CoM-c2itall/AWS/cleanup.yml

---
# AWS Cleanup Playbook

- name: Clean up AWS resources
  hosts: localhost
  gather_facts: false
  connection: local
  vars_files:
    - vars.yaml
  vars:
    delete_results: {}
    vpc_cleanup_list: []
    aws_detailed_logging: true

  tasks:
    # Confirmation prompts
    - name: Confirm cleanup
      pause:
        prompt: "This will delete all AWS resources for deployment ID {{ deployment_id }}. Continue? (yes/no)"
      register: confirm_deletion
      when: confirm_cleanup | default(true) | bool

    - name: Check confirmation
      assert:
        that: confirm_deletion.user_input | default('yes') | lower == 'yes'
        fail_msg: "Cleanup cancelled by user"
      when: confirm_cleanup | default(true) | bool

    # Display AWS region being used for cleanup
    - name: Display AWS region being used for cleanup
      debug:
        msg: "Cleaning up resources in region: {{ aws_region }}"
      when: aws_detailed_logging | bool

    # Check for and load shared infrastructure file
    - name: Check for shared infrastructure state
      stat:
        path: "infrastructure_state.json"
      register: infra_state_file
      
    - name: Load shared infrastructure state
      include_vars:
        file: "infrastructure_state.json"
        name: shared_infra
      when: infra_state_file.stat.exists | default(false)

    # Initialize cleaned resources tracking
    - name: Initialize cleaned resources tracking
      set_fact:
        cleaned_resources:
          instances: []
          key_pairs: []
          security_groups: []
          network_interfaces: []
          route_tables: []
          subnets: []
          internet_gateways: []
          vpcs: []

    # EC2 Instance cleanup
    - name: Terminate C2 instances
      amazon.aws.ec2_instance:
        state: absent
        region: "{{ aws_region }}"
        filters:
          "tag:Name": "{{ c2_name }}"
      register: c2_instances_result
      when: cleanup_c2 | default(true) | bool

    - name: Update cleaned instances list for C2
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + c2_instances_result.instance_ids}, recursive=true) }}"
      when: cleanup_c2 | default(true) | bool and c2_instances_result.instance_ids is defined
      
    - name: Terminate redirector instances
      amazon.aws.ec2_instance:
        state: absent
        region: "{{ aws_region }}"
        filters:
          "tag:Name": "{{ redirector_name }}"
      register: redirector_instances_result
      when: cleanup_redirector | default(true) | bool

    - name: Update cleaned instances list for redirector
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + redirector_instances_result.instance_ids}, recursive=true) }}"
      when: cleanup_redirector | default(true) | bool and redirector_instances_result.instance_ids is defined
      
    - name: Terminate tracker instances
      amazon.aws.ec2_instance:
        state: absent
        region: "{{ aws_region }}"
        filters:
          "tag:Name": "{{ tracker_name | default('t-' + deployment_id) }}"
      register: tracker_instances_result
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool

    - name: Update cleaned instances list for tracker
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + tracker_instances_result.instance_ids}, recursive=true) }}"
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool and tracker_instances_result.instance_ids is defined
      
    # Wait for all instances to terminate before attempting to clean up dependent resources
    - name: Wait for instances to terminate
      pause:
        seconds: 30
      when: (cleanup_c2 | default(true) | bool and c2_instances_result.changed | default(false)) or
            (cleanup_redirector | default(true) | bool and redirector_instances_result.changed | default(false)) or
            (cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool and tracker_instances_result.changed | default(false))
      
    # List all key pairs to handle different naming patterns
    - name: List available EC2 key pairs
      amazon.aws.ec2_key_info:
        region: "{{ aws_region }}"
      register: all_key_pairs
      
    # Delete C2 deployment key with deployment_id pattern
    - name: Delete C2 deployment key (deployment_id pattern)
      amazon.aws.ec2_key:
        name: "c2deploy_{{ deployment_id }}"
        region: "{{ aws_region }}"
        state: absent
      register: c2_deploy_key_result
      when: cleanup_c2 | default(true) | bool
      
    # Delete C2 EC2 key pair (original pattern)
    - name: Delete C2 EC2 key pair (original pattern)
      amazon.aws.ec2_key:
        name: "{{ c2_name }}"
        region: "{{ aws_region }}"
        state: absent
      register: c2_key_result
      when: cleanup_c2 | default(true) | bool
      
    # Update cleaned key pairs list for C2
    - name: Update cleaned key pairs list for C2
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [item]}, recursive=true) }}"
      with_items:
        - "c2deploy_{{ deployment_id }}"
        - "{{ c2_name }}"
      when: cleanup_c2 | default(true) | bool and (c2_key_result.changed or c2_deploy_key_result.changed)
      
    # Delete redirector EC2 key pair
    - name: Delete redirector EC2 key pair
      amazon.aws.ec2_key:
        name: "{{ redirector_name }}"
        region: "{{ aws_region }}"
        state: absent
      register: redirector_key_result
      when: cleanup_redirector | default(true) | bool
      
