n0mad1k
218 lines
8.4 KiB
YAML
218 lines
8.4 KiB
YAML
---
|
|
# AWS Cleanup Playbook (Fixed)
|
|
|
|
- name: Clean up AWS infrastructure
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: false
|
|
vars_files:
|
|
- vars.yaml
|
|
vars:
|
|
aws_region: "{{ aws_region | default(aws_region_choices | random) }}"
|
|
cleanup_redirector: "{{ (redirector_name is defined and redirector_name != '') | ternary(true, false) }}"
|
|
cleanup_c2: "{{ (c2_name is defined and c2_name != '') | ternary(true, false) }}"
|
|
confirm_cleanup: "{{ confirm_cleanup | default(true) }}"
|
|
delay_seconds: 30
|
|
# Initialize cleaned resources list
|
|
cleaned_resources:
|
|
instances: []
|
|
security_groups: []
|
|
key_pairs: []
|
|
internet_gateways: []
|
|
subnets: []
|
|
route_tables: []
|
|
vpcs: []
|
|
|
|
tasks:
|
|
- name: Validate required AWS credentials
|
|
assert:
|
|
that:
|
|
- aws_access_key is defined and aws_access_key != ""
|
|
- aws_secret_key is defined and aws_secret_key != ""
|
|
fail_msg: "AWS credentials are required. Set aws_access_key and aws_secret_key."
|
|
|
|
- name: Confirm cleanup if required
|
|
pause:
|
|
prompt: "WARNING: This will permanently delete all infrastructure. Type 'yes' to continue"
|
|
register: confirmation
|
|
when: confirm_cleanup
|
|
|
|
- name: Exit if not confirmed
|
|
meta: end_play
|
|
when: confirm_cleanup and confirmation.user_input != 'yes'
|
|
|
|
# Find EC2 instances
|
|
- name: Find redirector instance ID
|
|
command: >
|
|
aws ec2 describe-instances
|
|
--filters "Name=tag:Name,Values={{ redirector_name }}"
|
|
--query "Reservations[*].Instances[*].InstanceId"
|
|
--output text
|
|
--region {{ aws_region }}
|
|
environment:
|
|
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
|
register: redirector_id_result
|
|
failed_when: false
|
|
changed_when: false
|
|
when: cleanup_redirector
|
|
|
|
- name: Find C2 instance ID
|
|
command: >
|
|
aws ec2 describe-instances
|
|
--filters "Name=tag:Name,Values={{ c2_name }}"
|
|
--query "Reservations[*].Instances[*].InstanceId"
|
|
--output text
|
|
--region {{ aws_region }}
|
|
environment:
|
|
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
|
register: c2_id_result
|
|
failed_when: false
|
|
changed_when: false
|
|
when: cleanup_c2
|
|
|
|
- name: Set instance IDs as facts
|
|
set_fact:
|
|
redirector_instance_id: "{{ redirector_id_result.stdout | trim }}"
|
|
cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [redirector_id_result.stdout | trim]}, recursive=True) }}"
|
|
when: cleanup_redirector and redirector_id_result.stdout is defined and redirector_id_result.stdout | trim != ""
|
|
|
|
- name: Set C2 instance ID as fact
|
|
set_fact:
|
|
c2_instance_id: "{{ c2_id_result.stdout | trim }}"
|
|
cleaned_resources: "{{ cleaned_resources | combine({'instances': cleaned_resources.instances + [c2_id_result.stdout | trim]}, recursive=True) }}"
|
|
when: cleanup_c2 and c2_id_result.stdout is defined and c2_id_result.stdout | trim != ""
|
|
|
|
# Terminate EC2 instances
|
|
- name: Terminate redirector instance
|
|
amazon.aws.ec2_instance:
|
|
state: absent
|
|
instance_ids:
|
|
- "{{ redirector_instance_id }}"
|
|
region: "{{ aws_region }}"
|
|
aws_access_key: "{{ aws_access_key }}"
|
|
aws_secret_key: "{{ aws_secret_key }}"
|
|
when: cleanup_redirector and redirector_instance_id is defined and redirector_instance_id != ""
|
|
register: redirector_termination
|
|
|
|
- name: Terminate C2 instance
|
|
amazon.aws.ec2_instance:
|
|
state: absent
|
|
instance_ids:
|
|
- "{{ c2_instance_id }}"
|
|
region: "{{ aws_region }}"
|
|
aws_access_key: "{{ aws_access_key }}"
|
|
aws_secret_key: "{{ aws_secret_key }}"
|
|
when: cleanup_c2 and c2_instance_id is defined and c2_instance_id != ""
|
|
register: c2_termination
|
|
|
|
- name: Wait for instances to be fully terminated
|
|
pause:
|
|
seconds: 30
|
|
when:
|
|
- (redirector_termination is defined and redirector_termination.changed) or
|
|
(c2_termination is defined and c2_termination.changed)
|
|
|
|
