sudo apt update<\/span>\nsudo apt install<\/span> -y software-properties-common\nsudo apt-add<\/span>-repository --yes --update ppa:ansible\/ansible<\/span>\nsudo apt install<\/span> -y ansible\n<\/code><\/pre>\nref: https:\/\/docs.ansible.com\/ansible\/latest\/installation_guide\/intro_installation.html#installing-ansible-on-ubuntu<\/a><\/p>\nTerraform installation:<\/p>\n
wget https:<\/span>\/\/releases.hashicorp.com\/terraform\/0.12.24\/terraform_0.12.24_linux_amd64.zip<\/span>\nsudo unzip -d \/usr\/<\/span>local\/bin\/<\/span> .\/terraform_0.12<\/span>.24<\/span>_linux_amd64.zip\n<\/code><\/pre>\nref: https:\/\/www.techrepublic.com\/article\/how-to-install-terraform-on-ubuntu-server\/<\/a><\/p>\nAWS Client installation:<\/p>\n
curl \"https:\/\/awscli.amazonaws.com\/awscli-exe-linux-x86_64.zip\"<\/span> -o \"awscliv2.zip\"<\/span>\nunzip awscliv2.zip<\/span>\nsudo .\/aws\/install\n<\/code><\/pre>\nref: https:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/install-cliv2-linux.html<\/a><\/p>\nConnect your environment to your AWS cloud<\/h2>\n$ aws configure\nAWS Access<\/span> Key ID [None<\/span>]: AKIAIOSFODNN7EXAMPLE\nAWS Secret Access<\/span> Key [None<\/span>]: wJalrXUtnFEMI\/K7MDENG\/bPxRfiCYEXAMPLEKEY\nDefault<\/span> region name<\/span> [None<\/span>]: eu-central-a\nDefault<\/span> output format<\/span> [None<\/span>]: json\n<\/code><\/pre>\nref: https:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/cli-chap-configure.html#cli-quick-configuration<\/a><\/p>\nCreate a new Ansible project<\/h2>\n
That is my favorite Ansible layout. The one I’ve seen as the best so far:<\/p>\n
mkdir -p<\/span> ~\/my_aws_project\/inventory\nmkdir -p<\/span> ~\/my_aws_project\/playbooks\nmkdir -p<\/span> ~\/my_aws_project\/roles\n<\/code><\/pre>\nAdd the EC2 dynamic inventory<\/h2>\n
Ansible can work with a different kind of inventory called the dynamic inventory.
\nInstead of having a static declaration in a static file of your inventory, you can generate it from a source.
\nThis source can be a database, an active directory, etc. A dynamic inventory is a scrip that outputs a JSON in a structure that Ansible can handle. We could then develop a script that discovers our EC2 infrastructure that would take some time. Or we can use the one already provide with Ansible:<\/p>\n
Install prerequisites:<\/p>\n
sudo apt install<\/span> -y python3-pip\nsudo pip3 install<\/span> boto\nsudo pip3 install<\/span> ansible\nsudo rm \/usr\/bin<\/span>\/python\nsudo ln<\/span> -s \/usr\/bin<\/span>\/python3 \/usr\/bin<\/span>\/python\n<\/code><\/pre>\nGet the EC2 dynamic inventory:<\/p>\n
wget -O ~\/my_aws_project\/inventory<\/span>\/ec2.py \\\nhttps:\/<\/span>\/raw.githubusercontent.com\/ansible<\/span>\/ansible\/stable<\/span>-2.9<\/span>\/contrib\/inventory\/ec2.py\nwget -O ~\/my_aws_project\/inventory<\/span>\/ec2.ini \\\nhttps:\/<\/span>\/raw.githubusercontent.com\/ansible<\/span>\/ansible\/stable<\/span>-2.9<\/span>\/contrib\/inventory\/ec2.ini\nchmod +x ~\/my_aws_project\/inventory<\/span>\/ec2.py<\/span>\n<\/code><\/pre>\nThere are multiple configuration options you can do with the ini file. For this blog I’ll change those vars:<\/p>\n
regions<\/span> = eu-central-1<\/span>\nvpc_destination_variable<\/span> = private_ip_address\n<\/code><\/pre>\nTest the inventory script:<\/p>\n
~\/my_aws_project\/inventory\/ec2.py ## ---> return JSON description of<\/span> your AWS infrastructure\n<\/code><\/pre>\nBecause I want to work on one AWS region in the private network only. Since my bastion is already in
\nthe AWS infrastructure.<\/p>\n
Add a role for our deployment<\/h2>\n
I’ll create a role with the only purpose to deploy my infrastructure into AWS.<\/p>\n
ansible-galaxy init<\/span> --init<\/span>-path ~\/my_aws_project\/roles ec2_instances_dep\n<\/code><\/pre>\nCable the components (Ansible configuration)<\/h2>\n
To have that layout working fine and the simpliest way, I use that configuration:<\/p>\n
## file ~\/my_aws_project\/ansible.cfg<\/span>\n[defaults]<\/span>\nroles_path<\/span> = .\/roles\ninventory<\/span> = .\/inventory\/ec2.py\n<\/code><\/pre>\nTest the ansible inventory:<\/p>\n
cd<\/span> ~\/my_aws_project\nansible-inventory --graph ## ---> return the Ansible interpreted inventory<\/span>\n<\/code><\/pre>\nTerraform with Ansible<\/h2>\n
When I need to do something with Ansible, I first check in the list of modules<\/a> is the work is already done.
