Videos
I have a good bit of experience using Ansible to deploy and configure on-prem resources (vmware, linux, windows). I am now delving into trying to m maintain a consistent configuration of resources in AWS.
I'm currently trying to get my head around the best way to maintain s3 bucket configurations. I need to ensure that all existing and future buckets are configured with various properties by default, such as encryption, bucket policy, lifecycle, logging, and so on. I can write a playbook that configures these settings for a given bucket name, no problems there.
I guess I'm having a hard time getting out of the "host/inventory" mindset. I don't really see a way to define variables for individual buckets to have specific settings outside of the defaults, and I don't really see a way to only run a playbook against a "group" of buckets. There also isn't a "dynamic" inventory plugin for buckets in ansible that I have found.
Other than having my playbook either:
-
do the same thing on all buckets (list all buckets in one task, then run the things on all buckets in subsequent tasks with the same settings); or
-
do the same thing, but having to specify the bucket name every time I run it;
I don't see much flexibility here with being able to manage bucket configurations in Ansbile.
Am I approaching this incorrectly, or is this simply not the tool for my use case? How are others doing this?
Thanks in advance
S3 module in ansible doesn't support the profile option, but you can use like this, if you have exported the aws_key and aws_secret as variables:
export aws_key="AAAAAAAAAAAAAAAAAAAAAAAAAA"
export aws_secret="XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
Then you can use them like this:
s3:
aws_access_key: "{{ lookup('env','aws_key') }}"
aws_secret_key: "{{ lookup('env','aws_secret') }}"
bucket: "my-bucket"
object: "/data.zip"
mode: get
Hope this will help you or anyone, who is looking for, to use the local environment variables inside the ansible playbook. Thanks
In a EC2 instance the best way to authorise running code to access AWS resource is to use IAM Role.
You assign a role to any instance when starting it. Any policy can be set to the role.
Inside the instance any process can connect to a known URL to retrieve temps keys in order to authenticate to any AWS service.
Boto, the Python library used by the Ansible S3 module, has automatic support for IAM roles. So if no key is provided directly or in the environment variable, Boto will query the known URL to get the instance key.
More details on how IAM roles work can be found here: http://docs.aws.amazon.com/IAM/latest/UserGuide/roles-usingrole-ec2instance.html#role-usecase-ec2app-permissions