# Find VPCs
|
|
- name: Find VPCs by redirector name
|
|
command: >
|
|
aws ec2 describe-vpcs
|
|
--filters "Name=tag:Name,Values=*{{ redirector_name }}*"
|
|
--query "Vpcs[].VpcId"
|
|
--output text
|
|
--region {{ aws_region }}
|
|
environment:
|
|
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
|
register: redirector_vpcs
|
|
failed_when: false
|
|
changed_when: false
|
|
when: cleanup_redirector
|
|
|
|
- name: Find VPCs by C2 name
|
|
command: >
|
|
aws ec2 describe-vpcs
|
|
--filters "Name=tag:Name,Values=*{{ c2_name }}*"
|
|
--query "Vpcs[].VpcId"
|
|
--output text
|
|
--region {{ aws_region }}
|
|
environment:
|
|
AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
|
|
AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
|
|
register: c2_vpcs
|
|
failed_when: false
|
|
changed_when: false
|
|
when: cleanup_c2
|
|
|
|
- name: Combine VPC IDs into a list
|
|
set_fact:
|
|
vpc_ids: "{{ ((redirector_vpcs.stdout | default('') | trim | split('\n') | select('string') | list) +
|
|
(c2_vpcs.stdout | default('') | trim | split('\n') | select('string') | list)) | unique }}"
|
|
when: (redirector_vpcs.stdout | default('') | trim != '') or (c2_vpcs.stdout | default('') | trim != '')
|
|
|
|
# Process each VPC
|
|
- name: Process each VPC
|
|
include_tasks: process_vpc.yml
|
|
loop: "{{ vpc_ids | default([]) }}"
|
|
loop_control:
|
|
loop_var: vpc_id
|
|
when: vpc_ids is defined and vpc_ids | length > 0
|
|
|
|
# Delete key pairs
|
|
- name: Delete redirector key pair
|
|
amazon.aws.ec2_key:
|
|
name: "{{ redirector_name }}"
|
|
state: absent
|
|
region: "{{ aws_region }}"
|
|
aws_access_key: "{{ aws_access_key }}"
|
|
aws_secret_key: "{{ aws_secret_key }}"
|
|
when: cleanup_redirector and redirector_name is defined and redirector_name != ""
|
|
register: redirector_key_deleted
|
|
|
|
- name: Delete C2 key pair
|
|
amazon.aws.ec2_key:
|
|
name: "{{ c2_name }}"
|
|
state: absent
|
|
region: "{{ aws_region }}"
|
|
aws_access_key: "{{ aws_access_key }}"
|
|
aws_secret_key: "{{ aws_secret_key }}"
|
|
when: cleanup_c2 and c2_name is defined and c2_name != ""
|
|
register: c2_key_deleted
|
|
|
|
- name: Track deleted key pairs for redirector
|
|
set_fact:
|
|
cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [redirector_name]}, recursive=True) }}"
|
|
when: redirector_key_deleted is defined and redirector_key_deleted.changed
|
|
|
|
- name: Track deleted key pairs for C2
|
|
set_fact:
|
|
cleaned_resources: "{{ cleaned_resources | combine({'key_pairs': cleaned_resources.key_pairs + [c2_name]}, recursive=True) }}"
|
|
when: c2_key_deleted is defined and c2_key_deleted.changed
|
|
|
|
# Remove local key files
|
|
- name: Remove redirector SSH key file
|
|
file:
|
|
path: "~/.ssh/{{ redirector_name }}.pem"
|
|
state: absent
|
|
when: cleanup_redirector and redirector_name is defined and redirector_name != ""
|
|
|
|
- name: Remove C2 SSH key file
|
|
file:
|
|
path: "~/.ssh/{{ c2_name }}.pem"
|
|
state: absent
|
|
when: cleanup_c2 and c2_name is defined and c2_name != ""
|
|
|
|
# Summary of cleanup
|
|
- name: Cleanup complete message
|
|
debug:
|
|
msg:
|
|
- "AWS infrastructure cleanup complete!"
|
|
- "Resources that were cleaned up:"
|
|
- "- Instances: {{ cleaned_resources.instances | length }} {{ cleaned_resources.instances | join(', ') }}"
|
|
- "- Security Groups: {{ cleaned_resources.security_groups | length }} {{ cleaned_resources.security_groups | join(', ') }}"
|
|
- "- Internet Gateways: {{ cleaned_resources.internet_gateways | length }} {{ cleaned_resources.internet_gateways | join(', ') }}"
|
|
- "- Subnets: {{ cleaned_resources.subnets | length }} {{ cleaned_resources.subnets | join(', ') }}"
|
|
- "- Route Tables: {{ cleaned_resources.route_tables | length }} {{ cleaned_resources.route_tables | join(', ') }}"
|
|
- "- VPCs: {{ cleaned_resources.vpcs | length }} {{ cleaned_resources.vpcs | join(', ') }}"
|
|
- "- Key Pairs: {{ cleaned_resources.key_pairs | length }} {{ cleaned_resources.key_pairs | join(', ') }}" |