7_destroy.yaml

---
#------------------------------------------------------------------------------
# Terminate AWS EC2 Instances for a tagged project:
#   - Terminate all EC2 instances
#   - Delete Subnets
#   - Delete Route Table
#   - Delete Internet Gateway
#   - Delete Security Groups in VPC
#   - Delete VPCs
#   - Delete private key
#   - TODO: Delete Route53 records
#   - TODO: Delete S3 Buckets
#
# Run: `ansible-playbook destroy.yaml`
#------------------------------------------------------------------------------


- name: Destroy All AWS EC2 Resources for project:"{{ project_name }}"
  hosts: localhost
  gather_facts: no
  vars_files: vars/main.yaml
  tasks:

  #----------------------------------------------------------------------------
  # Confirm Project!
  #----------------------------------------------------------------------------

  - name: Prompt for Project to Delete
    ansible.builtin.pause:
      prompt: "Project Name [{{ project_name | default('') }}]"
    register: result

  # - ansible.builtin.debug: var=result.user_input

  - name: Set Project Name
    when: result.user_input is defined and result.user_input | length > 0
    ansible.builtin.set_fact:
      project_name: "{{ result.user_input | trim }}"

  # - ansible.builtin.debug: var=project_name

  #----------------------------------------------------------------------------
  # Get All Resources
  #----------------------------------------------------------------------------

  - name: Get All EC2 Instances with tag project:"{{ project_name }}"
    amazon.aws.ec2_instance_info:    # Get All by default
      filters:
        instance-state-name:
        - rebooted    # convenience alias for state=stopped immediately followed by state=running
        - restarted   # convenience alias for state=stopped immediately followed by state=started
        - running     # state=present + ensures the instances are running
        - started     # state=running + waits for EC2 status checks to report OK if wait=true
        - stopped     # ensures an existing instance is stopped.
        - present     # instances exist, but does not guarantee any state (e.g. running)
        # - terminated  # ensures an existing instance is terminated.
        # - absent      # alias for state=terminated
        "tag:project": "{{ project_name }}"
    register: ec2_instances

  # - ansible.builtin.debug: var=ec2_instances

  - name: Get All VPCs | project:"{{ project_name }}"
    amazon.aws.ec2_vpc_net_info:
      filters:
        "tag:project": "{{ project_name }}"
    register: vpcs

  # - ansible.builtin.debug: var=vpcs

  - name: Get All Dangling ENIs in the VPC
    when: vpcs.vpcs is defined and vpcs.vpcs | length > 0
    amazon.aws.ec2_eni_info:
      filters:
        vpc-id: "{{ vpcs.vpcs[0].id }}"
        "tag:project": "{{ project_name }}"
    register: enis

  # - ansible.builtin.debug: var=enis

  # - name: Get All DHCP Option in the VPC
  #   amazon.aws.ec2_vpc_dhcp_option_info:
  #     # filters:
  #     #   "tag:project": "{{ project_name }}"
  #   register: dhcp_info
  # - ansible.builtin.debug: var=dhcp_info

  - name: Get All Subnets | project:"{{ project_name }}"
    amazon.aws.ec2_vpc_subnet_info:
      filters:
        "tag:project": "{{ project_name }}"
    register: subnets

  # - ansible.builtin.debug: var=subnets

  - name: Get All Route Tables | project:"{{ project_name }}"
    amazon.aws.ec2_vpc_route_table_info:
      filters:
        "tag:project": "{{ project_name }}"
    register: route_tables

  # - ansible.builtin.debug: var=route_tables

  - name: Get All Internet Gateways | project:"{{ project_name }}"
    amazon.aws.ec2_vpc_igw_info:
      filters:
        "tag:project": "{{ project_name }}"
    register: igws

  # - ansible.builtin.debug: var=igws

  - name: Get All Security Groups | project:"{{ project_name }}"
    amazon.aws.ec2_group_info:
      filters:
        "tag:project": "{{ project_name }}"
    register: security_groups

