CoM-c2itall/AWS/cleanup.yml

---
# AWS Cleanup Playbook
# Used to tear down AWS infrastructure

- name: Clean up AWS infrastructure
  hosts: localhost
  connection: local
  gather_facts: false
  vars_files:
    - vars.yaml
  vars:
    aws_region: "{{ aws_region | default(aws_region_choices | random) }}"
    cleanup_redirector: "{{ (redirector_name is defined and redirector_name != '') | ternary(true, false) }}"
    cleanup_c2: "{{ (c2_name is defined and c2_name != '') | ternary(true, false) }}"
    confirm_cleanup: "{{ confirm_cleanup | default(true) }}"

  tasks:
    - name: Validate required AWS credentials
      assert:
        that:
          - aws_access_key is defined and aws_access_key != ""
          - aws_secret_key is defined and aws_secret_key != ""
        fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key."

    - name: Confirm cleanup if required
      pause:
        prompt: "WARNING: This will permanently delete all infrastructure. Type 'yes' to continue"
      register: confirmation
      when: confirm_cleanup
      
    - name: Exit if not confirmed
      meta: end_play
      when: confirm_cleanup and confirmation.user_input != 'yes'

    - name: Find redirector instance ID
      command: >
        aws ec2 describe-instances
        --filters "Name=tag:Name,Values={{ redirector_name }}"
        --query "Reservations[*].Instances[*].InstanceId"
        --output text
        --region {{ aws_region }}
      environment:
        AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
      register: redirector_id_result
      failed_when: false
      changed_when: false
      when: cleanup_redirector

    - name: Find C2 instance ID
      command: >
        aws ec2 describe-instances
        --filters "Name=tag:Name,Values={{ c2_name }}"
        --query "Reservations[*].Instances[*].InstanceId"
        --output text
        --region {{ aws_region }}
      environment:
        AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
      register: c2_id_result
      failed_when: false
      changed_when: false
      when: cleanup_c2

    - name: Set instance IDs as facts
      set_fact:
        redirector_instance_id: "{{ redirector_id_result.stdout | trim }}"
      when: cleanup_redirector and redirector_id_result.stdout is defined and redirector_id_result.stdout | trim != ""

    - name: Set C2 instance ID as fact
      set_fact:
        c2_instance_id: "{{ c2_id_result.stdout | trim }}"
      when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != ""

    - name: Get information about the redirector security group
      amazon.aws.ec2_security_group_info:
        filters:
          tag:redirector_name: "{{ redirector_name }}"
        region: "{{ aws_region }}"
      register: sg_info
      ignore_errors: yes
      when: cleanup_redirector | bool

    - name: Get information about the VPC
      amazon.aws.ec2_vpc_net_info:
        filters:
          tag:redirector_name: "{{ redirector_name }}"
        region: "{{ aws_region }}"
      register: vpc_info
      ignore_errors: yes
      when: cleanup_redirector | bool

    - name: Get subnet information
      amazon.aws.ec2_vpc_subnet_info:
        filters:
          tag:redirector_name: "{{ redirector_name }}"
        region: "{{ aws_region }}"
      register: subnet_info
      ignore_errors: yes
      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0

    - name: Get internet gateway information
      amazon.aws.ec2_vpc_igw_info:
        filters:
          tag:redirector_name: "{{ redirector_name }}"
        region: "{{ aws_region }}"
      register: igw_info
      ignore_errors: yes
      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0

    - name: Get route table information
      amazon.aws.ec2_vpc_route_table_info:
        filters:
          tag:redirector_name: "{{ redirector_name }}"
        region: "{{ aws_region }}"
      register: rtb_info
      ignore_errors: yes
      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0

    - name: Ensure all internet gateways are detached and deleted
      block:
        - name: Get all internet gateways for the VPC
          command: >
            aws ec2 describe-internet-gateways 
            --region {{ aws_region }} 
            --filters "Name=attachment.vpc-id,Values={{ vpc_info.vpcs[0].id }}" 
            --query "InternetGateways[*].InternetGatewayId" 
            --output text
          environment:
            AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
            AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
          register: igw_ids
          when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0
          
        - name: Detach internet gateways
          command: >
            aws ec2 detach-internet-gateway 
            --region {{ aws_region }} 
            --internet-gateway-id {{ item }} 
            --vpc-id {{ vpc_info.vpcs[0].id }}
          environment:
            AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
            AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
          with_items: "{{ igw_ids.stdout_lines | default([]) }}"
          when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 and igw_ids.stdout != ""
          ignore_errors: yes

        - name: Delete internet gateways
          command: >
            aws ec2 delete-internet-gateway 
            --region {{ aws_region }} 
            --internet-gateway-id {{ item }}
          environment:
            AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
            AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
          with_items: "{{ igw_ids.stdout_lines | default([]) }}"
          when: igw_ids.stdout is defined and igw_ids.stdout != ""
          ignore_errors: yes
      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0
      ignore_errors: yes

    # Add this task to the cleanup script to get all VPCs with redirector tags
    - name: Get all VPCs with redirector tags
      amazon.aws.ec2_vpc_net_info:
        region: "{{ aws_region }}"
      register: all_vpcs_info
      
    # Add a task to identify VPCs to cleanup based on tags
    - name: Identify redirector VPCs for cleanup
      set_fact:
        vpcs_to_cleanup: "{{ all_vpcs_info.vpcs | selectattr('tags.redirector_name', 'defined') | list }}"
      when: all_vpcs_info.vpcs is defined
      
