Using IAM roles to generate a dynamic inventory for Ansible

Question

I'm looking at setting up a deploy server within our VPC and am trying to use an IAM role instead of keys for Ansibles dynamic ec2.py inventory script.

An answer at Can I use IAM Roles for Ansible says it is possible, however it does not indicate what permission are required.

I'm wondering if someone is able to provide some more details on what permissions are needed to be able to generate a dynamic inventory.

Edit: I've reviewed the docs and I think part of the solution is figuring out what permissions botos get_all_instances() needs.

when you run it, how does it fail? – tedder42 Oct 19 '15 at 20:43 — tedder42, Oct 19 '15 at 20:43

score 3 · Answer 1 · answered Oct 19 '15 at 18:33

Assuming the only inventory you want are EC2 based resources, then allowing the "ec2:Describe*" actions should be sufficient:

"Effect": "Allow",
"Action": "ec2:Describe*",
"Resource": "*"

See Allow users to list the Amazon EC2 resources that belong to the AWS account

Yonsy Solis · Answer 2 · 2016-01-05T01:53:58.230

Log in to the AWS management console. Go to Identity & Access Management/Roles/Create New Role
Give your role a name, for example ansible because the instance with this role will run Ansible.
Under AWS Service Roles select Amazon EC2
Select Power User Access you will have a policy name and a policy document, one JSON string like this:

   {
        "Version": "20XX-XX-XX",
        "Statement": [
            {
                "Effect": "Allow",
                "NotAction": "iam:*",
                "Resource": "*"
            }
        ]
    }

Next Step/Create Role
You will have an instance profile with the same name that you give to your role, and the role will be associated to the instance profile. Now, when you create the new instance for Ansible deploy, you will give this instance profile to the instance, and this instance will have the permissions for the role.

Using IAM roles to generate a dynamic inventory for Ansible

2 Answers2