Ansible can provision EC2 instances and configure them, but those are separate jobs with different execution contexts, credentials, and failure points. A safer setup uses an Ansible controller with AWS credentials, the amazon.aws collection and its Python SDK dependencies, narrowly selected instances, and either SSH or AWS Systems Manager (SSM) for guest access. The documentation supports the workflow below; it does not establish that a particular lab was personally built or that any failure was reproduced.
How an Ansible-to-EC2 workflow fits together
Ansible’s AWS control tasks generally run on the Ansible execution host, often through a play targeting localhost. That host uses AWS credentials to call AWS APIs and create or manage resources. A later play connects to the launched guest to install packages or apply configuration. The execution host may be a developer machine, CI runner, or an EC2-hosted controller with an assigned IAM role. See the Ansible AWS guide.
As an Amazon Associate I earn from qualifying purchases.
Keep these roles distinct:
- Controller: runs Ansible and AWS control modules, and needs the relevant Python dependencies and AWS API credentials.
- Managed EC2 instance: receives guest configuration over SSH or SSM. Its instance profile supplies AWS permissions to software on that instance; it does not automatically give the controller’s Ansible process credentials.
- Inventory: identifies the hosts the guest-configuration play should target. Dynamic inventory can query EC2 at runtime rather than relying on a stale IP list.
Prepare the Ansible execution host
Install the collection and SDK dependencies where the module runs
The amazon.aws.ec2_instance module reference lists collection version 11.4.0 and requires Python 3.6 or newer, boto3 1.35.0 or newer, and botocore 1.35.0 or newer on the host executing the module. These are the versions documented by the current reference; verify the live requirements when pinning a new environment because collection and SDK versions can change. The module reference also explains how to install the collection and its dependencies: amazon.aws.ec2_instance documentation.
Do not assume that installing boto3 in an unrelated Python environment fixes an import error. Confirm which Python interpreter Ansible uses and install compatible dependencies in that execution environment. In a CI setup, that means the runner or execution environment; with a remote execution design, confirm the documented module execution host rather than guessing based on where the playbook file lives.
Provide credentials without putting secrets in the playbook
Ansible’s AWS documentation describes credential options including environment variables, AWS profiles, module arguments, and Ansible Vault-protected variables. Prefer an assigned IAM role or a short-lived credential flow where available. If static credentials are unavoidable, store and scope them securely rather than writing secret values into YAML committed to source control. The AWS guide covers the supported approaches.
Credential context matters. The EC2 module documentation distinguishes the module’s host context for environment variables and configuration files from the controller context used by lookup and connection plugins. boto3 can read credentials and Region from configuration files in the applicable context. A credential visible to one task therefore may not be visible to a lookup or connection plugin.
Provision EC2 with narrow, explicit selectors
Use amazon.aws.ec2_instance to create or manage instances, and make the intended Region, AMI, instance type, subnet, tags, and network access explicit. Select resources with precise IDs or narrow filters and tags. That makes later changes less likely to affect unrelated instances.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Pay particular attention to the difference between count and exact_count. The module documentation says count launches new instances. exact_count can create or terminate instances to make the selected group match the requested number. The reference includes a broad-filter example that can terminate every running instance in a Region and warns users to use extreme caution. Review the selectors and intended changes before running a task that can stop or terminate resources. Details and examples are in the EC2 instance module reference.
Decide how the guest will be reached before launch. The module supports key-pair and public-IP settings, but a public IP is not required simply because an example uses one. A private subnet with SSM or controlled network access may suit the design better; SSH requires an allowed route, security-group rules, a usable key, and the correct login user.
Discover instances before configuring them
Use temporary inventory for a one-run workflow
For a single playbook run, Ansible’s AWS guide demonstrates registering the provisioning result, adding the created hosts to a temporary group, and running a later play against that group. This keeps launch and guest configuration as distinct stages while allowing the same run to pass the new host details forward.
Use dynamic inventory when addresses or membership change
For repeat access to instances whose addresses or membership can change, use the amazon.aws.aws_ec2 inventory plugin. It queries EC2 at runtime and supports tag filters and tag-derived groups. Configure the desired Regions and selection criteria, then inspect what Ansible sees before targeting it:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →ansible-inventory --graphTo inspect the full inventory data instead, run ansible-inventory --list. Check the selected hosts, state, tags, hostname precedence, and generated groups before executing a play—especially one that changes or deletes infrastructure. The plugin’s options and examples are in the aws_ec2 inventory documentation.
Rank #3
Choose SSH or Systems Manager for guest access
| Approach | What it needs | Best fit and trade-off |
|---|---|---|
| SSH | A reachable network path, appropriate security-group rules, an SSH key pair, and the correct guest login user. | Familiar when controlled SSH access is already available; requires managing network reachability and key access. |
| SSM connection | A managed node with the required permissions and agent setup, plus the Ansible SSM connection configuration. | Can avoid making a public IP the default access path; adds IAM, agent, and SSM configuration requirements. |
The Ansible inventory documentation demonstrates amazon.aws.aws_ssm as a connection option, while the EC2 module documents key-pair and public-IP parameters. The right choice depends on the network and access model rather than on a universal preference. See the inventory guide and module reference.
