{"id":6081,"date":"2020-03-04T05:52:29","date_gmt":"2020-03-04T10:52:29","guid":{"rendered":"\/db-blog\/?p=6081"},"modified":"2020-03-12T01:10:40","modified_gmt":"2020-03-12T05:10:40","slug":"aws-ansible-provision-an-ec2-instance-using-infrastructure-as-code","status":"publish","type":"post","link":"https:\/\/droidbasement.com\/db-blog\/aws-ansible-provision-an-ec2-instance-using-infrastructure-as-code\/","title":{"rendered":"AWS\/Ansible \u2013 Provision an EC2 instance using Infrastructure as Code"},"content":{"rendered":"\n

Note: Some of this is a duplicate of the AWS Lightsail<\/a> article; modified for EC2.<\/em><\/p>\n\n\n\n

EC2<\/a> is the compute service in AWS. It is flexible, adaptable, scalable and is able to run Virtual Machine workloads to fit most every need.<\/p>\n\n\n\n

In this article we will use Ansible<\/a> (Infrastructure as Code) to swiftly bring up an AWS EC2 instance in us-east-1 on a static IP (Elastic IP), in a new VPC with an Internet Gateway, add a DNS Zone (Route 53) for the site in mention and install docker\/docker-compose on it. <\/p>\n\n\n\n

We will use ‘myweb’ as an example in this article, using the same base path of ‘dev’ that was previously created<\/a>, the container-admin group<\/a> (some of the IAM policy implemented there will be in use here) and using ~\/.local\/bin|lib for the binaries\/libraries.<\/p>\n\n\n\n

Please use ‘<\/a>AWS Free Tier<\/a>‘<\/a> prior to commencing with this article. <\/p>\n\n\n\n

<\/p>\n\n\n\n

–>
Go in to the dev directory\/link located within your home directory:<\/p>\n\n\n\n

$ cd ~\/dev<\/pre>\n\n\n\n
Install\/Upgrade Ansible:<\/p>\n\n\n\n
$ pip3 install ansible --upgrade --user && chmod 754 ~\/.local\/bin\/ansible ~\/.local\/bin\/ansible-playbook<\/pre>\n\n\n\n
Install\/Upgrade Boto3:<\/p>\n\n\n\n
$ pip3 install boto3 --upgrade --user<\/pre>\n\n\n\n
Install\/Upgrade Boto (required by ec2_eip):<\/p>\n\n\n\n
$ pip3 install boto --upgrade --user<\/pre>\n\n\n\n
Create a work folder and change in to it:<\/p>\n\n\n\n
$ mkdir -p ansible\/myweb\/scripts && cd ansible\/myweb<\/pre>\n\n\n\n
Add an IAM Policy to the container-admin group so it will have access to EC2 and related (EIP\/VPC\/Routes\/IGW\/Route 53\/SG\/KeyPair):
AWS UI Console -> Services -> Security, Identity, & Compliance -> IAM -> Policies -> Create Policy -> JSON (replace <AWS ACCOUNT ID> in the Resource arn with your Account\u2019s ID (shown under the top right drop-down (of your name) within the My Account page next to the Account Id: under Account Settings)).<\/p>\n\n\n\n
Note: This is identical to the section in the AWS\/Terraform<\/a> article, but adds an allowance for route53:ListHostedZones, ec2:DescribeInstanceStatus and ec2:UpdateSecurityGroupRuleDescriptionsEgress: <\/p>\n\n\n\n
 {\n     \"Version\": \"2012-10-17\",\n     \"Statement\": [\n         {\n             \"Effect\": \"Allow\",\n             \"Action\": [\n                 \"ec2:UpdateSecurityGroupRuleDescriptionsEgress\",\n                 \"ec2:TerminateInstances\",\n                 \"route53:GetChange\",\n                 \"route53:GetHostedZone\",\n                 \"route53:ChangeTagsForResource\",\n                 \"route53:DeleteHostedZone\",\n                 \"route53:ListTagsForResource\" \n             ],\n             \"Resource\": [\n                \"arn:aws:ec2:*:<AWS ACCOUNT ID>:security-group\/\",\n                \"arn:aws:ec2:*:<AWS ACCOUNT ID>:instance\/*\",\n                \"arn:aws:route53:::hostedzone\/*\",\n                \"arn:aws:route53:::change\/*\"\n             ]      <\/em>\n         },\n         {\n             \"Effect\": \"Allow\",\n             \"Action\": [\n                 \"ec2:DisassociateAddress\",\n                 \"ec2:DeleteSubnet\",\n                 \"ec2:DescribeAddresses\",\n                 \"ec2:DescribeInstances\",\n                 \"ec2:DescribeInstanceAttribute\",\n                 \"ec2:CreateVpc\",\n                 \"ec2:AttachInternetGateway\",\n                 \"ec2:DescribeVpcAttribute\",\n                 \"ec2:AssociateRouteTable\",\n                 \"ec2:DescribeInternetGateways\",\n                 \"ec2:DescribeNetworkInterfaces\",\n                 \"ec2:CreateInternetGateway\",\n                 \"ec2:CreateSecurityGroup\",\n                 \"ec2:DescribeVolumes\",\n                 \"ec2:DescribeAccountAttributes\",\n                 \"ec2:ModifyVpcAttribute\",\n                 \"ec2:DescribeKeyPairs\",\n                 \"ec2:DescribeNetworkAcls\",\n                 \"ec2:DescribeRouteTables\",\n                 \"ec2:DescribeInstanceStatus\",\n                 \"ec2:ReleaseAddress\",\n                 \"ec2:ImportKeyPair\",\n                 \"ec2:DescribeTags\",\n                 \"ec2:DescribeVpcClassicLinkDnsSupport\",\n                 \"ec2:CreateRouteTable\",\n                 \"ec2:DetachInternetGateway\",\n                 \"ec2:DisassociateRouteTable\",\n                 \"ec2:AllocateAddress\",\n                 \"ec2:DescribeInstanceCreditSpecifications\",\n                 \"ec2:DescribeSecurityGroups\",\n                 \"ec2:DescribeVpcClassicLink\",\n                 \"ec2:DescribeImages\",\n                 \"ec2:DescribeVpcs\",\n                 \"ec2:DeleteVpc\",\n                 \"ec2:AssociateAddress\",\n                 \"ec2:CreateSubnet\",\n                 \"ec2:DescribeSubnets\",\n                 \"ec2:DeleteKeyPair\",\n                 \"route53:CreateHostedZone\",\n                 \"route53:ListHostedZones\",\n                 \"sts:GetCallerIdentity\"\n             ],\n             \"Resource\": \"*\"\n         }\n     ]\n }<\/pre>\n\n\n\n
Review Policy -><\/p>\n\n\n\n
Name: AllowEC2
Description: Allow access to EC2 and related.<\/p>\n\n\n\n
Create Policy.<\/p>\n\n\n\n
Groups -> container-admin -> Attach Policy -> Search for AllowEC2 -> Attach Policy.<\/p>\n\n\n\n
<\/p>\n\n\n\n
Generate an SSH Key Pair (no password) and restrict permissions on it:<\/p>\n\n\n\n
$ ssh-keygen -q -t rsa -b 2048 -N '' -f ~\/.ssh\/myweb && chmod 400 ~\/.ssh\/myweb<\/pre>\n\n\n\n
Create a hosts file and specify localhost:<\/p>\n\n\n\n
$ cat << 'EOF' > hosts\n> [local]\n> localhost\n> EOF<\/pre>\n\n\n\n
The following is performed with this script\/code:<\/p>\n\n\n\n