Cloud Automation with Ansible

# CHAPTER 13

Cloud Automation with Ansible #

1. Introduction #

2. Learning Objectives #

• Understand the difference between Infrastructure Provisioning and Configuration Management.

• Configure Ansible to authenticate with Cloud Provider APIs (specifically AWS).

• Utilize the amazon.aws collection to provision cloud resources.

• Create an EC2 virtual machine and a Security Group using Ansible.

• Understand the integration of dynamic inventories with cloud provisioning.

3. Beginner-Friendly Explanation #

• Provisioning (Building the Hardware): You hire construction workers to build the walls, run the plumbing, and install the ovens. (Creating the EC2 server and Firewalls in the cloud).

• Configuration (Setting up the Software): You hire a chef to organize the kitchen, design the menu, and start cooking. (Installing Nginx and your application code).

Usually, Terraform is the construction worker, and Ansible is the chef. However, Ansible is powerful enough that you can give the chef a hammer and tell them to build the kitchen themselves before they start cooking.

4. Setting up the AWS Environment #

*On your Control Node:*

pip install boto3
ansible-galaxy collection install amazon.aws

Authentication: Ansible relies on your environment variables. Never hardcode AWS keys in your playbook.

export AWS_ACCESS_KEY_ID="your_access_key"
export AWS_SECRET_ACCESS_KEY="your_secret_key"

5. Provisioning Cloud Infrastructure #

---
- name: Provision Cloud Infrastructure
  hosts: localhost # We run this on the control node to talk to the AWS API
  gather_facts: no
  
  tasks:
    # 1. Build the Firewall
    - name: Create Web Security Group
      amazon.aws.ec2_security_group:
        name: web_sg
        description: Allow HTTP traffic
        region: us-east-1
        rules:
          - proto: tcp
            ports: 80
            cidr_ip: 0.0.0.0/0
            
    # 2. Build the Server
    - name: Launch an EC2 Instance
      amazon.aws.ec2_instance:
        name: "My-Ansible-Web-Server"
        key_name: "my_ssh_key"
        instance_type: t2.micro
        security_group: web_sg
        region: us-east-1
        # The Amazon Linux 2 OS Image ID
        image_id: ami-0c02fb55956c7d316 
        wait: yes # Wait for the server to fully boot before finishing the task

6. Mini Project: The Ultimate End-to-End Workflow #

Step-by-Step Architecture Concept:

---
# PLAY 1: Build the Hardware
- name: Provision the EC2 Server
  hosts: localhost
  tasks:
    - name: Launch EC2 Instance
      amazon.aws.ec2_instance:
        name: "Dynamic-Web"
        instance_type: t2.micro
        image_id: ami-xyz
        wait: yes
      # Save the AWS response (which contains the new IP address) to a variable
      register: ec2_data

    # Magically add the brand new IP address to our in-memory inventory!
    - name: Add new instance to temporary host group
      add_host:
        # Extract the public IP from the JSON response
        hostname: "{{ ec2_data.instances[0].public_ip_address }}"
        groupname: new_cloud_servers

# PLAY 2: Configure the Software
# Target the group we JUST created in Play 1!
- name: Configure the New Server
  hosts: new_cloud_servers 
  become: yes
  # Wait for SSH to become available before attempting to log in
  gather_facts: no 
  
  tasks:
    - name: Wait for SSH to come up
      wait_for_connection:
        delay: 10
        timeout: 300
        
    - name: Install Apache
      yum:
        name: httpd
        state: present

*You run this playbook once. Ansible talks to AWS, builds a server, waits for it to turn on, logs into it via SSH, and installs the web server. Complete end-to-end automation.*

7. Real-World Scenarios #

8. Best Practices #

• Ansible vs Terraform: While the end-to-end workflow is cool, it is generally considered an anti-pattern for large production environments. Terraform is a "Declarative State Machine" designed specifically for hardware. Ansible is a "Procedural Task Runner" designed for software. The enterprise best practice is to use Terraform to build the AWS infrastructure, and use Terraform's local-exec provisioner to automatically trigger Ansible to configure the newly built servers. Use the best tool for the job.

9. Security Recommendations #

• IAM Instance Profiles: If you are running an Ansible Control Node on an EC2 instance in AWS, you do NOT need to use Access Keys or Secret Keys. You can assign an "IAM Instance Profile" to the Control Node. Ansible will automatically adopt the permissions of the underlying server, eliminating the need to manage vulnerable, long-lived API keys.

10. Troubleshooting Tips #

• Boto3 Version Errors: The AWS API changes constantly. If your ec2instance module fails with a strange Python error, it almost always means your boto3 and botocore libraries are outdated. Run pip install --upgrade boto3 botocore on your Control Node to fix it.

1. 1. Explain the operational function of the addhost module in a cloud provisioning workflow.

1. 2. Why do we set hosts: localhost when using modules like ec2instance or ec2securitygroup?

• Q: Compare and contrast the operational paradigms of using Ansible versus Terraform for cloud infrastructure provisioning. In what scenario would utilizing Ansible's ec2instance module be appropriate?

• Q: Describe the end-to-end automation workflow required to provision a cloud instance and immediately configure it within a single Ansible playbook run. Highlight the critical modules (register, addhost, waitfor_connection) required to bridge the gap between hardware creation and SSH availability.

14. Summary #

15. Next Chapter Recommendation #