CoM-c2itall/AWS/redirector.yml

---
# AWS Redirector-only Deployment Playbook

- name: Deploy AWS redirector
  hosts: localhost
  gather_facts: false
  connection: local
  vars_files:
    - vars.yaml
  vars:
    # Default values for required variables
    ssh_user: "{{ ssh_user | default('kali') }}"
    aws_region: "{{ aws_region | default(aws_region_choices | random) }}"
    instance_type: "{{ aws_instance_type | default('t2.micro') }}"
    
    # Generate random instance name if not provided
    redirector_name: "{{ redirector_name | default('srv-' + 9999999999 | random | to_uuid | hash('md5') | truncate(8, True, '')) }}"
    
    # Generate random shell handler port if not provided
    shell_handler_port: "{{ shell_handler_port | default(4000 + 60000 | random) }}"

  tasks:
    - name: Validate required AWS credentials
      assert:
        that:
          - aws_access_key is defined and aws_access_key != ""
          - aws_secret_key is defined and aws_secret_key != ""
        fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key."

    - name: Create EC2 key pair for redirector
      amazon.aws.ec2_key:
        access_key: "{{ aws_access_key }}"
        secret_key: "{{ aws_secret_key }}"
        name: "{{ redirector_name }}"
        region: "{{ aws_region }}"
        state: present
      register: redirector_key_pair

    - name: Save private key locally
      copy:
        content: "{{ redirector_key_pair.key.private_key }}"
        dest: "~/.ssh/{{ redirector_name }}.pem"
        mode: "0600"
      when: redirector_key_pair.changed and redirector_key_pair.key.private_key is defined

    - name: Check if VPC exists with specified ID (if provided)
      amazon.aws.ec2_vpc_net_info:
        vpc_ids: "{{ vpc_id | default(omit) }}"
        region: "{{ aws_region }}"
      register: vpc_info
      when: vpc_id is defined and vpc_id | length > 0

    - name: Create VPC if not provided or not found
      amazon.aws.ec2_vpc_net:
        name: "{{ redirector_name }}-vpc"
        cidr_block: "10.0.0.0/16"
        region: "{{ aws_region }}"
        tags:
          Name: "{{ redirector_name }}-vpc"
          redirector_name: "{{ redirector_name }}"
      register: vpc_result
      when: vpc_id is not defined or vpc_id | length == 0 or (vpc_info.vpcs | default([]) | length == 0)

    - name: Set VPC ID from existing or newly created VPC
      set_fact:
        vpc_id: "{{ vpc_id if (vpc_id is defined and vpc_id | length > 0 and vpc_info.vpcs | length > 0) else vpc_result.vpc.id }}"

    - name: Create internet gateway for VPC
      amazon.aws.ec2_vpc_igw:
        vpc_id: "{{ vpc_id }}"
        region: "{{ aws_region }}"
        state: present
        tags:
          Name: "{{ redirector_name }}-igw"
          redirector_name: "{{ redirector_name }}"
      register: igw_result
      when: vpc_result.changed | default(false)

    - name: Create subnet in VPC
      amazon.aws.ec2_vpc_subnet:
        vpc_id: "{{ vpc_id }}"
        cidr: "10.0.1.0/24"
        region: "{{ aws_region }}"
        az: "{{ aws_region }}a"
        map_public: yes
        tags:
          Name: "{{ redirector_name }}-subnet"
          redirector_name: "{{ redirector_name }}"
      register: subnet_result
      when: vpc_result.changed | default(false)

    - name: Create routing table for internet access
      amazon.aws.ec2_vpc_route_table:
        vpc_id: "{{ vpc_id }}"
        region: "{{ aws_region }}"
        tags:
          Name: "{{ redirector_name }}-rtb"
          redirector_name: "{{ redirector_name }}"
        routes:
          - dest: "0.0.0.0/0"
            gateway_id: "{{ igw_result.gateway_id }}"
        subnets:
          - "{{ subnet_result.subnet.id }}"
      register: route_table_result
      when: vpc_result.changed | default(false) and igw_result.changed | default(false) and subnet_result.changed | default(false)

