In this tutorial, we are going to create a VPC using Ansible in AWS. Our VPC will include a router, subnet, IGW, Security Group and definitely an EC2 instance.
This is the topology we would create. (I have mentioned the Ansible Module so as to make it easier)
Prerequisites
- IAM User with the required permission.
- Boto installed. (Ansible uses the Boto Python library to handle AWS management)
If you are planning to improve your IAM security, please read my guide on it.
1. Creating a custom Role
We would first create an AWS VPC Role.
1 | ansible-galaxy init aws-vpc |
We would be using the two files below from our aws-vpc role.
1 2 3 4 | - tasks - main.yml- vars -main.yml |
Variables
We will place the variables in the vars/main.yml file. This allows the role to be easily reusable. Modify the variables depending on your requirement but replace your AWS Access and Secret key.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 | ---#vars/main.ymlaws_access_key: ""aws_secret_key: ""region: "us-east-1"# VPCvpc_cidr: 10.10.0.0/24vpc_name: "Ansible VPC"# Subnetsubnet_name: "Ansible Subnet"subnet_cidr: 10.10.0.0/26# Internet Gateway Nameigw_name: "Traffic IGW"securitygroup_name: "Ansible Security Group"ec2_tag: "WebServer"#The local path to which we would save our EC2 Private Keyec2_key_directory: "/home/ansible/roles/aws-vpc/"keypair_name: "ec2_key_pair" |
Do not store your AWS credentials as a variable! Follow the best practice
2. Creating the VPC
Our VPC will include the following components.
- VPC
- Subnet
- Router
- IGW (Internet Gateway)
- Security Group
- EC2 Instance
We will write all the code below in the tasks/main.yml file.
a) VPC
To create a VPC, we have to use the ec2_vpc_net module. We will register the module returned data in the “vpc” variable.
1 2 3 4 5 6 7 8 9 | - name: create VPC ec2_vpc_net: name: "{{ vpc_name }}" cidr_block: "{{ vpc_cidr }}" region: "{{ region }}" state: present aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" register: vpc |
b) Creating a subnet and associating it with an Internet Gateway
Now that we have successfully created a VPC. We would need to create a subnet and an IGW. We need an IGW so that our public subnet can access the internet.
In our subnet, we have set map_public to “YES”. This means instances created in this subnet is associated with a public IP address.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 | - name: associate subnet to the VPC ec2_vpc_subnet: state: present vpc_id: "{{ vpc_id }}" region: "{{ region }}" cidr: "{{ subnet_cidr }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" map_public: yes resource_tags: Name: "{{ subnet_name }}" register: subnet- name: create IGW ec2_vpc_igw: vpc_id: "{{ vpc_id }}" region: "{{ region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" state: "present" tags: Name: "{{ igw_name }}" register: igw |
c) Routing traffic to IGW and creating a security group
Now, we would need to route the traffic to the IGW via the route table and create a security group.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 | - name: Route IGW ec2_vpc_route_table: vpc_id: "{{ vpc_id }}" region: "{{ region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" subnets: - "{{ subnet.subnet.id }}" routes: - dest: 0.0.0.0/0 gateway_id: "{{ igw.gateway_id }}" tags: Name: "{{ route_name }}"# update the CIDR address in the SSH port section. - name: Create Security Group ec2_group: name: Web DMZ description: DMZ Security Group vpc_id: "{{ vpc_id }}" region: "{{ region }}" aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" rules: - proto: tcp ports: - 80 cidr_ip: 0.0.0.0/0 - proto: tcp ports: - 22 cidr_ip: 0.0.0.0/0 register: security_group |
d) Creating an EC2 Key Pair and an EC2 instance
This is our last step, we will create an EC2 Key Pair and an EC2 instance.
Key points:
- if you already have an EC2 key pair, skip the EC2 key pair and update the key_name with the name of the key pair.
- exact_count is important! It determines the number of instances is created.
- Image ID can be found on AWS Marketplace.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 | - name: create a new ec2 key pair ec2_key: aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" name: ec2_keypair region: "{{ region }}" register: keypair- name: Copy EC2 Private Key locally so it can be later on used to SSH into the instance copy: content="{{ keypair.key.private_key }}" dest={{ ec2_key_directory }}key.ppk when: keypair.changed == true - name: Create EC2 server ec2: image: ami-467ca739 wait: yes instance_type: t2.micro region: "{{ region }}" group_id: "{{ security_group.group_id }}" vpc_subnet_id: "{{ subnet.subnet.id }}" key_name: "{{ keypair.key.name }}" count_tag: Name: apacheserver exact_count: 1 aws_access_key: "{{ aws_access_key }}" aws_secret_key: "{{ aws_secret_key }}" |
This creates a simple VPC but creating a complex VPC is still achievable with Ansible, as it provides all the necessary modules for a VPC creation in the AWS.
