Ansible 與 AWS：自動化VPC和網路設定

---
- name: 建立VPC環境
  hosts: localhost
  connection: local
  gather_facts: False
  vars:
    region: ap-northeast-1
    vpc_name: "my-vpc"
    vpc_cidr: "10.0.0.0/16"
    public_subnet_cidr: "10.0.1.0/24"
    private_subnet_cidr: "10.0.2.0/24"
    az: "ap-northeast-1a"
    
  tasks:
    - name: 建立VPC
      ec2_vpc_net:
        name
## AWS 雲端服務入門與核心服務概述

### Amazon S3 儲存服務

Amazon S3 (Simple Storage Service) 提供高度耐用與可用性強的儲存服務，能夠存放從網頁應用程式到媒體檔案等各種內容。透過 S3，你可以將整個儲存基礎設施轉移到雲端，利用其可擴充套件性和按用量計費的定價模式來應對不斷增長的儲存需求。

S3 的主要優勢在於它的彈性使用方式：你可以直接從 S3 分發內容，或將 S3 作為來源儲存函式庫送內容到 Amazon CloudFront 邊緣位置，加速全球內容交付。

### 彈性負載平衡 (ELB)

彈性負載平衡 (Elastic Load Balancing) 能自動將傳入的應用程式流量分配到多個 Amazon EC2 執行個體上。這項服務讓你的應用程式達到更高的容錯能力，同時無縫提供分配應用程式流量所需的負載平衡容量。

ELB 的關鍵特性包括：
- 自動擴充套件請求處理能力，以滿足應用程式流量需求
- 與 Auto Scaling 整合，確保後端容量能夠應對不同流量水平，無需手動干預
- 提高應用程式的可用性和容錯能力

### Route 53 DNS 服務

Amazon Route 53 是一個高用性與可擴充套件的網域名稱系統 (DNS) 網路服務。它為開發人員和企業提供一種極其可靠與經濟實惠的方式，將終端使用者引導至網際網路應用程式，透過將網域名稱 (如 www.example.com) 轉換為電腦連線所需的數字 IP 地址 (如 192.0.2.1)。

Route 53 的主要功能：
- 有效地將使用者請求連線到在 AWS 上執行的基礎設施，如 EC2 執行個體、彈性負載平衡器或 S3 儲存桶
- 也可用於將使用者引導到 AWS 外部的基礎設施
- 使用全球 DNS 伺服器網路，以低延遲回應 DNS 查詢
- 可透過 AWS 管理主控台或 API 輕鬆管理公共 DNS 記錄
- 與其他 AWS 服務整合，如 IAM 服務，可控制組織內誰能修改 DNS 記錄

### AWS 全球基礎設施

傳統基礎設施難以為全球分散的使用者群提供出色效能，大多數公司為節省成本和時間，只專注於一個地理區域。而雲端運算改變了這一點 - 你可以輕鬆地在世界各地的任何或所有 AWS 區域佈署應用程式。

這意味著你可以最低成本為客戶提供更低延遲和更佳體驗。AWS 的全球基礎設施讓企業能夠快速拓展全球業務，不受地理位置限制。

### 設定 AWS 帳戶

如果你還沒有 Amazon Web Services 帳戶，請依照以下步驟設定：

1. 存取 http://aws.amazon.com 並點選「登入主控台」按鈕
2. 選擇「我是新使用者」選項，填寫電子郵件地址，然後點選「使用我們的安全伺服器登入」按鈕
3. 輸入你的姓名、再次輸入電子郵件地址，設定密碼，然後點選「建立帳戶」按鈕
4. 選擇「個人帳戶」(或如果要為公司建立 AWS 帳戶，則選擇「公司帳戶」)，填寫聯絡資訊表格，輸入安全檢查字元，確認接受 AWS 客戶協定，然後點選「安全提交」按鈕
5. 輸入信用卡號碼和帳單地址資訊，點選「繼續」按鈕
6. 驗證身份：輸入有效的電話或行動電話號碼，點選「立即致電」按鈕，接聽電話並輸入顯示的 PIN 碼
7. 選擇支援方案，點選「繼續」按鈕

完成設定後，你將收到確認帳戶設定的電子郵件。值得注意的是，初始帳戶註冊提供一年的免費使用層級。

#### 關於費用注意事項

設定 AWS 帳戶時，你已提供信用卡資訊來支付所使用的資源。建議瞭解每項服務的定價方案，以避免意外的費用支出。AWS 提供線上計算器來估算每月的 AWS 帳單。

### AWS 管理主控台

AWS 管理主控台是一個直覺與功能強大的網頁介面，讓你能夠管理所有 AWS 資源。透過這個單一平台，你可以執行各種任務，從佈署新應用程式到監控應用程式的健康狀態。