  # - ansible.builtin.debug: var=security_groups

  #----------------------------------------------------------------------------
  # Summarize Resources to Destroy
  #----------------------------------------------------------------------------
  - name: Resource Summary
    ansible.builtin.debug:
      msg:
      - "{{ ec2_instances.instances | length }} EC2 Instances"
      - "{{ vpcs.vpcs | length }} VPCs"
      - "{{ enis.network_interfaces | default([]) | length }} ENIs"
      - "{{ subnets.subnets | length }} Subnets"
      - "{{ route_tables.route_tables | length }} Route Tables"
      # - "{{ dhcp_info is defined | ternary('1','0') }} DHCP Info"
      - "{{ igws.internet_gateways | length }} Internet Gateways"
      - "{{ security_groups.security_groups | length }} Security Groups"

  #----------------------------------------------------------------------------
  # Confirm Destruction!
  #----------------------------------------------------------------------------

  - name: Confirm Deletion
    ansible.builtin.pause:
      prompt: |
         
                /\
               /  \
              / ❕ \   Delete All resources in the project "{{ project_name }}"? [y/n] (yes)
             /______\
         
    register: input

  # - ansible.builtin.debug: var=input.user_input

  - name: Set Delete Confirmation
    when: input.user_input is defined
    ansible.builtin.set_fact:
      is_confirmed: "{{ (input.user_input | length == 0) or (input.user_input[0] | lower == 'y') }}"

  - name: Show is_confirmed
    ansible.builtin.debug:
      var: is_confirmed
      verbosity: 3


  #----------------------------------------------------------------------------
  # Delete VPC Resources
  #----------------------------------------------------------------------------
  - name: Delete VPC Resources
    when: is_confirmed
    block:
    - name: Delete All EC2 instances | project:"{{ project_name }}"
      when: is_confirmed and ec2_instances is defined and ec2_instances | length > 0
      amazon.aws.ec2_instance:
        state: absent
        wait: yes
        filters:
          # instance-state-name: [ "running" ]
          "tag:project": "{{ project_name }}"
      register: ec2_instances_deleted
    # - ansible.builtin.debug: var=ec2_instances_deleted

    - name: Delete All dangling ENIs
      when: is_confirmed and enis.network_interfaces is defined and enis.network_interfaces | length > 0
      loop: '{{ enis.network_interfaces }}'
      amazon.aws.ec2_eni:
        state: absent
        eni_id: "{{ item.id }}"

    # - name: Delete All DHCP Options
    #   amazon.aws.ec2_vpc_dhcp_option:
    #     # vpc_id: "{{ vpcs.vpcs[0].id }}"
    #     state: absent
    #   register: dhcp_info_deleted
    # - ansible.builtin.debug: var=dhcp_info_deleted

    - name: Delete Subnets
      when: is_confirmed and subnets is defined and subnets.subnets | length > 0
      loop: '{{ subnets.subnets }}'
      amazon.aws.ec2_vpc_subnet:
        vpc_id: "{{ item.vpc_id }}"
        cidr: "{{ item.cidr_block }}"
        state: absent
      register: subnets_deleted

    # - ansible.builtin.debug: var=subnets_deleted

    - name: Delete Route Table
      when: is_confirmed and route_tables is defined and route_tables.route_tables | length > 0
      loop: '{{ route_tables.route_tables }}'
      amazon.aws.ec2_vpc_route_table:
        route_table_id: "{{ item.id }}"
        lookup: id
        state: absent
      register: route_tables_deleted

    # - ansible.builtin.debug: var=route_tables_deleted

    - name: Delete Internet Gateway
      when: is_confirmed and igws is defined # and igws.internet_gateways | length > 0
      loop: '{{ vpcs.vpcs }}'
      amazon.aws.ec2_vpc_igw:
        vpc_id: "{{ item.vpc_id }}"
        state: absent
      register: igws_deleted

