CoM-c2itall/AWS/cleanup.yml

---
# AWS Cleanup Playbook (Fixed)

- name: Clean up AWS infrastructure
  hosts: localhost
  connection: local
  gather_facts: false
  vars_files:
    - vars.yaml
  vars:
    aws_region: "{{ aws_region | default(aws_region_choices | random) }}"
    cleanup_redirector: "{{ (redirector_name is defined and redirector_name != '') | ternary(true, false) }}"
    cleanup_c2: "{{ (c2_name is defined and c2_name != '') | ternary(true, false) }}"
    confirm_cleanup: "{{ confirm_cleanup | default(true) }}"
    delay_seconds: 30
    # Initialize cleaned resources list
    cleaned_resources:
      instances: []
      security_groups: []
      key_pairs: []
      internet_gateways: []
      subnets: []
      route_tables: []
      vpcs: []

  tasks:
    - name: Validate required AWS credentials
      assert:
        that:
          - aws_access_key is defined and aws_access_key != ""
          - aws_secret_key is defined and aws_secret_key != ""
        fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key."

    - name: Confirm cleanup if required
      pause:
        prompt: "WARNING: This will permanently delete all infrastructure. Type 'yes' to continue"
      register: confirmation
      when: confirm_cleanup
      
    - name: Exit if not confirmed
      meta: end_play
      when: confirm_cleanup and confirmation.user_input != 'yes'

    # Find EC2 instances
    - name: Find redirector instance ID
      command: >
        aws ec2 describe-instances
        --filters "Name=tag:Name,Values={{ redirector_name }}"
        --query "Reservations[*].Instances[*].InstanceId"
        --output text
        --region {{ aws_region }}
      environment:
        AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
      register: redirector_id_result
      failed_when: false
      changed_when: false
      when: cleanup_redirector

    - name: Find C2 instance ID
      command: >
        aws ec2 describe-instances
        --filters "Name=tag:Name,Values={{ c2_name }}"
        --query "Reservations[*].Instances[*].InstanceId"
        --output text
        --region {{ aws_region }}
      environment:
        AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
      register: c2_id_result
      failed_when: false
      changed_when: false
      when: cleanup_c2

    - name: Set instance IDs as facts
      set_fact:
        redirector_instance_id: "{{ redirector_id_result.stdout | trim }}"
        cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [redirector_id_result.stdout | trim]}, recursive=True) }}"
      when: cleanup_redirector and redirector_id_result.stdout is defined and redirector_id_result.stdout | trim != ""

    - name: Set C2 instance ID as fact
      set_fact:
        c2_instance_id: "{{ c2_id_result.stdout | trim }}"
        cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [c2_id_result.stdout | trim]}, recursive=True) }}"
      when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != ""

    # Terminate EC2 instances
    - name: Terminate redirector instance
      amazon.aws.ec2_instance:
        state: absent
        instance_ids:
          - "{{ redirector_instance_id }}"
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != ""
      register: redirector_termination

    - name: Terminate C2 instance
      amazon.aws.ec2_instance:
        state: absent
        instance_ids:
          - "{{ c2_instance_id }}"
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != ""
      register: c2_termination

    - name: Wait for instances to be fully terminated
      pause:
        seconds: 30
      when: 
        - (redirector_termination is defined and redirector_termination.changed) or 
          (c2_termination is defined and c2_termination.changed)

    # Find VPCs
    - name: Find VPCs by redirector name
      command: >
        aws ec2 describe-vpcs
        --filters "Name=tag:Name,Values=*{{ redirector_name }}*"
        --query "Vpcs[].VpcId"
        --output text
        --region {{ aws_region }}
      environment:
        AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
      register: redirector_vpcs
      failed_when: false
      changed_when: false
      when: cleanup_redirector

    - name: Find VPCs by C2 name
      command: >
        aws ec2 describe-vpcs
        --filters "Name=tag:Name,Values=*{{ c2_name }}*"
        --query "Vpcs[].VpcId"
        --output text
        --region {{ aws_region }}
      environment:
        AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
      register: c2_vpcs
      failed_when: false
      changed_when: false
      when: cleanup_c2

