Managing AWS Infrastructure

1. Using AWS Collection

Property	Description	Values
aws_access_key	Access key for AWS authentication	`string`
aws_secret_key	Secret key for AWS authentication	`string`
region	Region to use for AWS operations	`string`
security_token	Security token for temporary credentials	`string`

Example: Configure AWS credentials

- name: Configure AWS credentials
  hosts: localhost
  vars:
    aws_access_key: "AKIAIOSFODNN7EXAMPLE"
    aws_secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    region: "us-west-2"
  tasks:
    - name: Set AWS credentials
      set_fact:
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
        region: "{{ region }}"

Example: Launch EC2 instance

- name: Launch EC2 instance
  hosts: localhost
  vars:
    aws_access_key: "AKIAIOSFODNN7EXAMPLE"
    aws_secret_key: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
    region: "us-west-2"
  tasks:
    - name: Launch EC2 instance
      ec2_instance:
        name: "ansible-test-instance"
        image_id: "ami-0c55b159cbfafe1d0"
        instance_type: "t2.micro"
        region: "{{ region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"

Note: Ensure that the AWS credentials have appropriate permissions to launch EC2 instances and manage resources in the specified region.

2. Configuring AWS Credentials

Method	Description	Configuration	Notes
Environment Variables	Set AWS credentials as environment variables	`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`	Use for CLI or Ansible execution
IAM Roles (EC2)	Assign IAM roles to EC2 instances	Instance profile with appropriate policies	No credentials needed in code; IAM role assumed automatically
Shared Credentials File	Store credentials in `~/.aws/credentials`	`[default] aws_access_key_id = AKIAIOSFODNN7EXAMPLE aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY`	Supports named profiles with `[profile-name]`
AWS Config File	Store configuration in `~/.aws/config`	`[default] region = us-west-2 output = json`	Separates credentials from config
Command-Line Arguments	Pass credentials directly to Ansible commands	`--extra-vars "aws_access_key=... aws_secret_key=..."`	Not recommended for sensitive data

Example: Using Environment Variables

export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
ansible-playbook site.yml

Note: Ensure credentials are not hardcoded in playbooks or inventories.

Warning: Never commit AWS credentials to version control.

3. Managing EC2 Instances

Property	Description	Example
instance_type	Instance type to launch (e.g., t2.micro, m5.large)	`instance_type: t2.micro`
image_id	AMI ID to use for the instance	`image_id: ami-0c55b159cbfafe1d0`
key_name	Name of the SSH key pair to use	`key_name: my-key-pair`
security_groups	List of security groups to assign	`security_groups: [web-sg, db-sg]`
count	Number of instances to launch	`count: 2`
vpc_subnet_id	ID of the subnet to launch in	`vpc_subnet_id: subnet-12345678`

Example: Launching EC2 Instances

- name: Launch EC2 instances
  ec2_instance:
    instance_type: t3.micro
    image_id: ami-0c55b159cbfafe1d0
    key_name: my-key-pair
    security_groups:
      - web-sg
    count: 2
    vpc_subnet_id: subnet-12345678

Example: Tagging EC2 Instances

- name: Tag EC2 instances
  ec2_instance:
    instance_type: t3.micro
    image_id: ami-0c55b159cbfafe1d0
    key_name: my-key-pair
    security_groups:
      - web-sg
    count: 1
    tags:
      Name: WebServer
      Environment: Production

Note: Ensure that the security groups and subnets exist before launching instances.

Warning: Be cautious with count parameter as it can launch multiple instances at once.

4. Managing S3 Buckets

Property	Description	Example
bucket	Name of the S3 bucket	`my-ansible-bucket`
state	Whether the bucket should exist or be absent	`present` or `absent`
region	Region where the bucket is located	`us-west-2`
acl	Access control list for the bucket	`private`, `public-read`
tags	Tags to apply to the bucket	`{ "Environment": "Production", "Owner": "TeamA" }`

Example: Create S3 Bucket

- name: Create S3 bucket
  amazon.aws.s3_bucket:
    name: my-ansible-bucket
    state: present
    region: us-west-2
    acl: private
    tags:
      Environment: Production
      Owner: TeamA

Example: Delete S3 Bucket

- name: Delete S3 bucket
  amazon.aws.s3_bucket:
    name: my-ansible-bucket
    state: absent
    region: us-west-2

Note: Ensure that the bucket is empty before deletion or set force to true to delete all contents.