主控台主要功能：
- 管理從 EC2 執行個體到 DynamoDB 資料表等所有 AWS 資源
- 管理 AWS 帳戶的各個方面，包括檢視每月按服務分類別的支出
- 管理安全憑證或設定新的 IAM 使用者
- 可自訂導航欄以快速存取常用服務

每項服務都有自己的主控台，你可以從 AWS 管理主控台存取。

### 建立第一個 EC2 執行個體

EC2 (Elastic Compute Cloud) 是最廣泛使用的 AWS 服務。EC2 徹底改變了伺服器佈建的方式，只需在 AWS 管理主控台上點選幾下，就能在幾分鐘內獲得虛擬伺服器。

#### 建立金鑰對

首先，需要建立一個金鑰對。AWS 使用公鑰密碼學來保護執行個體的登入資訊。Linux 執行個體沒有密碼，你需要使用金鑰對安全地登入。啟動執行個體時，需指定金鑰對的名稱，然後在登入時提供私鑰。

需要注意的是，金鑰對是區域特定的。例如，如果計劃在亞太地區 (雪梨) 啟動執行個體，必須為該區域的執行個體建立金鑰對。

AWS 雲端服務的核心價值

AWS 的核心優勢在於其服務整合性與彈性。以 S3 為例，它不僅是一個儲存服務，更是一個可以與 CloudFront、EC2 和其他服務無縫整合的平台。當建立一個完整的雲端應用程式時，這種整合能力讓架構設計變得更加靈活。

在實際佈署中，玄貓發現 ELB 與 Auto Scaling 的組合是處理流量波動的絕佳解決方案。這種自動化擴充套件機制讓系統能夠在高峰期自動增加資源，並在低峰期釋放資源，從而最佳化成本。這是傳統基礎設施難以實作的靈活性。

Route 53 的全球分散式架構則是國際業務的關鍵支柱。透過將 DNS 查詢路由到最近的伺服器，它能夠顯著降低延遲，提升使用者經驗。這對於需要全球佈署的應用程式來說是無價的優勢。

在設定 AWS 帳戶時，玄貓建議特別注意免費層級的使用限制。許多新手誤以為「免費」意味著無限制使用，但實際上每項服務都有明確的使用上限。超過這些限制後，費用可能會迅速累積。這是雲端服務的一個重要管理導向 - 資源使用的可見性與控制。

AWS 管理主控台的直覺設計大降低了雲端服務的使用門檻。不過，對於需要自動化的大型佈署，玄貓推薦學習使用 AWS CLI 或 CloudFormation，這些工具能夠實作基礎設施即程式碼 (IaC)，提高佈署效率和一致性。

EC2 作為 AWS 的核心計算服務，其彈性和多樣性是其最大特點。從微型例項到高效能計算例項，EC2 提供了適合各種工作負載的選項。在選擇例項類別時，應根據應用程式的具體需求進行評估，而不僅是考慮成本因素。

雲端服務的真正價值在於它將基礎設施轉變為程式化資源，使技術團隊能夠將更多精力放在創新和業務價值上，而非基礎設施管理的繁瑣工作上。

## 雲端佈署的第一步：AWS關鍵設定

在雲端運算的世界中，AWS（Amazon Web Services）是一個領先的平台，提供了豐富的服務幫助企業和開發者建立、佈署和管理應用程式。作為一名經常在不同雲端環境中工作的技術工作者，我認為掌握AWS的基礎設定是進入雲端世界的關鍵。本文將帶你完成AWS環境設定的三個基本步驟：建立金鑰對、設定安全群組以及啟動EC2執行個體。

### 金鑰對：你的雲端伺服器鑰匙

在AWS中，金鑰對就像是你進入雲端伺服器的數位鑰匙。它由公鑰和私鑰組成，AWS儲存公鑰，而你需要安全地保管私鑰。這種設計確保只有擁有對應私鑰的人才能連線到你的EC2執行個體。

#### 如何建立金鑰對

1. 登入AWS管理主控台，開啟EC2儀錶板（https://console.aws.amazon.com/ec2）
2. 從導航欄中選擇你要建立金鑰對的區域
3. 在導航窗格中點選「金鑰對」
4. 點選「建立金鑰對」
5. 在「金鑰對名稱」欄位中輸入一個容易記憶的名稱，建議使用「你的名稱-key-pair-區網域名稱」的格式，例如「blackcat-key-pair-apsydney」
6. 點選「建立」按鈕，瀏覽器將自動下載私鑰檔案（.pem檔案）