\nAnd, nicely, there is a module for Terraform<\/a>.<\/p>\nSo I can add this module in my task main file of my role:<\/p>\n
## ~\/my_aws_project\/roles\/ec2_instances_dep\/tasks\/main.yml<\/span>\n---<\/span>\n- name:<\/span> I create a directory to store my Terraform config\n file:<\/span>\n path:<\/span> \"~\/aws_terraform\"<\/span>\n state:<\/span> directory\n recurse:<\/span> yes<\/span>\n\n- name:<\/span> I copy my Terraform template into the working directory create above\n template:<\/span>\n src:<\/span> \"my_ec2_infra.tf\"<\/span>\n dest:<\/span> \"~\/aws_terraform\/my_ec2_infra.tf\"<\/span>\n\n- name:<\/span> I deploy my configuration into AWS from Ansible\n terraform:<\/span>\n project_path:<\/span> \"~\/aws_terraform\"<\/span>\n force_init:<\/span> true<\/span>\n state:<\/span> \"present\"<\/span>\n register:<\/span> r_aws\n\n- name:<\/span> I do whatever I need to do in my EC2 infrastructure\n debug:<\/span> msg=\"update, install, create user, start services, etc\"<\/span>\n\n- name:<\/span> I destroy my AWS infrastructure \n terraform:<\/span>\n project_path:<\/span> \"~\/aws_terraform\"<\/span>\n state:<\/span> \"absent\"<\/span>\n<\/code><\/pre>\nTerraform content<\/h2>\n
Add this file into the template directory: ~\/my_aws_project\/roles\/ec2_instances_dep<\/p>\n
## file ~\/my_aws_project\/roles\/ec2_instances_dep\/my_ec2_infra.tf<\/span>\nprovider \"aws\"<\/span> {\n region<\/span> = \"eu-central-1\"<\/span>\n}\n\nresource \"aws_instance\"<\/span> \"dba-essential\"<\/span> {\n count<\/span> = \"5\"<\/span>\n ami<\/span> = \"ami-0e342d72b12109f91\"<\/span>\n availability_zone<\/span> = \"eu-central-1a\"<\/span>\n instance_type<\/span> = \"t2.micro\"<\/span>\n associate_public_ip_address<\/span> = false<\/span>\n security_groups<\/span> = [\"my_sg_01\"<\/span>]\n vpc_security_group_ids<\/span> = [\"sg-602eff2724d52a0b7\"<\/span>]\n key_name<\/span> = \"my_key_01\"<\/span>\n\n root_block_device {\n delete_on_termination<\/span> = true<\/span>\n encrypted<\/span> = false<\/span>\n volume_size<\/span> = 15<\/span>\n volume_type<\/span> = \"gp2\"<\/span>\n }\n\n tags<\/span> = {\n Owner<\/span> = \"Nicolas\"<\/span>\n Name<\/span> = \"crash-test-${count.index + 1<\/span>}<\/span>\"<\/span>\n }\n\n}\n<\/code><\/pre>\nCreate a playbook to call the role<\/h2>\n## file ~\/my_aws_project\/playbooks\/deploy.yml<\/span>\n---<\/span>\n- name:<\/span> Deploy my infrastructure\n hosts:<\/span> localhost\n roles:<\/span>\n\n -<\/span> ec2_instances_dep\n<\/code><\/pre>\nRun the playbook<\/h2>\ncd<\/span> my_aws_project\nansible-playbook playbooks\/deploy.yml\n<\/code><\/pre>\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/ansible_aws.jpg\")
<\/a>Boom! Here it is. Now imagine that you can generate a unique key and unique directory for each deployment and you can deploy as much infrastructure as your credit card will accept it.<\/p>\n