redhat-cop/cloud.aws_ops

Ansible Roles for managing AWS Resources

cloud.aws_ops roles/playbooks/rulebooks to demo Ansible on AWS

This repository hosts the cloud.aws_ops Ansible Collection.

The collection includes a variety of Ansible roles, playbooks, and rulebooks to help automate the management of resources on AWS.

Ansible version compatibility

This collection has been tested against following Ansible versions: >=2.14.0.

Included content

Click on the name of a role, playbook, or rulebook to view that content's documentation:

Roles

Name	Description
cloud.aws_ops.aws_setup_credentials	A role to define credentials for aws modules.
cloud.aws_ops.awsconfig_detach_and_delete_internet_gateway	A role to detach and delete the internet gateway you specify from virtual private cloud.
cloud.aws_ops.awsconfig_multiregion_cloudtrail	A role to create/delete a Trail for multiple regions.
cloud.backup_create_plan	A role to create an AWS backup plan.
cloud.backup_select_resources	A role to select resources to back up with an existing backup plan.
cloud.aws_ops.customized_ami	A role to manage custom AMIs on AWS.
cloud.aws_ops.ec2_instance_terminate_by_tag	A role to terminate the EC2 instances based on a specific tag you specify.
cloud.aws_ops.enable_cloudtrail_encryption_with_kms	A role to encrypt an AWS CloudTrail trail using the AWS Key Management Service (AWS KMS) customer managed key you specify.
cloud.aws_ops.manage_vpc_peering	A role to create, delete and accept existing VPC peering connections.
cloud.aws_ops.moving_objects_between_buckets	A role to move objects from one bucket to another bucket.
cloud.aws_ops.awsconfig_apigateway_with_lambda_integration	A role to create/delete an API gateway with lambda function integration.
cloud.aws_ops.manage_transit_gateway	A role to create/delete transit_gateway with vpc and vpn attachments.
cloud.aws_ops.deploy_flask_app	A role to deploy a flask web application on AWS.
cloud.aws_ops.create_rds_global_cluster	A role to create, delete aurora global cluster with a primary cluster and a replica cluster in different regions.
cloud.aws_ops.clone_on_prem_vm	A role to clone an existing on prem VM using the KVM hypervisor.
cloud.aws_ops.import_image_and_run_aws_instance	A role that imports a local .raw image into an Amazon Machine Image (AMI) and run an AWS EC2 instance.

Playbooks

Name	Description
cloud.aws_ops.eda	A set of playbooks to restore AWS Cloudtrail configurations, created for use with the cloud.aws_manage_cloudtrail_encryption rulebook.
cloud.aws_ops.webapp	A set of playbooks to create, delete, or migrate a webapp on AWS.
cloud.aws_ops.upload_file_to_s3	A playbook to upload a local file to S3.
cloud.aws_ops.move_vm_from_on_prem_to_aws	A playbook to migrate an existing on prem VM running on KVM hypervisor to AWS.

Rulebooks

Name	Description
cloud.aws_ops.aws_manage_cloudtrail_encryption	An Event-Driven Ansible rulebook to ensure that an existing encrypted AWS Cloudtrail trail will not be deleted or have its encryption removed.

Installation and Usage

Requirements

The amazon.aws and community.aws collections MUST be installed in order for this collection to work.

To run rulebooks, ansible-rulebook must be installed.

Installation

To consume this Validated Content from Automation Hub, please ensure that you add the following lines to your ansible.cfg file.

[galaxy]
server_list = automation_hub

[galaxy_server.automation_hub]
url=https://cloud.redhat.com/api/automation-hub/
auth_url=https://sso.redhat.com/auth/realms/redhat-external/protocol/openid-connect/token
token=<SuperSecretToken>

The token can be obtained from the Automation Hub Web UI.

Once the above steps are done, you can run the following command to install the collection.

ansible-galaxy collection install cloud.aws_ops

Using this collection

Once installed, you can reference the cloud.aws_ops collection content by its fully qualified collection name (FQCN), for example:

  - hosts: all
    tasks:
      - name: Include 'enable_cloudtrail_encryption_with_kms' role
        ansible.builtin.include_role:
          name: cloud.aws_ops.enable_cloudtrail_encryption_with_kms
        vars:
          enable_cloudtrail_encryption_with_kms_trail_name: "{{ cloudtrail_name }}"
          enable_cloudtrail_encryption_with_kms_kms_key_id: "{{ kms_alias }}"

See Also

• Ansible Using collections for more details.
• Ansible Rulebook documentation for information on using rulebooks.

