--- # AWS Cleanup Playbook (Fixed) - name: Clean up AWS infrastructure hosts: localhost connection: local gather_facts: false vars_files: - vars.yaml vars: aws_region: "{{ aws_region | default(aws_region_choices | random) }}" cleanup_redirector: "{{ (redirector_name is defined and redirector_name != '') | ternary(true, false) }}" cleanup_c2: "{{ (c2_name is defined and c2_name != '') | ternary(true, false) }}" confirm_cleanup: "{{ confirm_cleanup | default(true) }}" delay_seconds: 30 # Initialize cleaned resources list cleaned_resources: instances: [] security_groups: [] key_pairs: [] internet_gateways: [] subnets: [] route_tables: [] vpcs: [] tasks: - name: Validate required AWS credentials assert: that: - aws_access_key is defined and aws_access_key != "" - aws_secret_key is defined and aws_secret_key != "" fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key." - name: Confirm cleanup if required pause: prompt: "WARNING: This will permanently delete all infrastructure. Type 'yes' to continue" register: confirmation when: confirm_cleanup - name: Exit if not confirmed meta: end_play when: confirm_cleanup and confirmation.user_input != 'yes' # Find EC2 instances - name: Find redirector instance ID command: > aws ec2 describe-instances --filters "Name=tag:Name,Values={{ redirector_name }}" --query "Reservations[*].Instances[*].InstanceId" --output text --region {{ aws_region }} environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" register: redirector_id_result failed_when: false changed_when: false when: cleanup_redirector - name: Find C2 instance ID command: > aws ec2 describe-instances --filters "Name=tag:Name,Values={{ c2_name }}" --query "Reservations[*].Instances[*].InstanceId" --output text --region {{ aws_region }} environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" register: c2_id_result failed_when: false changed_when: false when: cleanup_c2 - name: Set instance IDs as facts set_fact: redirector_instance_id: "{{ redirector_id_result.stdout | trim }}" cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [redirector_id_result.stdout | trim]}, recursive=True) }}" when: cleanup_redirector and redirector_id_result.stdout is defined and redirector_id_result.stdout | trim != "" - name: Set C2 instance ID as fact set_fact: c2_instance_id: "{{ c2_id_result.stdout | trim }}" cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [c2_id_result.stdout | trim]}, recursive=True) }}" when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != "" # Terminate EC2 instances - name: Terminate redirector instance amazon.aws.ec2_instance: state: absent instance_ids: - "{{ redirector_instance_id }}" region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != "" register: redirector_termination - name: Terminate C2 instance amazon.aws.ec2_instance: state: absent instance_ids: - "{{ c2_instance_id }}" region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != "" register: c2_termination - name: Wait for instances to be fully terminated pause: seconds: 30 when: - (redirector_termination is defined and redirector_termination.changed) or (c2_termination is defined and c2_termination.changed) # Find VPCs - name: Find VPCs by redirector name command: > aws ec2 describe-vpcs --filters "Name=tag:Name,Values=*{{ redirector_name }}*" --query "Vpcs[].VpcId" --output text --region {{ aws_region }} environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" register: redirector_vpcs failed_when: false changed_when: false when: cleanup_redirector - name: Find VPCs by C2 name command: > aws ec2 describe-vpcs --filters "Name=tag:Name,Values=*{{ c2_name }}*" --query "Vpcs[].VpcId" --output text --region {{ aws_region }} environment: AWS_ACCESS_KEY_ID: "{{ aws_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}" register: c2_vpcs failed_when: false changed_when: false when: cleanup_c2 - name: Combine VPC IDs into a list set_fact: vpc_ids: "{{ ((redirector_vpcs.stdout | default('') | trim | split('\n') | select('string') | list) + (c2_vpcs.stdout | default('') | trim | split('\n') | select('string') | list)) | unique }}" when: (redirector_vpcs.stdout | default('') | trim != '') or (c2_vpcs.stdout | default('') | trim != '') # Process each VPC - name: Process each VPC include_tasks: process_vpc.yml loop: "{{ vpc_ids | default([]) }}" loop_control: loop_var: vpc_id when: vpc_ids is defined and vpc_ids | length > 0 # Delete key pairs - name: Delete redirector key pair amazon.aws.ec2_key: name: "{{ redirector_name }}" state: absent region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" when: cleanup_redirector and redirector_name is defined and redirector_name != "" register: redirector_key_deleted - name: Delete C2 key pair amazon.aws.ec2_key: name: "{{ c2_name }}" state: absent region: "{{ aws_region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" when: cleanup_c2 and c2_name is defined and c2_name != "" register: c2_key_deleted - name: Track deleted key pairs for redirector set_fact: cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [redirector_name]}, recursive=True) }}" when: redirector_key_deleted is defined and redirector_key_deleted.changed - name: Track deleted key pairs for C2 set_fact: cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [c2_name]}, recursive=True) }}" when: c2_key_deleted is defined and c2_key_deleted.changed # Remove local key files - name: Remove redirector SSH key file file: path: "~/.ssh/{{ redirector_name }}.pem" state: absent when: cleanup_redirector and redirector_name is defined and redirector_name != "" - name: Remove C2 SSH key file file: path: "~/.ssh/{{ c2_name }}.pem" state: absent when: cleanup_c2 and c2_name is defined and c2_name != "" # Summary of cleanup - name: Cleanup complete message debug: msg: - "AWS infrastructure cleanup complete!" - "Resources that were cleaned up:" - "- Instances: {{ cleaned_resources.instances | length }} {{ cleaned_resources.instances | join(', ') }}" - "- Security Groups: {{ cleaned_resources.security_groups | length }} {{ cleaned_resources.security_groups | join(', ') }}" - "- Internet Gateways: {{ cleaned_resources.internet_gateways | length }} {{ cleaned_resources.internet_gateways | join(', ') }}" - "- Subnets: {{ cleaned_resources.subnets | length }} {{ cleaned_resources.subnets | join(', ') }}" - "- Route Tables: {{ cleaned_resources.route_tables | length }} {{ cleaned_resources.route_tables | join(', ') }}" - "- VPCs: {{ cleaned_resources.vpcs | length }} {{ cleaned_resources.vpcs | join(', ') }}" - "- Key Pairs: {{ cleaned_resources.key_pairs | length }} {{ cleaned_resources.key_pairs | join(', ') }}"