
debug:
msg:
- "AWS infrastructure cleanup complete!"
- "Resources that were cleaned up:"
- "{{ cleanup_redirector | ternary('- Redirector instance: ' + redirector_name, '') }}"
- "{{ cleanup_c2 | ternary('- C2 instance: ' + c2_name, '') }}"
- "- Instances: {{ cleaned_resources.instances | length }} {{ cleaned_resources.instances | join(', ') }}"
- "- Security Groups: {{ cleaned_resources.security_groups | length }} {{ cleaned_resources.security_groups | join(', ') }}"
- "- Internet Gateways: {{ cleaned_resources.internet_gateways | length }} {{ cleaned_resources.internet_gateways | join(', ') }}"
- "- Subnets: {{ cleaned_resources.subnets | length }} {{ cleaned_resources.subnets | join(', ') }}"
- "- Route Tables: {{ cleaned_resources.route_tables | length }} {{ cleaned_resources.route_tables | join(', ') }}"
- "- VPCs: {{ cleaned_resources.vpcs | length }} {{ cleaned_resources.vpcs | join(', ') }}"
- "- Key Pairs: {{ cleaned_resources.key_pairs | length }} {{ cleaned_resources.key_pairs | join(', ') }}"
AWS/infrastructure.yml
+92
View File
@@ -0,0 +1,92 @@
---
# AWS Shared Infrastructure Deployment Playbook
- name: Deploy shared AWS infrastructure
hosts: localhost
gather_facts: false
connection: local
vars_files:
- vars.yaml
vars:
# Deployment identifiers
deployment_id: "{{ deployment_id | default('') }}"
infra_name: "infra-{{ deployment_id }}"
# Region settings
split_regions: "{{ c2_region is defined and redirector_region is defined and c2_region != redirector_region }}"
deployment_region: "{{ aws_region | default(aws_region_choices | random) }}"
tasks:
- name: Validate AWS credentials
assert:
that:
- aws_access_key is defined and aws_access_key != ""
- aws_secret_key is defined and aws_secret_key != ""
fail_msg: "AWS credentials are required"
- name: Skip shared infrastructure if using split regions
meta: end_play
when: split_regions | bool
- name: Create shared VPC
amazon.aws.ec2_vpc_net:
name: "{{ infra_name }}-vpc"
cidr_block: "10.0.0.0/16"
region: "{{ deployment_region }}"
tags:
Name: "{{ infra_name }}-vpc"
deployment_id: "{{ deployment_id }}"
state: present
register: vpc_result
- name: Store shared VPC ID
set_fact:
shared_vpc_id: "{{ vpc_result.vpc.id }}"
- name: Create internet gateway
amazon.aws.ec2_vpc_igw:
vpc_id: "{{ shared_vpc_id }}"
region: "{{ deployment_region }}"
state: present
tags:
Name: "{{ infra_name }}-igw"
deployment_id: "{{ deployment_id }}"
register: igw_result
- name: Create subnet
amazon.aws.ec2_vpc_subnet:
vpc_id: "{{ shared_vpc_id }}"
cidr: "10.0.1.0/24"
region: "{{ deployment_region }}"
az: "{{ deployment_region }}a"
map_public: yes
tags:
Name: "{{ infra_name }}-subnet"
deployment_id: "{{ deployment_id }}"
register: subnet_result
- name: Create routing table
amazon.aws.ec2_vpc_route_table:
vpc_id: "{{ shared_vpc_id }}"
region: "{{ deployment_region }}"
tags:
Name: "{{ infra_name }}-rtb"
deployment_id: "{{ deployment_id }}"
routes:
- dest: "0.0.0.0/0"
gateway_id: "{{ igw_result.gateway_id }}"
subnets:
- "{{ subnet_result.subnet.id }}"
register: route_table_result
- name: Write infrastructure info to state file
copy:
content: |
{
"vpc_id": "{{ shared_vpc_id }}",
"subnet_id": "{{ subnet_result.subnet.id }}",
"igw_id": "{{ igw_result.gateway_id }}",
"region": "{{ deployment_region }}",
"deployment_id": "{{ deployment_id }}"
}
dest: "infrastructure_state.json"
mode: "0600"
AWS/process_vpc.yml
+206
View File
@@ -0,0 +1,206 @@
---
# VPC Cleanup Process
# Step 1: Route Tables
- name: Find all route tables for VPC {{ vpc_id }}
command: >
aws ec2 describe-route-tables
--filters "Name=vpc-id,Values={{ vpc_id }}"
--query "RouteTables[?Associations[0].Main != `true`].RouteTableId"
--output text
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
register: rt_ids
failed_when: false
changed_when: false
- name: Process route tables
when: rt_ids.stdout | trim != ""
block:
- name: Find route table associations
command: >
aws ec2 describe-route-tables
--route-table-id {{ item }}
--query "RouteTables[].Associations[].RouteTableAssociationId"
--output text
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
register: rt_assocs
with_items: "{{ rt_ids.stdout.split() }}"
failed_when: false
changed_when: false
- name: Disassociate route tables
command: >
aws ec2 disassociate-route-table
--association-id {{ item.1 }}
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
with_subelements:
- "{{ rt_assocs.results }}"
- stdout_lines
when: item.0.stdout | trim != ""
failed_when: false
ignore_errors: true
- name: Delete route tables
command: >
aws ec2 delete-route-table
--route-table-id {{ item }}
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
with_items: "{{ rt_ids.stdout.split() }}"
register: deleted_rts
failed_when: false
ignore_errors: true
- name: Update cleaned route tables
set_fact:
cleaned_resources: "{{ cleaned_resources | combine({'route_tables': cleaned_resources.route_tables + rt_ids.stdout.split()}, recursive=True) }}"
when: rt_ids.stdout | trim != ""
# Step 2: Internet Gateways
- name: Find internet gateways for VPC {{ vpc_id }}
command: >
aws ec2 describe-internet-gateways
--filters "Name=attachment.vpc-id,Values={{ vpc_id }}"
--query "InternetGateways[].InternetGatewayId"
--output text
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
register: igw_ids
failed_when: false
changed_when: false
- name: Process internet gateways
when: igw_ids.stdout | trim != ""
block:
- name: Detach internet gateways
command: >
aws ec2 detach-internet-gateway
--internet-gateway-id {{ item }}
--vpc-id {{ vpc_id }}
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
with_items: "{{ igw_ids.stdout.split() }}"
failed_when: false
ignore_errors: true
- name: Delete internet gateways
command: >
aws ec2 delete-internet-gateway
--internet-gateway-id {{ item }}
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
with_items: "{{ igw_ids.stdout.split() }}"
register: deleted_igws
failed_when: false
ignore_errors: true
- name: Update cleaned internet gateways
set_fact:
cleaned_resources: "{{ cleaned_resources | combine({'internet_gateways': cleaned_resources.internet_gateways + igw_ids.stdout.split()}, recursive=True) }}"
when: igw_ids.stdout | trim != ""
# Step 3: Subnets
- name: Find subnets for VPC {{ vpc_id }}
command: >
aws ec2 describe-subnets
--filters "Name=vpc-id,Values={{ vpc_id }}"
--query "Subnets[].SubnetId"
--output text
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
register: subnet_ids
failed_when: false
changed_when: false
- name: Delete subnets
command: >
aws ec2 delete-subnet
--subnet-id {{ item }}
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
with_items: "{{ subnet_ids.stdout.split() }}"
register: deleted_subnets
failed_when: false
ignore_errors: true
when: subnet_ids.stdout | trim != ""
- name: Update cleaned subnets
set_fact:
cleaned_resources: "{{ cleaned_resources | combine({'subnets': cleaned_resources.subnets + subnet_ids.stdout.split()}, recursive=True) }}"
when: subnet_ids.stdout | trim != ""
# Step 4: Security Groups (except default)
- name: Find non-default security groups for VPC {{ vpc_id }}
command: >
aws ec2 describe-security-groups
--filters "Name=vpc-id,Values={{ vpc_id }}"
--query "SecurityGroups[?GroupName != 'default'].GroupId"
--output text
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
register: sg_ids
failed_when: false
changed_when: false
- name: Delete security groups
command: >
aws ec2 delete-security-group
--group-id {{ item }}
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
with_items: "{{ sg_ids.stdout.split() }}"
register: deleted_sgs
failed_when: false
ignore_errors: true
when: sg_ids.stdout | trim != ""
- name: Update cleaned security groups
set_fact:
cleaned_resources: "{{ cleaned_resources | combine({'security_groups': cleaned_resources.security_groups + sg_ids.stdout.split()}, recursive=True) }}"
when: sg_ids.stdout | trim != ""
# Step 5: Wait a bit and delete VPC
- name: Wait before trying to delete VPC
pause:
seconds: 10
- name: Delete VPC {{ vpc_id }}
command: >
aws ec2 delete-vpc
--vpc-id {{ vpc_id }}
--region {{ aws_region }}
environment:
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
register: deleted_vpc
failed_when: false
ignore_errors: true
- name: Update cleaned VPCs
set_fact:
cleaned_resources: "{{ cleaned_resources | combine({'vpcs': cleaned_resources.vpcs + [vpc_id]}, recursive=True) }}"
when: deleted_vpc.rc == 0
AWS/redirector.yml
+33 -92
View File
@@ -1,5 +1,5 @@
---
# AWS Redirector-only Deployment Playbook
# AWS Redirector-only Deployment Playbook (Fixed)
- name: Deploy AWS redirector
hosts: localhost
@@ -10,6 +10,7 @@
vars:
# Default values for required variables
ssh_user: "{{ ssh_user | default('kali') }}"
aws_region: "{{ aws_region | default(aws_region_choices | random) }}"
instance_type: "{{ aws_instance_type | default('t2.micro') }}"
# Generate random instance name if not provided
@@ -26,19 +27,22 @@
- aws_secret_key is defined and aws_secret_key != ""
fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key."
# Set a single consistent region variable early
- name: Set deployment region
# Select the region first - CRITICAL FIX
- name: Set region for AWS redirector
set_fact:
aws_region: "{{ aws_region | default(aws_region_choices | random if aws_region_choices is defined and aws_region_choices | length > 0 else 'us-east-1') }}"
aws_redirector_region: "{{ aws_region | default(aws_region_choices | random if aws_region_choices is defined else 'us-east-1') }}"
- name: Display selected region
debug:
msg: "Deploying in AWS region: {{ aws_region }}"
- name: Set AMI ID for the selected region
set_fact:
ami_id: "{{ ami_map[aws_redirector_region] }}"
when: ami_map is defined and aws_redirector_region in ami_map
- name: Create EC2 key pair for redirector
amazon.aws.ec2_key:
access_key: "{{ aws_access_key }}"
secret_key: "{{ aws_secret_key }}"
name: "{{ redirector_name }}"
region: "{{ aws_region }}"
region: "{{ aws_redirector_region }}"
state: present
register: redirector_key_pair
@@ -49,56 +53,52 @@
mode: "0600"
when: redirector_key_pair.changed and redirector_key_pair.key.private_key is defined
- name: Check if VPC exists with specified ID (if provided)
amazon.aws.ec2_vpc_net_info:
vpc_ids: "{{ vpc_id | default(omit) }}"
region: "{{ aws_region }}"
register: vpc_info
when: vpc_id is defined and vpc_id | length > 0
- name: Create VPC if not provided or not found
- name: Create VPC
amazon.aws.ec2_vpc_net:
name: "{{ redirector_name }}-vpc"
cidr_block: "10.0.0.0/16"
region: "{{ aws_region }}"
region: "{{ aws_redirector_region }}"
tags:
Name: "{{ redirector_name }}-vpc"
redirector_name: "{{ redirector_name }}"
state: present
register: vpc_result
when: vpc_id is not defined or vpc_id | length == 0 or (vpc_info.vpcs | default([]) | length == 0)
- name: Set VPC ID from existing or newly created VPC
- name: Store VPC ID
set_fact:
vpc_id: "{{ vpc_id if (vpc_id is defined and vpc_id | length > 0 and vpc_info.vpcs | default([]) | length > 0) else vpc_result.vpc.id }}"
vpc_id: "{{ vpc_result.vpc.id }}"
- name: Wait for VPC to be fully available
pause:
seconds: 10
when: vpc_result.changed
- name: Create internet gateway for VPC
amazon.aws.ec2_vpc_igw:
vpc_id: "{{ vpc_id }}"
region: "{{ aws_region }}"
region: "{{ aws_redirector_region }}"
state: present
tags:
Name: "{{ redirector_name }}-igw"
redirector_name: "{{ redirector_name }}"
register: igw_result
when: vpc_result.changed | default(false)
- name: Create subnet in VPC
amazon.aws.ec2_vpc_subnet:
vpc_id: "{{ vpc_id }}"
cidr: "10.0.1.0/24"
region: "{{ aws_region }}"
az: "{{ aws_region }}a"
region: "{{ aws_redirector_region }}"