    - name: Combine VPC IDs into a list
      set_fact:
        vpc_ids: "{{ ((redirector_vpcs.stdout | default('') | trim | split('\n') | select('string') | list) + 
                     (c2_vpcs.stdout | default('') | trim | split('\n') | select('string') | list)) | unique }}"
      when: (redirector_vpcs.stdout | default('') | trim != '') or (c2_vpcs.stdout | default('') | trim != '')

    - name: Find shared infrastructure resources by deployment ID
      command: >
        aws ec2 describe-vpcs
        --filters "Name=tag:deployment_id,Values={{ deployment_id }}"
        --query "Vpcs[].VpcId"
        --output text
        --region {{ aws_region }}
      environment:
        AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
      register: infra_vpcs
      failed_when: false
      changed_when: false

    - name: Add shared infrastructure VPCs to cleanup list
      set_fact:
        vpc_ids: "{{ vpc_ids | default([]) + (infra_vpcs.stdout | default('') | trim | split('\n') | select('string') | list) }}"
      when: infra_vpcs.stdout | default('') | trim != ''
      
    - name: Remove infrastructure state file if it exists
      file:
        path: "infrastructure_state.json"
        state: absent

    # Process each VPC
    - name: Process each VPC
      include_tasks: process_vpc.yml
      loop: "{{ vpc_ids | default([]) }}"
      loop_control:
        loop_var: vpc_id
      when: vpc_ids is defined and vpc_ids | length > 0

    # Delete key pairs
    - name: Delete redirector key pair
      amazon.aws.ec2_key:
        name: "{{ redirector_name }}"
        state: absent
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      when: cleanup_redirector and redirector_name is defined and redirector_name != ""
      register: redirector_key_deleted

    - name: Delete C2 key pair
      amazon.aws.ec2_key:
        name: "{{ c2_name }}"
        state: absent
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
      when: cleanup_c2 and c2_name is defined and c2_name != ""
      register: c2_key_deleted

    - name: Track deleted key pairs for redirector
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [redirector_name]}, recursive=True) }}"
      when: redirector_key_deleted is defined and redirector_key_deleted.changed

    - name: Track deleted key pairs for C2
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [c2_name]}, recursive=True) }}"
      when: c2_key_deleted is defined and c2_key_deleted.changed

    # Remove local key files
    - name: Remove redirector SSH key file
      file:
        path: "~/.ssh/{{ redirector_name }}.pem"
        state: absent
      when: cleanup_redirector and redirector_name is defined and redirector_name != ""

    - name: Remove C2 SSH key file
      file:
        path: "~/.ssh/{{ c2_name }}.pem"
        state: absent
      when: cleanup_c2 and c2_name is defined and c2_name != ""

    # Summary of cleanup
    - name: Cleanup complete message
      debug:
        msg:
          - "AWS infrastructure cleanup complete!"
          - "Resources that were cleaned up:"
          - "- Instances: {{ cleaned_resources.instances | length }} {{ cleaned_resources.instances | join(', ') }}"
          - "- Security Groups: {{ cleaned_resources.security_groups | length }} {{ cleaned_resources.security_groups | join(', ') }}"
          - "- Internet Gateways: {{ cleaned_resources.internet_gateways | length }} {{ cleaned_resources.internet_gateways | join(', ') }}"
          - "- Subnets: {{ cleaned_resources.subnets | length }} {{ cleaned_resources.subnets | join(', ') }}"
          - "- Route Tables: {{ cleaned_resources.route_tables | length }} {{ cleaned_resources.route_tables | join(', ') }}"
          - "- VPCs: {{ cleaned_resources.vpcs | length }} {{ cleaned_resources.vpcs | join(', ') }}"
          - "- Key Pairs: {{ cleaned_resources.key_pairs | length }} {{ cleaned_resources.key_pairs | join(', ') }}"