SSM managed-node prerequisites
AWS documents that automatic management through Default Host Management Configuration requires IMDSv2 and SSM Agent 3.2.582.0 or newer, along with appropriate permissions. The configuration is regional, must be enabled separately in each Region, and may take up to 30 minutes to apply. AWS recommends Default Host Management Configuration where it fits the use case and also documents instance profiles as an alternative. Because its account-level role changes affect managed EC2 instances in that account and Region, assess the scope and least-privilege requirements before enabling it. See AWS Systems Manager instance permissions.
An instance profile is the mechanism that passes a role to an EC2 instance. AWS defines it as “a container that passes IAM role information to an Amazon Elastic Compute Cloud (Amazon EC2) instance at launch.” AWS also notes that removing a role from a profile can take up to one hour to take effect; use the documented association or replacement workflow when changing access. The same Systems Manager permissions guide describes the role and profile options.
Recommended Free Tools
Run Ansible playbooks through Systems Manager
If SSM itself is the mechanism for running a playbook, AWS recommends the AWS-ApplyAnsiblePlaybooks document. The older AWS-RunAnsiblePlaybook is deprecated and retained for legacy purposes. Playbooks can come from GitHub or S3 and may be packaged as ZIP files or directory structures.
For an S3 playbook source, grant the managed node’s instance profile access to the bucket. If the run writes output logs to S3, the managed node role needs write access as well; permissions held only by the user who initiated the run are not enough. Dependency auto-install behavior varies by operating system, so check the document and operating-system requirements for the target. See AWS’s Ansible playbook execution documentation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Diagnose common setup failures
The EC2 module cannot import boto3 or botocore
- Identify the host and Python interpreter executing the module.
- Confirm that Python, boto3, and botocore meet the module’s documented minimum versions and are installed in that interpreter’s environment.
- Check that the required
amazon.awscollection is installed in the Ansible environment actually running the play.
The version requirements are listed in the module reference.
Credentials work in one task but fail in a plugin
Check which context the task or plugin uses. Module environment variables and configuration files are read from the module’s host context, while lookup and connection plugins use the controller context. Verify the credential source and Region in the context relevant to the failing component; do not assume a controller shell variable is inherited everywhere.
Free tools Windows power users keep installed
One-click scans. No signup required.
The instance launches, but configuration cannot reach it
First inspect the registered launch result or dynamic inventory output. Then check whether the selected hostname is public or private, whether the network path and security group permit the chosen connection, whether the key pair is available for SSH, and whether the login user is correct. For SSM, verify the managed-node prerequisites and permissions. These are diagnostic checks implied by Ansible’s separate provisioning and configuration workflow and the documented connection parameters—not claims about a reproduced failure.
The SSM node is missing or does not respond
- Check the instance’s permissions or instance profile.
- Verify the required SSM Agent version and IMDSv2 setting.
- Confirm Default Host Management Configuration is enabled in the instance’s Region, if that is the selected setup.
- Allow for the documented application delay, which may be up to 30 minutes.
AWS’s managed-instance permissions guide covers these prerequisites and the regional scope.
SSM runs commands but cannot retrieve or save the playbook
Inspect the managed node’s instance profile and the S3 bucket policy. For S3 sources and S3 output logs, AWS assigns the necessary access to the managed node role, not merely to the initiating user. The SSM Ansible documentation describes these permissions.
Inventory misses a host or targets too many
Check the configured Region, instance state, tag names and values, filters, hostname selection, and generated groups. The plugin makes live API calls, so its results depend on current EC2 data and the selection rules. Inspect ansible-inventory --graph or --list before running a consequential play.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallAn instance is unexpectedly replaced, stopped, or terminated
Review the task’s count or exact_count, filters, instance IDs, and desired state. Broad filters combined with exact_count can select resources beyond the intended lab. Use explicit selectors and review the affected resources before executing a destructive change; the module reference documents the behavior and its cautionary example.
Pick an operating model that matches the scale
| Decision | Smaller or simpler setup | Changing or larger fleet |
|---|---|---|
| Execution location | Developer or CI controller with scoped AWS credentials. | Centralized controller or EC2-hosted controller using an assigned IAM role, according to the operational model. |
| Host discovery | Temporary host group or static inventory for a tiny, stable lab. | aws_ec2 dynamic inventory for changing instances and tag-based grouping. |
| Guest configuration | Configure after launch with Ansible. | Consider baking a more complete image with a tool such as Packer, or retain post-provisioning configuration where it is appropriate. |
| Automation operations | A straightforward playbook or pull workflow. | Ansible Automation Platform callbacks are one option for autoscaling workflows; the Ansible guide notes centrally recorded job results as a benefit compared with pull mode. |
| Risk controls | Precise tags and selectors, scoped IAM access, and reviewed teardown tasks. | Keep selection and permissions explicit as fleet size and automation reach expand. |
These are design choices, not prerequisites for a small EC2 demonstration. Ansible’s AWS guide discusses post-provisioning configuration, Packer image building, and Automation Platform callbacks for autoscaling use cases.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
