If our goal is configuring AWS using Ansible, the first thing that we need to do is configure our Ansible control node for the job, and provide appropriate credentials. In this hands-on lab, we will configure a new IAM user in the AWS console to allow Ansible to connect to the console programmatically. The credentials need to be protected, so they will be supplied by means of an encrypted Ansible vault.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Create a new IAM user called `ansible` with programmatic access keys and the *AmazonEC2ReadOnlyAccess* role.
- Log into the AWS console using the provided AWS URL and
cloud_useraccount. - Search for IAM in the Find Services search box, and select the IAM that shows up in the pop up box.
- Select Users in the left menu.
- Click Add User at the top of the page.
- Provide the username ansible and check the box next to Programmatic access for access type.
- Click Next: Permissions.
- Select Attach existing policies directly and search for AmazonEC2ReadOnlyAccess using the filter policies search box.
- Check the box next to AmazonEC2ReadOnlyAccess.
- Click Next: Tags, then Next: Review, and lastly, after ensuring your configurations are correct, click Create user.
- Click Show under Secret access key to reveal the secret access key for the
ansibleuser. - Important! Copy the Access key ID and Secret access key to a place where you may access them later, like a text file.
- Log into the AWS console using the provided AWS URL and
- Edit the file `/home/ansible/keys.yml` and replace the place holders with the ansible IAM user’s access key, secret key, and appropriate AWS region. Then encrypt the file using `ansible-vault`. The vault should use the password “I love ansible”.
Log into the Ansible control node as the
ansibleuser.- Open
/home/ansible/keys.ymlusing a text editor such as Vim, and replace each place holder with the appropriate value. - Run
ansible-vault encrypt /home/ansible/keys.ymlusing the password "I love ansible".
- Open
- Install the necessary boto and boto3 packages on the Ansible control node.
- Log into the Ansible control node as the
ansibleuser. - Run the following command to install the boto packages on the Ansible control node:
sudo yum install -y python-boto python-boto3
- Log into the Ansible control node as the
- Run the provided playbook to validate that your `ansible` user and vault are correctly configured.
- Log into the Ansible control node as the
ansibleuser. - Run the following command:
ansible-playbook --ask-vault-pass /home/ansible/test-aws-connection.yml
- Log into the Ansible control node as the