> **重要提醒**：這是你唯一可以儲存私鑰檔案的機會。當你啟動執行個體時需要提供金鑰對的名稱，而每次連線到執行個體時則需要對應的私鑰。請將私鑰檔案存放在安全的地方！

#### 設定私鑰檔案許可權

如果你使用Mac或Linux系統，需要設定私鑰檔案的許可權，確保只有你能讀取：

```bash
$ chmod 400 blackcat-key-pair-apsydney.pem

$ ssh -i /path/key_pair.pem ec2-user@public_ip

$ sudo yum -y update
$ sudo yum -y install wget
$ wget http://dl.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
$ sudo rpm -Uvh epel-release-6*.rpm

$ sudo yum groupinstall -y 'development tools'

$ sudo yum -y install python-pip python-devel

$ sudo pip install setuptools --upgrade

$ sudo pip install ansible

$ ansible --version
ansible 2.1.1.0

$ sudo pip install ansible --upgrade

$ ssh-keygen
Generating public/private rsa key pair.
Enter file in which to save the key (/home/yan/.ssh/id_rsa):[按 ENTER 鍵]
Enter passphrase (empty for no passphrase):[按 ENTER 鍵]
Enter same passphrase again:[按 ENTER 鍵]
Your identification has been saved in /home/yan/.ssh/id_rsa.
Your public key has been saved in /home/yan/.ssh/id_rsa.pub.
The key fingerprint is:

$ ssh-copy-id -i ~/.ssh/id_rsa.pub localhost
yan@localhost's password:[輸入密碼]
Now try logging into the machine, with "ssh 'localhost'", and check in:
.ssh/authorized_keys

ssh-keygen -t rsa -b 4096

ssh-copy-id username@remote_host

ssh localhost
exit

one.example.com

[webservers]
web1.example.com
web2.example.com
two.example.com

[dbservers]
db1.example.com
db2.example.com
two.example.com

[webservers]
web[01:50].example.com

[databases]
db-[a:f].example.com

[sydney]
host1
host2

[singapore]
host3
host4

[asiapacific:children]
sydney
singapore

[webservers]
web1.example.com ansible_user=ec2-user
web2.example.com ansible_user=ubuntu

/home/yan/ansible4aws/host_vars/web1.example.com

---
ansible_user: ec2-user
ansible_port: 5300
ansible_ssh_private_key_file: /home/yan/.ssh/keypair1.pem

[sydney]
node1
node2

[sydney:vars]
ntp_server=ntp.sydney.example.com
proxy_server=proxy.sydney.example.com

/home/yan/ansible4aws/group_vars/sydney

---
ntp_server: ntp.sydney.example.com
proxy_server: proxy.sydney.example.com

[asiapacific:vars]
db_server=db1.asiapacific.example.com

mkdir -p /home/yan/ansible4aws && cd /home/yan/ansible4aws
vi hosts

[local]
localhost

# 你可以增加更多主機
# [mygroup]
# 192.168.1.10
# 192.168.1.11

ansible -i hosts all -m ping

ansible -i hosts all -a "/bin/echo hello"

---
- name: 安裝並啟動Apache伺服器
  hosts: webservers
  become: yes
  
  tasks:
    - name: 安裝Apache
      yum:
        name: httpd
        state: present
        
    - name: 啟動Apache服務
      service:
        name: httpd
        state: started
        enabled: yes

ansible webservers -m service -a "name=httpd state=started"
ansible webservers -m ping
ansible webservers -m command -a "/sbin/reboot -t now"

- name: 重啟伺服器
  command: /sbin/reboot -t now

---
- hosts: webservers
  tasks:
    - name: ensure apache is installed
      yum: name=httpd state=present
- hosts: databases
  tasks:
    - name: ensure mysql server is installed
      yum: name=mysql-server state=present

- hosts: webservers
  remote_user: root

- hosts: webservers
  vars:
    http_port: 80
    region: ap-southeast-2
  tasks:
    - name: create key pair
      local_action:
        module: ec2_key
        region: "{{ region }}"

- hosts: webservers
  vars_files:
    - /vars/external_vars.yml

vars_prompt:
  - name: 'vpc_subnet_id'
    prompt: 'Enter the VPC subnet ID: '

$ ansible-playbook -i hosts site.yml --extra-vars "hosts=dbservers user=ec2-user"

tasks:
  - name: make sure apache is running
    service: name=httpd state=running

tasks:
  - name: disable selinux
    command: /sbin/setenforce 0

tasks:
  - name: Copy somefile to remote host
    copy: src=/home/somefile dest=/etc/somefile
          owner=root group=root mode=0644

tasks:
  - name: Configure ntp file
    template: src=ntp.conf.j2 dest=/etc/ntp.conf
    notify: restart ntp

handlers:
  - name: restart ntp
    service: name=ntpd state=restarted

[local]
localhost