Property	Description	Values
bucket	Name of the S3 bucket	`my-ansible-bucket`
state	Whether the bucket should exist or be absent	`present`, `absent`
region	Region where the bucket is located	`us-east-1`, `us-west-2`, etc.
acl	Access control list for the bucket	`private`, `public-read`, `public-read-write`
force	Force deletion of bucket even if not empty	`true`, `false`

5. Managing VPCs

Property	Description	Values
vpc_id	Unique identifier for the VPC	`vpc-12345678`
cidr_block	IP address range for the VPC	`10.0.0.0/16`
region	AWS region where the VPC is created	`us-east-1`
tags	Tags to apply to the VPC	`{ "Name": "my-vpc", "Environment": "production" }`

Example: Create a VPC

- name: Create VPC
  ec2_vpc:
    name: "my-vpc"
    cidr_block: "10.0.0.0/16"
    region: "us-east-1"
    tags:
      Environment: "production"
    state: "present"

Example: Delete a VPC

- name: Delete VPC
  ec2_vpc:
    vpc_id: "vpc-12345678"
    region: "us-east-1"
    state: "absent"

Note: Ensure that all resources within the VPC are deleted before attempting to delete the VPC itself.

6. Managing Security Groups

Property	Description	Example
name	Name of the security group	`web-sg`
description	Description of the security group	`Security group for web servers`
vpc_id	ID of the VPC where the security group resides	`vpc-12345678`
rules	List of rules to apply to the security group	`[{'proto': 'tcp', 'from_port': 80, 'to_port': 80, 'cidr_ip': '0.0.0.0/0'}]`

Example: Create a Security Group

- name: Create security group
  amazon.aws.ec2_security_group:
    name: web-sg
    description: Security group for web servers
    vpc_id: vpc-12345678
    rules:
      - proto: tcp
        from_port: 80
        to_port: 80
        cidr_ip: 0.0.0.0/0

Example: Add Ingress Rule to Security Group

- name: Add SSH rule to security group
  amazon.aws.ec2_security_group:
    name: web-sg
    description: Security group for web servers
    vpc_id: vpc-12345678
    rules:
      - proto: tcp
        from_port: 22
        to_port: 22
        cidr_ip: 0.0.0.0/0

Example: Remove a Rule from Security Group

- name: Remove HTTP rule from security group
  amazon.aws.ec2_security_group:
    name: web-sg
    description: Security group for web servers
    vpc_id: vpc-12345678
    rules:
      - proto: tcp
        from_port: 80
        to_port: 80
        cidr_ip: 0.0.0.0/0
    rules_egress:
      - proto: all
        cidr_ip: 0.0.0.0/0

Note: When managing security groups, ensure that the VPC ID is correctly specified to avoid applying rules to the wrong network.

7. Managing IAM Resources

Resource	Module	Description
aws_iam_user	`community.aws.aws_iam_user`	Manage IAM users with attributes like permissions, groups, and MFA.
aws_iam_group	`community.aws.aws_iam_group`	Create and manage IAM groups for organizing users.
aws_iam_role	`community.aws.aws_iam_role`	Create IAM roles with trust policies and attached managed policies.
aws_iam_policy	`community.aws.aws_iam_policy`	Create and manage custom IAM policies.

Example: Create an IAM User

- name: Create IAM user
  community.aws.aws_iam_user:
    name: "john_doe"
    state: present
    password_reset_required: false

Example: Attach Policy to IAM Group

- name: Attach managed policy to group
  community.aws.aws_iam_group_membership:
    group_name: "developers"
    users:
      - "john_doe"

Example: Create IAM Role with Trust Policy

- name: Create IAM role for EC2
  community.aws.aws_iam_role:
    name: "ec2-s3-access"
    assume_role_policy_document: "{\n  \"Version\": \"2012-10-17\",\n  \"Statement\": [\n    {\n      \"Effect\": \"Allow\",\n      \"Principal\": {\n        \"Service\": \"ec2.amazonaws.com\"\n      },\n      \"Action\": \"sts:AssumeRole\"\n    }\n  ]\n}"
    managed_policies:
      - "arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess"

Note: Ensure the aws_iam_role module has appropriate permissions to assume roles and attach managed policies.

8. Managing RDS Instances

Property	Description	Values	Notes
aws_rds.instance_identifier	Unique identifier for the RDS instance	`mydb-instance`	Required field
aws_rds.engine	Database engine to use	`mysql`, `postgres`, `oracle`	Must match supported engines
aws_rds.db_instance_class	Instance type for the RDS instance	`db.t3.micro`, `db.m5.large`	See AWS documentation for valid types
aws_rds.db_name	Name of the initial database to create	`myappdb`	Optional, defaults to engine-specific name
aws_rds.master_username	Master username for the database	`admin`	Required for most engines
aws_rds.master_user_password	Password for the master user	`secret123`	Must be at least 8 characters
aws_rds.allocated_storage	Storage size in GB	`20`	Minimum 20GB, increases in 1GB increments
aws_rds.vpc_security_group_ids	Security groups to associate with the instance	`[sg-12345678]`	Must be valid security group IDs
aws_rds.db_subnet_group_name	Name of the DB subnet group to use	`my-subnet-group`	Required if using VPC
aws_rds.multi_az	Whether to enable Multi-AZ deployment	`true`, `false`	Defaults to false
aws_rds.backup_retention_period	Number of days to retain automated backups	`7`	Valid range: 0-35, default is 1
aws_rds.storage_type	Storage type to use for the DB instance	`gp2`, `gp3`	Defaults to gp2
aws_rds.publicly_accessible	Whether the DB instance is publicly accessible	`true`, `false`	Defaults to false