    # - ansible.builtin.debug: var=igws_deleted

    - name: Delete Security Groups in VPC
      when: is_confirmed and security_groups is defined and security_groups.security_groups | length > 0
      loop: "{{ security_groups.security_groups }}"
      amazon.aws.ec2_group:
        group_id: "{{ item.group_id }}"
        state: absent
      register: security_groups_deleted

    # - ansible.builtin.debug: var=security_groups_deleted

    - name: Delete VPCs | project:"{{ project_name }}"
      when: is_confirmed and vpcs is defined and vpcs.vpcs | length > 0
      loop: "{{ vpcs.vpcs }}"
      amazon.aws.ec2_vpc_net:
        vpc_id: "{{ item.vpc_id }}"            # required
        purge_cidrs: yes    # Remove CIDRs associated with VPC and no in cidr_block
        state: absent
      register: vpcs_deleted

    # - ansible.builtin.debug: var=vpcs_deleted

    - name: Delete {{ ssh_key_name }} from AWS
      when: ssh_key_name is defined
      amazon.aws.ec2_key:
        name: "{{ ssh_key_name }}"
        state: absent
      register: keypair_remote_deleted

    # - ansible.builtin.debug: var=keypair_remote_deleted

    - name: Delete the Local SSH Keypair
      when: ssh_key_name is defined
      block:
      - name: Delete Local Private Key | {{ ssh_key_directory }}/{{ ssh_key_name }}
        ansible.builtin.file:
          path: "{{ ssh_key_directory }}/{{ ssh_key_name }}"
          state: absent
        register: keypair_local_deleted

      - name: Delete Local Public Key | {{ ssh_key_directory }}/{{ ssh_key_name }}.pub
        ansible.builtin.file:
          path: "{{ ssh_key_directory }}/{{ ssh_key_name }}.pub"
          state: absent
        register: keypair_local_deleted

    # - ansible.builtin.debug: var=keypair_local_deleted

    #
    # Route53 DNS Records
    #

    # - name: Retrieve the DNS records
    #   community.aws.route53:
    #     state: get
    #     zone: "{{ domain_name }}"
    #     record: new.foo.com
    #     type: A
    #   register: records
    # - ansible.builtin.debug: var=records

    # - name: Delete A record using the results from the get command
    #   community.aws.route53:
    #     state: absent
    #     zone: "{{ domain_name }}"
    #     record: "{{ rec.set.record }}"
    #     ttl: "{{ rec.set.ttl }}"
    #     type: "{{ rec.set.type }}"
    #     value: "{{ rec.set.value }}"

    # - name: Delete public DNS entry for the ISE node(s)
    #   community.aws.route53:
    #     state: absent
    #     zone: "{{ domain_name }}"
    #     record: "{{ item.tags.Name }}.{{ domain_name }}"
    #     # overwrite: yes
    #     # private_zone: no
    #     # type: A
    #     # ttl: 7200
    #     # value: "{{ item.public_ip_address }}"
    #     # wait: no

    # - name: Delete private DNS entry for the ISE node(s)
    #   community.aws.route53:
    #     state: absent
    #     zone: "{{ domain_name }}"
    #     record: "{{ item.tags.Name }}.{{ domain_name }}"
    #     # overwrite: yes
    #     # private_zone: yes
    #     # type: A
    #     # wait: no


    # - name: Retrieve the DNS details
    #   community.aws.route53:
    #     state: get
    #     zone: "{{ domain_name }}"
    #     record: "{{ domain_name }}"
    #     type: A
    #   register: rec

    # - name: Show rec
    #   ansible.builtin.debug: var=rec

    # - name: Delete A records using the results from the get command
    #   community.aws.route53:
    #     state: absent
    #     zone: "{{ domain_name }}"
    #     record: "{{ rec.set.record }}"
    #     ttl: "{{ rec.set.ttl }}"
    #     type: "{{ rec.set.type }}"
    #     value: "{{ rec.set.value }}"


...