---
- hosts: localhost
  tasks:
    - name: ensure apache is at the latest version
      yum: name=httpd state=latest
    - name: ensure apache is running
      service: name=httpd state=started

$ ansible-playbook -i hosts site.yml

# ps ax | grep httpd

---
- hosts: localhost
  tasks:
    - name: ensure apache is absent
      yum: name=httpd state=absent

$ ansible-playbook -i hosts site.yml

- hosts: webservers
  tasks:
    - include: tasks/webserver.yml

roles/
  common/
    tasks/
      main.yml
    handlers/
      main.yml
    files/
    templates/
    vars/
      main.yml
    defaults/
      main.yml
    meta/
      main.yml

---
- hosts: webservers
  roles:
    - common
    - webservers

# 儲存為 tasks/task1.yml

- name: task one
  command: /bin/commandone

- name: task two
  command: /bin/commandtwo

tasks:
  - include: tasks/task1.yml

roles/
  common/
    files/
    templates/
    tasks/
    handlers/
    vars/
    meta/
  webservers/
    files/
    templates/
    tasks/
    handlers/
    vars/
    meta/

---
- hosts: webservers
  roles:
    - common
    - webservers

---
- name: Provision AWS VPC
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    vpc_name: "Web-App-VPC"
    vpc_cidr: "10.0.0.0/16"
    region: "us-west-2"
    public_subnet_1_cidr: "10.0.1.0/24"
    public_subnet_2_cidr: "10.0.2.0/24"
    private_subnet_1_cidr: "10.0.3.0/24"
    private_subnet_2_cidr: "10.0.4.0/24"
  
  tasks:
    - name: Create VPC
      ec2_vpc_net:
        name: "{{ vpc_name }}"
        cidr_block: "{{ vpc_cidr }}"
        region: "{{ region }}"
        tags:
          Name: "{{ vpc_name }}"
          Environment: "Production"
      register: vpc
    
    - name: Create public subnet 1
      ec2_vpc_subnet:
        vpc_id: "{{ vpc.vpc.id }}"
        cidr: "{{ public_subnet_1_cidr }}"
        az: "{{ region }}a"
        region: "{{ region }}"
        tags:
          Name: "Public Subnet 1"
          Environment: "Production"
      register: public_subnet_1
    
    - name: Create public subnet 2
      ec2_vpc_subnet:
        vpc_id: "{{ vpc.vpc.id }}"
        cidr: "{{ public_subnet_2_cidr }}"
        az: "{{ region }}b"
        region: "{{ region }}"
        tags:
          Name: "Public Subnet 2"
          Environment: "Production"
      register: public_subnet_2
    
    - name: Create private subnet 1
      ec2_vpc_subnet:
        vpc_id: "{{ vpc.vpc.id }}"
        cidr: "{{ private_subnet_1_cidr }}"
        az: "{{ region }}a"
        region: "{{ region }}"
        tags:
          Name: "Private Subnet 1"
          Environment: "Production"
      register: private_subnet_1
    
    - name: Create private subnet 2
      ec2_vpc_subnet:
        vpc_id: "{{ vpc.vpc.id }}"
        cidr: "{{ private_subnet_2_cidr }}"
        az: "{{ region }}b"
        region: "{{ region }}"
        tags:
          Name: "Private Subnet 2"
          Environment: "Production"
      register: private_subnet_2

- name: Create Internet Gateway
  ec2_vpc_igw:
    vpc_id: "{{ vpc.vpc.id }}"
    region: "{{ region }}"
    tags:
      Name: "{{ vpc_name }}-IGW"
      Environment: "Production"
  register: igw

- name: Create public route table
  ec2_vpc_route_table:
    vpc_id: "{{ vpc.vpc.id }}"
    region: "{{ region }}"
    tags:
      Name: "Public Route Table"
      Environment: "Production"
    subnets:
      - "{{ public_subnet_1.subnet.id }}"
      - "{{ public_subnet_2.subnet.id }}"
    routes:
      - dest: "0.0.0.0/0"
        gateway_id: "{{ igw.gateway_id }}"
  register: public_route_table

---
- name: Provision VPC Infrastructure
  hosts: localhost
  connection: local
  gather_facts: false
  vars:
    vpc_name: "Production-VPC"
    vpc_cidr: "10.0.0.0/16"
    public_subnet_cidr: "10.0.0.0/24"
    private_subnet_cidr: "10.0.1.0/24"
    region: "ap-northeast-1"
    az: "ap-northeast-1a"
    
  tasks:
    - name: Create VPC
      ec2_vpc:
        state: present
