community / community.aws / 7.2.0 / connection / aws_ssm connect to EC2 instances via AWS Systems Manager Authors: Pat Sharkey (@psharkey) <psharkey@cleo.com>, HanumanthaRao MVL (@hanumantharaomvl) <hanumanth@flux7.com>, Gaurav Ashtikar (@gau1991) <gaurav.ashtikar@flux7.com>community.aws.aws_ssm (7.2.0) — connection
Install with ansible-galaxy collection install community.aws:==7.2.0
collections: - name: community.aws version: 7.2.0
This connection plugin allows Ansible to execute tasks on an EC2 instance via an AWS SSM Session.
--- # Wait for SSM Agent to be available on the Instance - name: Wait for connection to be available vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 # When the S3 bucket isn't in the same region as the Instance # Explicitly setting the addressing style to 'virtual' may be necessary # https://repost.aws/knowledge-center/s3-http-307-response ansible_aws_ssm_s3_addressing_style: virtual tasks: - name: Wait for connection wait_for_connection:
# Stop Spooler Process on Windows Instances - name: Stop Spooler Service on Windows Instances vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Stop spooler service win_service: name: spooler state: stopped
# Install a Nginx Package on Linux Instance - name: Install a Nginx Package vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 tasks: - name: Install a Nginx Package yum: name: nginx state: present
# Create a directory in Windows Instances - name: Create a directory in Windows Instance vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Create a Directory win_file: path: C:\Windows\temp state: directory
--- # Wait for SSM Agent to be available on the Instance - name: Wait for connection to be available vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 # When the S3 bucket isn't in the same region as the Instance # Explicitly setting the addressing style to 'virtual' may be necessary # https://repost.aws/knowledge-center/s3-http-307-response ansible_aws_ssm_s3_addressing_style: virtual tasks: - name: Wait for connection wait_for_connection: # Stop Spooler Process on Windows Instances - name: Stop Spooler Service on Windows Instances vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Stop spooler service win_service: name: spooler state: stopped # Install a Nginx Package on Linux Instance - name: Install a Nginx Package vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 tasks: - name: Install a Nginx Package yum: name: nginx state: present # Create a directory in Windows Instances - name: Create a directory in Windows Instance vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Create a Directory win_file: path: C:\Windows\temp state: directory --- # Making use of Dynamic Inventory Plugin # ======================================= # # aws_ec2.yml (Dynamic Inventory - Linux) # plugin: aws_ec2 # regions: # - us-east-1 # hostnames: # - instance-id # # This will return the Instances with the tag "SSMTag" set to "ssmlinux" # filters: # tag:SSMTag: ssmlinux # ----------------------- - name: install aws-cli hosts: all gather_facts: false vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: aws-cli raw: yum install -y awscli tags: aws-cli
--- # Wait for SSM Agent to be available on the Instance - name: Wait for connection to be available vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 # When the S3 bucket isn't in the same region as the Instance # Explicitly setting the addressing style to 'virtual' may be necessary # https://repost.aws/knowledge-center/s3-http-307-response ansible_aws_ssm_s3_addressing_style: virtual tasks: - name: Wait for connection wait_for_connection: # Stop Spooler Process on Windows Instances - name: Stop Spooler Service on Windows Instances vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Stop spooler service win_service: name: spooler state: stopped # Install a Nginx Package on Linux Instance - name: Install a Nginx Package vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 tasks: - name: Install a Nginx Package yum: name: nginx state: present # Create a directory in Windows Instances - name: Create a directory in Windows Instance vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Create a Directory win_file: path: C:\Windows\temp state: directory --- # Making use of Dynamic Inventory Plugin # ======================================= # # aws_ec2.yml (Dynamic Inventory - Linux) # plugin: aws_ec2 # regions: # - us-east-1 # hostnames: # - instance-id # # This will return the Instances with the tag "SSMTag" set to "ssmlinux" # filters: # tag:SSMTag: ssmlinux # ----------------------- - name: install aws-cli hosts: all gather_facts: false vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: aws-cli raw: yum install -y awscli tags: aws-cli --- # Execution: ansible-playbook linux.yaml -i aws_ec2.yml # ===================================================== # # aws_ec2.yml (Dynamic Inventory - Windows) # plugin: aws_ec2 # regions: # - us-east-1 # hostnames: # - instance-id # # This will return the Instances with the tag "SSMTag" set to "ssmwindows" # filters: # tag:SSMTag: ssmwindows # ----------------------- - name: Create a dir. hosts: all gather_facts: false vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Create the directory win_file: path: C:\Temp\SSM_Testing5 state: directory