    - name: Update cleaned key pairs list for redirector
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [redirector_name]}, recursive=true) }}"
      when: cleanup_redirector | default(true) | bool and redirector_key_result.changed | default(false)
      
    - name: Delete tracker EC2 key pair
      amazon.aws.ec2_key:
        name: "{{ tracker_name | default('t-' + deployment_id) }}"
        region: "{{ aws_region }}"
        state: absent
      register: tracker_key_result
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool
      
    - name: Update cleaned key pairs list for tracker
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [tracker_name | default('t-' + deployment_id)]}, recursive=true) }}"
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool and tracker_key_result.changed | default(false)

    # Security group cleanup
    - name: Delete C2 security group
      amazon.aws.ec2_security_group:
        name: "{{ c2_name }}-sg"
        region: "{{ aws_region }}"
        state: absent
      register: c2_sg_result
      ignore_errors: yes
      when: cleanup_c2 | default(true) | bool
      
    - name: Update cleaned security groups list for C2
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'security_groups': cleaned_resources.security_groups + [c2_sg_result.group_id | default('')]}, recursive=true) }}"
      when: cleanup_c2 | default(true) | bool and c2_sg_result.changed | default(false) and c2_sg_result.group_id is defined
      
    - name: Delete redirector security group
      amazon.aws.ec2_security_group:
        name: "{{ redirector_name }}-sg"
        region: "{{ aws_region }}"
        state: absent
      register: redirector_sg_result
      ignore_errors: yes
      when: cleanup_redirector | default(true) | bool
      
    - name: Update cleaned security groups list for redirector
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'security_groups': cleaned_resources.security_groups + [redirector_sg_result.group_id | default('')]}, recursive=true) }}"
      when: cleanup_redirector | default(true) | bool and redirector_sg_result.changed | default(false) and redirector_sg_result.group_id is defined
      
    - name: Delete tracker security group
      amazon.aws.ec2_security_group:
        name: "{{ tracker_name | default('t-' + deployment_id) }}-sg"
        region: "{{ aws_region }}"
        state: absent
      register: tracker_sg_result
      ignore_errors: yes
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool
      
    - name: Update cleaned security groups list for tracker
      set_fact:
        cleaned_resources: "{{ cleaned_resources | combine({'security_groups': cleaned_resources.security_groups + [tracker_sg_result.group_id | default('')]}, recursive=true) }}"
      when: cleanup_tracker | default(true) | bool and track_deployment | default(false) | bool and tracker_sg_result.changed | default(false) and tracker_sg_result.group_id is defined

    # Identify VPCs to clean up (by tag and by name pattern)
    - name: Get VPCs by deployment tag
      amazon.aws.ec2_vpc_net_info:
        region: "{{ aws_region }}"
        filters:
          "tag:deployment_id": "{{ deployment_id }}"
      register: tagged_vpcs
    
    - name: Add tagged VPCs to cleanup list
      set_fact:
        vpc_cleanup_list: "{{ vpc_cleanup_list + [item.vpc_id] }}"
      with_items: "{{ tagged_vpcs.vpcs }}"
      when: tagged_vpcs.vpcs | length > 0
    
    # Find VPCs by name pattern
    - name: Find VPCs by naming pattern for C2
      amazon.aws.ec2_vpc_net_info:
        region: "{{ aws_region }}"
        filters:
          "tag:Name": "{{ c2_name }}-vpc"
      register: c2_named_vpcs
      when: cleanup_c2 | default(true) | bool
      
    - name: Add C2-named VPCs to cleanup list
      set_fact:
        vpc_cleanup_list: "{{ vpc_cleanup_list + [item.vpc_id] }}"
      with_items: "{{ c2_named_vpcs.vpcs }}"
      when: cleanup_c2 | default(true) | bool and c2_named_vpcs.vpcs | length > 0
      
    - name: Find VPCs by naming pattern for redirector
      amazon.aws.ec2_vpc_net_info:
        region: "{{ aws_region }}"
        filters:
          "tag:Name": "{{ redirector_name }}-vpc"
      register: redirector_named_vpcs
      when: cleanup_redirector | default(true) | bool
      
    - name: Add redirector-named VPCs to cleanup list
      set_fact:
        vpc_cleanup_list: "{{ vpc_cleanup_list + [item.vpc_id] }}"
      with_items: "{{ redirector_named_vpcs.vpcs }}"
      when: cleanup_redirector | default(true) | bool and redirector_named_vpcs.vpcs | length > 0
    
    # Handle shared infrastructure
    - name: Add shared VPC to cleanup if both C2 and redirector being cleaned
      set_fact:
        vpc_cleanup_list: "{{ vpc_cleanup_list + [shared_infra.vpc_id] }}"
      when: >
        infra_state_file.stat.exists | default(false) and 
        shared_infra.vpc_id is defined and
        cleanup_c2 | default(true) | bool and 
        cleanup_redirector | default(true) | bool