    - name: Set region for AWS redirector
      set_fact:
        aws_redirector_region: "{{ aws_region | default(region, true) | default('us-east-1', true) }}"
      when: aws_region_choices is not defined or aws_region_choices|length == 0

    - name: Set random region for AWS redirector
      set_fact:
        aws_redirector_region: "{{ aws_region_choices | random }}"
      when: aws_region_choices is defined and aws_region_choices|length > 0 and aws_redirector_region is not defined

    - name: Set AMI ID for the selected region
      set_fact:
        ami_id: "{{ ami_map[aws_redirector_region] }}"
      when: ami_map is defined and aws_redirector_region in ami_map

    - name: Create security group for redirector
      amazon.aws.ec2_security_group:
        name: "{{ redirector_name }}-sg"
        description: "Security group for redirector {{ redirector_name }}"
        vpc_id: "{{ vpc_id }}"
        region: "{{ aws_redirector_region }}"
        rules:
          - proto: tcp
            ports:
              - 22
              - 80
              - 443
              - "{{ shell_handler_port | default(4444) }}"
            cidr_ip: 0.0.0.0/0
        rules_egress:
          - proto: -1
            cidr_ip: 0.0.0.0/0
        state: present
      register: security_group

    - name: Launch EC2 instance for redirector
      amazon.aws.ec2_instance:
        name: "{{ redirector_name }}"
        key_name: "{{ redirector_name }}"
        instance_type: "{{ redirector_instance_type | default('t2.micro') }}"
        vpc_subnet_id: "{{ subnet_result.subnet.id | default(omit) }}"
        security_group_ids: 
          - "{{ security_group.group_id }}"
        image_id: "{{ ami_id }}"
        region: "{{ aws_redirector_region }}"
        state: present
        wait: yes
        tags:
          Name: "{{ redirector_name }}"
      register: ec2

    - name: Set redirector_ip for later use
      set_fact:
        redirector_ip: "{{ redirector_instance.instances[0].public_ip_address }}"
        redirector_instance_id: "{{ redirector_instance.instances[0].instance_id }}"

    - name: Wait for redirector SSH to be available
      wait_for:
        host: "{{ redirector_ip }}"
        port: 22
        delay: 30
        timeout: 300
        state: started

    - name: Add redirector to inventory
      add_host:
        name: "redirector"
        groups: "redirectors"
        ansible_host: "{{ redirector_ip }}"
        ansible_user: "{{ ssh_user }}"
        ansible_ssh_private_key_file: "~/.ssh/{{ redirector_name }}.pem"
        ansible_ssh_common_args: "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null"

- name: Configure redirector server
  hosts: redirectors
  become: true
  gather_facts: true
  vars_files:
    - vars.yaml
  vars:
    c2_ip: "{{ c2_ip | default('127.0.0.1') }}"
    redirector_subdomain: "{{ redirector_subdomain | default('cdn') }}"
  tasks:
    - name: Wait for apt to be available
      apt:
        update_cache: yes
      register: apt_result
      until: apt_result is success
      retries: 5
      delay: 10
      
    - name: Include common redirector configuration tasks
      include_tasks: "../tasks/configure_redirector.yml"
      
    - name: Include common security hardening tasks
      include_tasks: "../tasks/security_hardening.yml"

    - name: Print deployment summary
      debug:
        msg:
          - "Redirector Deployment Complete!"
          - "-------------------------------"
          - "Redirector IP: {{ ansible_host }}"
          - "Redirector Domain: {{ redirector_subdomain }}.{{ domain }} (Update DNS A record)"
          - "Shell Handler Port: {{ shell_handler_port }}"
          - "SSH Key: ~/.ssh/{{ redirector_name }}.pem"
      when: not disable_summary | default(false)