az: "{{ aws_redirector_region }}a"
map_public: yes
tags:
Name: "{{ redirector_name }}-subnet"
redirector_name: "{{ redirector_name }}"
register: subnet_result
when: vpc_result.changed | default(false)
- name: Create routing table for internet access
amazon.aws.ec2_vpc_route_table:
vpc_id: "{{ vpc_id }}"
region: "{{ aws_region }}"
region: "{{ aws_redirector_region }}"
tags:
Name: "{{ redirector_name }}-rtb"
redirector_name: "{{ redirector_name }}"
@@ -108,19 +108,13 @@
subnets:
- "{{ subnet_result.subnet.id }}"
register: route_table_result
when: vpc_result.changed | default(false) and igw_result.changed | default(false) and subnet_result.changed | default(false)
- name: Set AMI ID for the selected region
set_fact:
ami_id: "{{ ami_map[aws_region] }}"
when: ami_map is defined and aws_region in ami_map
- name: Create security group for redirector
amazon.aws.ec2_security_group:
name: "{{ redirector_name }}-sg"
description: "Security group for redirector {{ redirector_name }}"
vpc_id: "{{ vpc_id }}"
region: "{{ aws_region }}"
region: "{{ aws_redirector_region }}"
rules:
- proto: tcp
ports:
@@ -140,17 +134,15 @@
name: "{{ redirector_name }}"
key_name: "{{ redirector_name }}"
instance_type: "{{ redirector_instance_type | default('t2.micro') }}"
vpc_subnet_id: "{{ subnet_result.subnet.id | default(omit) }}"
security_groups:
- "{{ redirector_name }}-sg"
vpc_subnet_id: "{{ subnet_result.subnet.id }}"
security_groups:
- "{{ security_group.group_id }}"
image_id: "{{ ami_id }}"
region: "{{ aws_region }}"
region: "{{ aws_redirector_region }}"
state: present
wait: yes
tags:
Name: "{{ redirector_name }}"
redirector_name: "{{ redirector_name }}"
aws_region: "{{ aws_region }}"
register: redirector_instance
- name: Set redirector_ip for later use
@@ -158,30 +150,14 @@
redirector_ip: "{{ redirector_instance.instances[0].public_ip_address }}"
redirector_instance_id: "{{ redirector_instance.instances[0].instance_id }}"
# Added longer wait time for SSH to be available
- name: Wait for redirector SSH to be available
wait_for:
host: "{{ redirector_ip }}"
port: 22
delay: 60
delay: 30
timeout: 300
state: started
# Added SSH connection test to verify credentials
- name: Test SSH connection to instance
command: >
ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=10
-i ~/.ssh/{{ redirector_name }}.pem {{ ssh_user }}@{{ redirector_ip }} echo "SSH connection test"
register: ssh_test
retries: 5
delay: 20
until: ssh_test.rc == 0
ignore_errors: yes
- name: Display SSH connection status
debug:
msg: "{{ 'SSH connection successful' if ssh_test.rc == 0 else 'SSH connection failed - check key permissions' }}"
- name: Add redirector to inventory
add_host:
name: "redirector"
@@ -189,39 +165,4 @@
ansible_host: "{{ redirector_ip }}"
ansible_user: "{{ ssh_user }}"
ansible_ssh_private_key_file: "~/.ssh/{{ redirector_name }}.pem"
ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"
- name: Configure redirector server
hosts: redirectors
become: true
gather_facts: true
vars_files:
- vars.yaml
vars:
c2_ip: "{{ c2_ip | default('127.0.0.1') }}"
redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
tasks:
- name: Wait for apt to be available
apt:
update_cache: yes
register: apt_result
until: apt_result is success
retries: 5
delay: 10
- name: Include common redirector configuration tasks
include_tasks: "../tasks/configure_redirector.yml"
- name: Include common security hardening tasks
include_tasks: "../tasks/security_hardening.yml"
- name: Print deployment summary
debug:
msg:
- "Redirector Deployment Complete!"
- "-------------------------------"
- "Redirector IP: {{ ansible_host }}"
- "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
- "Shell Handler Port: {{ shell_handler_port }}"
- "SSH Key: ~/.ssh/{{ redirector_name }}.pem"
when: not disable_summary | default(false)
ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"