    # Make the VPC cleanup list unique
    - name: Deduplicate VPC cleanup list
      set_fact:
        vpc_cleanup_list: "{{ vpc_cleanup_list | unique }}"
      when: vpc_cleanup_list | length > 0

    # Display VPCs to be cleaned up
    - name: Display VPCs to be cleaned
      debug:
        msg: "VPCs to be cleaned: {{ vpc_cleanup_list }}"
      when: aws_detailed_logging | bool and vpc_cleanup_list | length > 0

    # Process each VPC
    - name: Process VPCs for cleanup
      block:
        - name: Process each VPC
          include_tasks: "process_vpc.yml"
          vars:
            vpc_id: "{{ item }}"
          with_items: "{{ vpc_cleanup_list | unique }}"
      when: vpc_cleanup_list | length > 0

    # Clean up infrastructure state file if both C2 and redirector are being cleaned
    - name: Remove infrastructure state file if cleaning up shared infrastructure
      file:
        path: "infrastructure_state.json"
        state: absent
      when: >
        infra_state_file.stat.exists | default(false) and
        ((cleanup_c2 | default(true) | bool and cleanup_redirector | default(true) | bool) or
        (cleanup_c2 | default(true) | bool and not cleanup_redirector | default(true) | bool and 
         c2_region | default(aws_region) == shared_infra.region) or
        (cleanup_redirector | default(true) | bool and not cleanup_c2 | default(true) | bool and 
         redirector_region | default(aws_region) == shared_infra.region))
      
    # Create summary of deleted resources
    - name: Collect all deleted resources
      set_fact:
        resource_summary:
          ec2_instances:
            c2: "{{ c2_instances_result.instance_ids | default([]) }}"
            redirector: "{{ redirector_instances_result.instance_ids | default([]) }}"
            tracker: "{{ tracker_instances_result.instance_ids | default([]) }}"
          key_pairs:
            c2: "{{ cleaned_resources.key_pairs | default([]) | select('search', 'c2deploy_' + deployment_id) | list + cleaned_resources.key_pairs | default([]) | select('search', c2_name) | list }}"
            redirector: "{{ redirector_key_result.key.name | default('') | ternary([redirector_key_result.key.name], []) }}"
            tracker: "{{ tracker_key_result.key.name | default('') | ternary([tracker_key_result.key.name], []) }}"
          security_groups:
            c2: "{{ c2_sg_result.group_id | default('') | ternary([c2_sg_result.group_id], []) }}"
            redirector: "{{ redirector_sg_result.group_id | default('') | ternary([redirector_sg_result.group_id], []) }}"
            tracker: "{{ tracker_sg_result.group_id | default('') | ternary([tracker_sg_result.group_id], []) }}"
          vpc_resources:
            route_tables: "{{ cleaned_resources.route_tables | default([]) }}"
            internet_gateways: "{{ cleaned_resources.internet_gateways | default([]) }}"
            subnets: "{{ cleaned_resources.subnets | default([]) }}"
            network_interfaces: "{{ cleaned_resources.network_interfaces | default([]) }}"
            vpcs: "{{ cleaned_resources.vpcs | default([]) }}"
      when: not disable_summary | default(false)
      
    # Display summary of deleted resources
    - name: Display cleanup summary
      debug:
        msg:
          - "=========================================================="
          - "CLEANUP SUMMARY FOR DEPLOYMENT ID: {{ deployment_id }}"
          - "=========================================================="
          - "EC2 INSTANCES DELETED:"
          - "  C2: {{ resource_summary.ec2_instances.c2 }}"
          - "  Redirector: {{ resource_summary.ec2_instances.redirector }}"
          - "  Tracker: {{ resource_summary.ec2_instances.tracker }}"
          - ""
          - "KEY PAIRS DELETED:"
          - "  C2: {{ resource_summary.key_pairs.c2 }}"
          - "  Redirector: {{ resource_summary.key_pairs.redirector }}"
          - "  Tracker: {{ resource_summary.key_pairs.tracker }}"
          - ""
          - "SECURITY GROUPS DELETED:"
          - "  C2: {{ resource_summary.security_groups.c2 }}"
          - "  Redirector: {{ resource_summary.security_groups.redirector }}"
          - "  Tracker: {{ resource_summary.security_groups.tracker }}"
          - ""
          - "VPC RESOURCES DELETED:"
          - "  Route Tables: {{ resource_summary.vpc_resources.route_tables }}"
          - "  Internet Gateways: {{ resource_summary.vpc_resources.internet_gateways }}"
          - "  Subnets: {{ resource_summary.vpc_resources.subnets }}"
          - "  Network Interfaces: {{ resource_summary.vpc_resources.network_interfaces }}"
          - "  VPCs: {{ resource_summary.vpc_resources.vpcs }}"
          - "=========================================================="
      when: not disable_summary | default(false)