Example: Create an RDS Instance

- name: Create RDS instance
  amazon.aws.ec2_rds:
    state: present
    instance_identifier: mydb-instance
    engine: mysql
    db_instance_class: db.t3.micro
    db_name: myappdb
    master_username: admin
    master_user_password: secret123
    allocated_storage: 20
    vpc_security_group_ids:
      - sg-12345678
    db_subnet_group_name: my-subnet-group
    multi_az: false
    backup_retention_period: 7
    storage_type: gp2
    publicly_accessible: false

Example: Modify RDS Instance Storage

- name: Modify RDS instance storage
  amazon.aws.ec2_rds:
    state: present
    instance_identifier: mydb-instance
    allocated_storage: 50
    apply_immediately: true

Note: Ensure that the security group allows appropriate access to the RDS instance from your Ansible control node or application servers.

9. Using Dynamic Inventory

Property	Description	Example
aws_ec2	Plugin to fetch EC2 instances from AWS	`plugin: aws_ec2`
regions	List of AWS regions to query	`regions: [us-east-1, us-west-2]`
filters	EC2 instance filters to apply	`filters: { "instance-state-name": "running" }`

Example: Basic Dynamic Inventory Configuration

plugin: aws_ec2
regions:
  - us-east-1
  - us-west-2
filters:
  instance-state-name: running

Note: Requires boto3 and AWS credentials configured via environment variables or IAM roles.

Example: Using Dynamic Inventory with Groups

plugin: aws_ec2
regions:
  - us-east-1
filters:
  instance-state-name: running
group_by:
  - instance_type
  - tag:Environment

10. Managing Load Balancers

Property	Description	Example
aws_elb_lb	Module to manage Elastic Load Balancers (ELB) in AWS	`aws_elb_lb:`
name	Name of the load balancer	`name: "my-elb"`
subnets	List of subnet IDs to attach the ELB to	`subnets: ["subnet-12345", "subnet-67890"]`
security_groups	List of security group IDs to assign to the ELB	`security_groups: ["sg-12345"]`
scheme	Internet-facing or internal ELB (default: internet-facing)	`scheme: "internal"`
listeners	List of listener configurations (port, protocol, etc.)	`listeners: [{"protocol": "HTTP", "load_balancer_port": 80}]`

Example: Create an ELB with HTTP listener

---
- hosts: localhost
  tasks:
    - name: Create an ELB
      aws_elb_lb:
        name: "my-web-elb"
        subnets:
          - "subnet-12345"
          - "subnet-67890"
        security_groups:
          - "sg-12345"
        scheme: "internet-facing"
        listeners:
          - protocol: "HTTP"
            load_balancer_port: 80
            instance_port: 80

Note: Ensure that the subnets and security groups exist in your AWS account before creating the ELB.

Example: Update an existing ELB with new listeners

---
- hosts: localhost
  tasks:
    - name: Update ELB listeners
      aws_elb_lb:
        name: "my-web-elb"
        listeners:
          - protocol: "HTTPS"
            load_balancer_port: 443
            instance_port: 80
            ssl_certificate_id: "arn:aws:acm:us-east-1:123456789012:certificate/12345678-1234-1234-1234-123456789012"

Warning: Modifying listeners on an existing ELB may cause downtime if not handled carefully.

Property	Description	Notes
aws_elb_target_group	Module to manage target groups for Application Load Balancers (ALB)	Used with ALBs to define where traffic should be routed
name	Name of the target group	Must be unique within the region
port	Port to route traffic to	Must match the instance port in your target group
protocol	Protocol to use for routing (HTTP or HTTPS)	Must match the protocol used by your instances
vpc_id	ID of the VPC where the target group is created	Required for ALB target groups
health_check	Configuration for health checks on targets	Allows you to define how often and how to check target health

Example: Create a target group for an ALB

---
- hosts: localhost
  tasks:
    - name: Create ALB target group
      aws_elb_target_group:
        name: "my-target-group"
        port: 80
        protocol: "HTTP"
        vpc_id: "vpc-12345"
        health_check:
          healthy_threshold_count: 2
          unhealthy_threshold_count: 3
          interval_seconds: 30
          timeout_seconds: 5
          path: "/"

Note: Target groups are required when using Application Load Balancers (ALB) and can be used with multiple instance types or services.