--- # Wait for SSM Agent to be available on the Instance - name: Wait for connection to be available vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 # When the S3 bucket isn't in the same region as the Instance # Explicitly setting the addressing style to 'virtual' may be necessary # https://repost.aws/knowledge-center/s3-http-307-response ansible_aws_ssm_s3_addressing_style: virtual tasks: - name: Wait for connection wait_for_connection: # Stop Spooler Process on Windows Instances - name: Stop Spooler Service on Windows Instances vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Stop spooler service win_service: name: spooler state: stopped # Install a Nginx Package on Linux Instance - name: Install a Nginx Package vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 tasks: - name: Install a Nginx Package yum: name: nginx state: present # Create a directory in Windows Instances - name: Create a directory in Windows Instance vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Create a Directory win_file: path: C:\Windows\temp state: directory --- # Making use of Dynamic Inventory Plugin # ======================================= # # aws_ec2.yml (Dynamic Inventory - Linux) # plugin: aws_ec2 # regions: # - us-east-1 # hostnames: # - instance-id # # This will return the Instances with the tag "SSMTag" set to "ssmlinux" # filters: # tag:SSMTag: ssmlinux # ----------------------- - name: install aws-cli hosts: all gather_facts: false vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: aws-cli raw: yum install -y awscli tags: aws-cli --- # Execution: ansible-playbook linux.yaml -i aws_ec2.yml # ===================================================== # # aws_ec2.yml (Dynamic Inventory - Windows) # plugin: aws_ec2 # regions: # - us-east-1 # hostnames: # - instance-id # # This will return the Instances with the tag "SSMTag" set to "ssmwindows" # filters: # tag:SSMTag: ssmwindows # ----------------------- - name: Create a dir. hosts: all gather_facts: false vars: ansible_connection: aws_ssm ansible_shell_type: powershell ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-east-1 tasks: - name: Create the directory win_file: path: C:\Temp\SSM_Testing5 state: directory --- # Execution: ansible-playbook win_file.yaml -i aws_ec2.yml # The playbook tasks will get executed on the instance ids returned from the dynamic inventory plugin using ssm connection. # Install a Nginx Package on Linux Instance; with specific SSE CMK used for the file transfer - name: Install a Nginx Package vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 ansible_aws_ssm_bucket_sse_mode: 'aws:kms' ansible_aws_ssm_bucket_sse_kms_key_id: alias/kms-key-alias tasks: - name: Install a Nginx Package yum: name: nginx state: present
# Install a Nginx Package on Linux Instance; using the specified SSM document - name: Install a Nginx Package vars: ansible_connection: aws_ssm ansible_aws_ssm_bucket_name: nameofthebucket ansible_aws_ssm_region: us-west-2 ansible_aws_ssm_document: nameofthecustomdocument tasks: - name: Install a Nginx Package yum: name: nginx state: present
plugin: default: /usr/local/bin/session-manager-plugin description: This defines the location of the session-manager-plugin binary. vars: - name: ansible_aws_ssm_plugin region: default: us-east-1 description: The region the EC2 instance is located. env: - name: AWS_REGION - name: AWS_DEFAULT_REGION vars: - name: ansible_aws_ssm_region profile: description: Sets AWS profile to use. env: - name: AWS_PROFILE vars: - name: ansible_aws_ssm_profile version_added: 1.5.0 version_added_collection: community.aws bucket_name: description: The name of the S3 bucket used for file transfers. vars: - name: ansible_aws_ssm_bucket_name instance_id: description: The EC2 instance ID. vars: - name: ansible_aws_ssm_instance_id ssm_timeout: default: 60 description: Connection timeout seconds. type: integer vars: - name: ansible_aws_ssm_timeout ssm_document: description: - SSM Session document to use when connecting. - To configure the remote_user (when C(become=False), it is possible to use an SSM Session document and define the C(runAsEnabled) and C(runAsDefaultUser) parameters. See also U(https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager-schema.html) vars: - name: ansible_aws_ssm_document version_added: 5.2.0 version_added_collection: community.aws access_key_id: description: The STS access key to use when connecting via session-manager. env: - name: AWS_ACCESS_KEY_ID vars: - name: ansible_aws_ssm_access_key_id version_added: 1.3.0 version_added_collection: community.aws session_token: description: The STS session token to use when connecting via session-manager. env: - name: AWS_SESSION_TOKEN vars: - name: ansible_aws_ssm_session_token version_added: 1.3.0 version_added_collection: community.aws bucket_sse_mode: choices: - AES256 - aws:kms description: Server-side encryption mode to use for uploads on the S3 bucket used for file transfer. required: false vars: - name: ansible_aws_ssm_bucket_sse_mode version_added: 2.2.0 version_added_collection: community.aws secret_access_key: description: The STS secret key to use when connecting via session-manager. env: - name: AWS_SECRET_ACCESS_KEY vars: - name: ansible_aws_ssm_secret_access_key version_added: 1.3.0 version_added_collection: community.aws bucket_endpoint_url: description: The S3 endpoint URL of the bucket used for file transfers. vars: - name: ansible_aws_ssm_bucket_endpoint_url version_added: 5.3.0 version_added_collection: community.aws s3_addressing_style: choices: - path - virtual - auto default: auto description: - The addressing style to use when using S3 URLs. - When the S3 bucket isn't in the same region as the Instance explicitly setting the addressing style to 'virtual' may be necessary U(https://repost.aws/knowledge-center/s3-http-307-response) as this forces the use of a specific endpoint. vars: - name: ansible_aws_ssm_s3_addressing_style version_added: 5.2.0 version_added_collection: community.aws reconnection_retries: default: 3 description: Number of attempts to connect. type: integer vars: - name: ansible_aws_ssm_retries bucket_sse_kms_key_id: description: KMS key id to use when encrypting objects using C(bucket_sse_mode=aws:kms). Ignored otherwise. vars: - name: ansible_aws_ssm_bucket_sse_kms_key_id version_added: 2.2.0 version_added_collection: community.aws