Contributing to this collection

We welcome community contributions to this collection. If you find problems, please open an issue or create a PR against this collection repository.

Testing and Development

The project uses ansible-lint and black. Assuming this repository is checked out in the proper structure, e.g. collections_root/ansible_collections/cloud/aws_ops/, run:

  tox -e linters

Sanity and unit tests are run as normal:

  ansible-test sanity

If you want to run cloud integration tests, ensure you log in to the cloud:

# using the "default" profile on AWS
  aws configure set aws_access_key_id     my-access-key
  aws configure set aws_secret_access_key my-secret-key
  aws configure set region                eu-north-1

  ansible-test integration [target]

This collection is tested using GitHub Actions. To know more about CI, refer to CI.md.

License

GNU General Public License v3.0 or later

See LICENSE to see the full text.

cloud.aws_ops's Issues

Add support for scale-up and scale-down for the webapp playbook

Currently the webapp is not scalable, we cannot reduce nor increase the number workers of the application.
This should be available as done for Azure

SUMMARY

ISSUE TYPE

• Bug Report

COMPONENT NAME

playbooks/webapp.yaml

Roles with missing integration tests

SUMMARY

Roles not covered by integration tests:

• ec2_instance_terminate_by_tag

ISSUE TYPE

• Feature Idea

COMPONENT NAME

ADDITIONAL INFORMATION

Amazon RDS for PostgreSQL version 14.2 no longer supported

By chance I was looking for some good AWS/Red Hat demos for the Minneapolis RHUG in September, and came across this repo. In experimenting with your Webapp Playbook I discovered that the PostgresSQL RDS Engine version you are referencing, 14.2 is no longer supported. Please bump the version to 14.3 or higher, see the following for currently supported versions - https://docs.aws.amazon.com/AmazonRDS/latest/PostgreSQLReleaseNotes/postgresql-release-calendar.html

I'm happy to submit a pull request if that would be easier, but thanks for all your good work!

webapp - unable to delete VPC when using ``operation=delete``

The teardown operation is not deleting all resources, this is due to the fact that the module ec2_vpc_route_table does not delete route tables, we need to find a way to delete it without using the console or the cli

SUMMARY

ISSUE TYPE

• Bug Report

Disable broken test_deploy_flask_app integration tests

The test_deploy_flask_app integration tests are broken and constantly failing in the CI:

TASK [cloud.aws_ops.deploy_flask_app : Deploy application into workers] ********
fatal: [testhost -> bastion]: UNREACHABLE! => {"changed": false, "msg": "Failed to connect to the host via ssh: Shared connection to 18.233.148.133 closed.", "unreachable": true}

This PR disabled the integration tests #84 until further investigations will be done.

manage_transit_gateway: Incomplete documentation of allowed options

Documented options in README are not complete or do not match what is defined here https://github.com/redhat-cop/cloud.aws_ops/blob/main/roles/manage_transit_gateway/meta/argument_specs.yaml

Webapp fails looking for deploy_flask_app_bastion_host_required_packages

task path: /runner/project/playbooks/webapp/webapp.yaml:2
fatal: [localhost]: FAILED! => {
    "argument_errors": [
        "missing required arguments: deploy_flask_app_bastion_host_required_packages, deploy_flask_app_git_repository, deploy_flask_app_local_registry_port, deploy_flask_app_local_registry_pwd, deploy_flask_app_local_registry_user, deploy_flask_app_rds_info, deploy_flask_app_vm_info"
    ],

costomized_ami: Incomplete documentation of allowed options

Documented options in README are not complete or do not match what is defined in defaults https://github.com/redhat-cop/cloud.aws_ops/blob/main/roles/customized_ami/defaults/main.yml

aws default/vars won't work in automation controller

this won't work->
https://github.com/redhat-cop/cloud.aws_ops/blob/main/playbooks/webapp/webapp.yaml#L22

with automation controller because you would use a AWS credential which uses environment variables.