    # Enhanced VPC deletion with better dependency handling
    - name: Delete all VPC resources
      block:
        - name: Delete associated subnets
          amazon.aws.ec2_vpc_subnet:
            vpc_id: "{{ item.id }}"
            state: absent
            region: "{{ aws_region }}"
          with_items: "{{ vpcs_to_cleanup }}"
          ignore_errors: yes
          
        - name: Ensure all internet gateways are detached
          shell: >
            aws ec2 describe-internet-gateways --region {{ aws_region }} --filters "Name=attachment.vpc-id,Values={{ item.id }}" --query "InternetGateways[*].InternetGatewayId" --output text | 
            xargs -I % aws ec2 detach-internet-gateway --region {{ aws_region }} --internet-gateway-id % --vpc-id {{ item.id }}
          with_items: "{{ vpcs_to_cleanup }}"
          ignore_errors: yes
          
        - name: Delete all VPCs
          amazon.aws.ec2_vpc_net:
            vpc_id: "{{ item.id }}"
            state: absent
            region: "{{ aws_region }}"
          with_items: "{{ vpcs_to_cleanup }}"
          ignore_errors: yes
      when: vpcs_to_cleanup is defined and vpcs_to_cleanup | length > 0      

    - name: Delete route tables
      amazon.aws.ec2_vpc_route_table:
        route_table_id: "{{ item.id }}"
        region: "{{ aws_region }}"
        state: absent
      loop: "{{ rtb_info.route_tables | default([]) }}"
      ignore_errors: yes
      when: rtb_info.route_tables is defined and rtb_info.route_tables | length > 0

    - name: Detach internet gateway from VPC
      amazon.aws.ec2_vpc_igw:
        vpc_id: "{{ vpc_info.vpcs[0].id }}"
        region: "{{ aws_region }}"
        state: absent
      ignore_errors: yes
      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0 and igw_info.internet_gateways is defined and igw_info.internet_gateways | length > 0

    - name: Delete internet gateway
      amazon.aws.ec2_vpc_igw:
        igw_id: "{{ item.id }}"
        region: "{{ aws_region }}"
        state: absent
      loop: "{{ igw_info.internet_gateways | default([]) }}"
      ignore_errors: yes
      when: igw_info.internet_gateways is defined and igw_info.internet_gateways | length > 0

    - name: Delete subnets
      amazon.aws.ec2_vpc_subnet:
        vpc_id: "{{ vpc_info.vpcs[0].id }}"
        cidr: "{{ item.cidr_block }}"
        region: "{{ aws_region }}"
        state: absent
      loop: "{{ subnet_info.subnets | default([]) }}"
      ignore_errors: yes
      when: subnet_info.subnets is defined and subnet_info.subnets | length > 0

    - name: Delete security groups
      amazon.aws.ec2_security_group:
        group_id: "{{ item.group_id }}"
        region: "{{ aws_region }}"
        state: absent
      loop: "{{ sg_info.security_groups | default([]) }}"
      ignore_errors: yes
      when: sg_info.security_groups is defined and sg_info.security_groups | length > 0

    - name: Delete VPC
      amazon.aws.ec2_vpc_net:
        vpc_id: "{{ vpc_info.vpcs[0].id }}"
        region: "{{ aws_region }}"
        state: absent
      ignore_errors: yes
      when: vpc_info.vpcs is defined and vpc_info.vpcs | length > 0




    - name: Terminate redirector instance
      amazon.aws.ec2_instance:
        state: absent
        instance_ids:
          - "{{ redirector_instance_id }}"
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != ""
      register: redirector_termination

    - name: Terminate C2 instance
      amazon.aws.ec2_instance:
        state: absent
        instance_ids:
          - "{{ c2_instance_id }}"
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != ""
      register: c2_termination

    - name: Wait for instances to be fully terminated
      pause:
        seconds: 30
      when: 
        - (redirector_termination is defined and redirector_termination.changed) or 
          (c2_termination is defined and c2_termination.changed)

    - name: Delete redirector security group
      amazon.aws.ec2_group:
        name: "{{ redirector_name }}-sg"
        state: absent
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      ignore_errors: yes
      when: cleanup_redirector and redirector_name is defined and redirector_name != ""

    - name: Delete C2 security group
      amazon.aws.ec2_group:
        name: "{{ c2_name }}-sg"
        state: absent
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      ignore_errors: yes
      when: cleanup_c2 and c2_name is defined and c2_name != ""

    - name: Delete redirector key pair
      amazon.aws.ec2_key:
        name: "{{ redirector_name }}"
        state: absent
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      when: cleanup_redirector and redirector_name is defined and redirector_name != ""

    - name: Delete C2 key pair
      amazon.aws.ec2_key:
        name: "{{ c2_name }}"
        state: absent
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      when: cleanup_c2 and c2_name is defined and c2_name != ""

    - name: Remove redirector SSH key file
      file:
        path: "~/.ssh/{{ redirector_name }}.pem"
        state: absent
      when: cleanup_redirector and redirector_name is defined and redirector_name != ""

    - name: Remove C2 SSH key file
      file:
        path: "~/.ssh/{{ c2_name }}.pem"
        state: absent
      when: cleanup_c2 and c2_name is defined and c2_name != ""

    - name: Cleanup complete message
      debug:
        msg:
          - "AWS infrastructure cleanup complete!"
          - "Resources that were cleaned up:"
          - "{{ cleanup_redirector | ternary('- Redirector instance: ' + redirector_name, '') }}"
          - "{{ cleanup_c2 | ternary('- C2 instance: ' + c2_name, '') }}"