--- # AWS Cleanup Playbook # Used to tear down AWS infrastructure - name: Clean up AWS infrastructure hosts: localhost connection: local gather_facts: false vars_files: - vars.yaml vars: aws_region: "{{ aws_region | default(aws_region_choices | random) }}" cleanup_redirector: "{{ (redirector_name is defined and redirector_name != '') | ternary(true, false) }}" cleanup_c2: "{{ (c2_name is defined and c2_name != '') | ternary(true, false) }}" confirm_cleanup: "{{ confirm_cleanup | default(true) }}" tasks: - name: Validate required AWS credentials assert: that: - aws_access_key is defined and aws_access_key != "" - aws_secret_key is defined and aws_secret_key != "" fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key." - name: Confirm cleanup if required pause: prompt: "WARNING: This will permanently delete all infrastructure. Type 'yes' to continue" register: confirmation when: confirm_cleanup - name: Exit if not confirmed meta: end_play when: confirm_cleanup and confirmation.user_input != 'yes' - name: Find redirector instance ID command: > aws ec2 describe-instances --filters "Name=tag:Name,Values={{ redirector_name }}" --query "Reservations[*].Instances[*].InstanceId" --output text --region {{ aws_region }} environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" register: redirector_id_result failed_when: false changed_when: false when: cleanup_redirector - name: Find C2 instance ID command: > aws ec2 describe-instances --filters "Name=tag:Name,Values={{ c2_name }}" --query "Reservations[*].Instances[*].InstanceId" --output text --region {{ aws_region }} environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" register: c2_id_result failed_when: false changed_when: false when: cleanup_c2 - name: Set instance IDs as facts set_fact: redirector_instance_id: "{{ redirector_id_result.stdout | trim }}" when: cleanup_redirector and redirector_id_result.stdout is defined and redirector_id_result.stdout | trim != "" - name: Set C2 instance ID as fact set_fact: c2_instance_id: "{{ c2_id_result.stdout | trim }}" when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != "" - name: Get information about the redirector security group amazon.aws.ec2_security_group_info: filters: tag:redirector_name: "{{ redirector_name }}" region: "{{ aws_region }}" register: sg_info ignore_errors: yes when: cleanup_redirector | bool - name: Get information about the VPC amazon.aws.ec2_vpc_net_info: filters: tag:redirector_name: "{{ redirector_name }}" region: "{{ aws_region }}" register: vpc_info ignore_errors: yes when: cleanup_redirector | bool - name: Get subnet information amazon.aws.ec2_vpc_subnet_info: filters: tag:redirector_name: "{{ redirector_name }}" region: "{{ aws_region }}" register: subnet_info ignore_errors: yes when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 - name: Get internet gateway information amazon.aws.ec2_vpc_igw_info: filters: tag:redirector_name: "{{ redirector_name }}" region: "{{ aws_region }}" register: igw_info ignore_errors: yes when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 - name: Get route table information amazon.aws.ec2_vpc_route_table_info: filters: tag:redirector_name: "{{ redirector_name }}" region: "{{ aws_region }}" register: rtb_info ignore_errors: yes when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 - name: Ensure all internet gateways are detached and deleted block: - name: Get all internet gateways for the VPC command: > aws ec2 describe-internet-gateways --region {{ aws_region }} --filters "Name=attachment.vpc-id,Values={{ vpc_info.vpcs[0].id }}" --query "InternetGateways[*].InternetGatewayId" --output text environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" register: igw_ids when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 - name: Detach internet gateways command: > aws ec2 detach-internet-gateway --region {{ aws_region }} --internet-gateway-id {{ item }} --vpc-id {{ vpc_info.vpcs[0].id }} environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" with_items: "{{ igw_ids.stdout_lines | default([]) }}" when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 and igw_ids.stdout != "" ignore_errors: yes - name: Delete internet gateways command: > aws ec2 delete-internet-gateway --region {{ aws_region }} --internet-gateway-id {{ item }} environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" with_items: "{{ igw_ids.stdout_lines | default([]) }}" when: igw_ids.stdout is defined and igw_ids.stdout != "" ignore_errors: yes when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 ignore_errors: yes # Add this task to the cleanup script to get all VPCs with redirector tags - name: Get all VPCs with redirector tags amazon.aws.ec2_vpc_net_info: region: "{{ aws_region }}" register: all_vpcs_info # Add a task to identify VPCs to cleanup based on tags - name: Identify redirector VPCs for cleanup set_fact: vpcs_to_cleanup: "{{ all_vpcs_info.vpcs | selectattr('tags.redirector_name', 'defined') | list }}" when: all_vpcs_info.vpcs is defined # Enhanced VPC deletion with better dependency handling - name: Delete all VPC resources block: - name: Delete associated subnets amazon.aws.ec2_vpc_subnet: vpc_id: "{{ item.id }}" state: absent region: "{{ aws_region }}" with_items: "{{ vpcs_to_cleanup }}" ignore_errors: yes - name: Ensure all internet gateways are detached shell: > aws ec2 describe-internet-gateways --region {{ aws_region }} --filters "Name=attachment.vpc-id,Values={{ item.id }}" --query "InternetGateways[*].InternetGatewayId" --output text | xargs -I % aws ec2 detach-internet-gateway --region {{ aws_region }} --internet-gateway-id % --vpc-id {{ item.id }} with_items: "{{ vpcs_to_cleanup }}" ignore_errors: yes - name: Delete all VPCs amazon.aws.ec2_vpc_net: vpc_id: "{{ item.id }}" state: absent region: "{{ aws_region }}" with_items: "{{ vpcs_to_cleanup }}" ignore_errors: yes when: vpcs_to_cleanup is defined and vpcs_to_cleanup | length > 0 - name: Delete route tables amazon.aws.ec2_vpc_route_table: route_table_id: "{{ item.id }}" region: "{{ aws_region }}" state: absent loop: "{{ rtb_info.route_tables | default([]) }}" ignore_errors: yes when: rtb_info.route_tables is defined and rtb_info.route_tables | length > 0 - name: Detach internet gateway from VPC amazon.aws.ec2_vpc_igw: vpc_id: "{{ vpc_info.vpcs[0].id }}" region: "{{ aws_region }}" state: absent ignore_errors: yes when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 and igw_info.internet_gateways is defined and igw_info.internet_gateways | length > 0 - name: Delete internet gateway amazon.aws.ec2_vpc_igw: igw_id: "{{ item.id }}" region: "{{ aws_region }}" state: absent loop: "{{ igw_info.internet_gateways | default([]) }}" ignore_errors: yes when: igw_info.internet_gateways is defined and igw_info.internet_gateways | length > 0 - name: Delete subnets amazon.aws.ec2_vpc_subnet: vpc_id: "{{ vpc_info.vpcs[0].id }}" cidr: "{{ item.cidr_block }}" region: "{{ aws_region }}" state: absent loop: "{{ subnet_info.subnets | default([]) }}" ignore_errors: yes when: subnet_info.subnets is defined and subnet_info.subnets | length > 0 - name: Delete security groups amazon.aws.ec2_security_group: group_id: "{{ item.group_id }}" region: "{{ aws_region }}" state: absent loop: "{{ sg_info.security_groups | default([]) }}" ignore_errors: yes when: sg_info.security_groups is defined and sg_info.security_groups | length > 0 - name: Delete VPC amazon.aws.ec2_vpc_net: vpc_id: "{{ vpc_info.vpcs[0].id }}" region: "{{ aws_region }}" state: absent ignore_errors: yes when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 - name: Terminate redirector instance amazon.aws.ec2_instance: state: absent instance_ids: - "{{ redirector_instance_id }}" region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != "" register: redirector_termination - name: Terminate C2 instance amazon.aws.ec2_instance: state: absent instance_ids: - "{{ c2_instance_id }}" region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != "" register: c2_termination - name: Wait for instances to be fully terminated pause: seconds: 30 when: - (redirector_termination is defined and redirector_termination.changed) or (c2_termination is defined and c2_termination.changed) - name: Delete redirector security group amazon.aws.ec2_group: name: "{{ redirector_name }}-sg" state: absent region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" ignore_errors: yes when: cleanup_redirector and redirector_name is defined and redirector_name != "" - name: Delete C2 security group amazon.aws.ec2_group: name: "{{ c2_name }}-sg" state: absent region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" ignore_errors: yes when: cleanup_c2 and c2_name is defined and c2_name != "" - name: Delete redirector key pair amazon.aws.ec2_key: name: "{{ redirector_name }}" state: absent region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" when: cleanup_redirector and redirector_name is defined and redirector_name != "" - name: Delete C2 key pair amazon.aws.ec2_key: name: "{{ c2_name }}" state: absent region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" when: cleanup_c2 and c2_name is defined and c2_name != "" - name: Remove redirector SSH key file file: path: "~/.ssh/{{ redirector_name }}.pem" state: absent when: cleanup_redirector and redirector_name is defined and redirector_name != "" - name: Remove C2 SSH key file file: path: "~/.ssh/{{ c2_name }}.pem" state: absent when: cleanup_c2 and c2_name is defined and c2_name != "" - name: Cleanup complete message debug: msg: - "AWS infrastructure cleanup complete!" - "Resources that were cleaned up:" - "{{ cleanup_redirector | ternary('- Redirector instance: ' + redirector_name, '') }}" - "{{ cleanup_c2 | ternary('- C2 instance: ' + c2_name, '') }}"