        cidr_block: "{{ vpc_cidr }}"
        resource_tags: { "Name": "{{ vpc_name }}" }
        region: "{{ region }}"
        internet_gateway: yes
        dns_support: yes
        dns_hostnames: yes
      register: vpc
    
    - name: Create public subnet
      ec2_vpc_subnet:
        state: present
        vpc_id: "{{ vpc.vpc_id }}"
        cidr: "{{ public_subnet_cidr }}"
        az: "{{ az }}"
        resource_tags: { "Name": "Public Subnet" }
        region: "{{ region }}"
      register: public_subnet
    
    - name: Create private subnet
      ec2_vpc_subnet:
        state: present
        vpc_id: "{{ vpc.vpc_id }}"
        cidr: "{{ private_subnet_cidr }}"
        az: "{{ az }}"
        resource_tags: { "Name": "Private Subnet" }
        region: "{{ region }}"
      register: private_subnet
    
    - name: Create Internet Gateway route table
      ec2_vpc_route_table:
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ region }}"
        tags:
          Name: "Public Route Table"
        subnets:
          - "{{ public_subnet.subnet.id }}"
        routes:
          - dest: 0.0.0.0/0
            gateway_id: "{{ vpc.igw_id }}"
      register: public_route_table
    
    - name: Create NAT instance
      ec2:
        key_name: my_key
        instance_type: t2.micro
        image: ami-12345678  # 應替換為您區域中的 NAT AMI
        region: "{{ region }}"
        vpc_subnet_id: "{{ public_subnet.subnet.id }}"
        assign_public_ip: yes
        group: ["nat_security_group"]  # 應事先建立
        instance_tags:
          Name: "NAT Instance"
        source_dest_check: no  # 關鍵設定，允許 NAT 功能
      register: nat_instance
    
    - name: Create NAT route table
      ec2_vpc_route_table:
        vpc_id: "{{ vpc.vpc_id }}"
        region: "{{ region }}"
        tags:
          Name: "Private Route Table"
        subnets:
          - "{{ private_subnet.subnet.id }}"
        routes:
          - dest: 0.0.0.0/0
            instance_id: "{{ nat_instance.instances[0].id }}"
      register: private_route_table

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars:
    region: ap-southeast-2
    # 命名字首
    prefix: staging
    # 可用區域
    az: ap-southeast-2a
  tasks:
    - name: 建立 VPC
      ec2_vpc:
        region: "{{ region }}"
        cidr_block: 10.0.0.0/16
        resource_tags: '{"Name":"{{ prefix }}_vpc"}'
        subnets:
          - cidr: 10.0.0.0/24
            az: "{{ az }}"
            resource_tags: '{"Name":"{{ prefix }}_subnet_public"}'
          - cidr: 10.0.1.0/24
            az: "{{ az }}"
            resource_tags: '{"Name":"{{ prefix }}_subnet_private"}'
        internet_gateway: yes
        route_tables:
          - subnets:
              - 10.0.0.0/24
            routes:
              - dest: 0.0.0.0/0
                gw: igw
      register: vpc
    - name: 將 VPC ID 寫入 {{ prefix }}_vpc_info 檔案
      shell: echo "{{ prefix }}"_vpc":" "{{ vpc.vpc_id }}" > "{{ prefix }}"_vpc_info
    - name: 將子網路 ID 寫入 {{ prefix }}_vpc_info 檔案
      shell: echo "{{ item.resource_tags.Name }}"":" "{{ item.id }}" >> "{{ prefix }}"_vpc_info
      with_items: vpc.subnets

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars:
    region: ap-southeast-2
  vars_files:
    - staging_vpc_info
  tasks:
    - name: 刪除 VPC
      ec2_vpc:
        region: "{{ region }}"
        state: absent
        # 從 staging_vpc_info 檔案取得 vpc_id
        vpc_id: "{{ staging_vpc }}"
        wait: yes

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars:
    region: ap-southeast-2
  vars_files:
    - staging_vpc_info
  tasks:
    - name: 建立 Web 伺服器安全群組
      ec2_group:
        name: "staging_webservers"
        description: "Security group for web servers"
        vpc_id: "{{ staging_vpc }}"
        region: "{{ region }}"
        rules: []
        rules_egress: []
      register: web_sg
        
    - name: 建立資料函式庫群組
      ec2_group:
        name: "staging_db"
        description: "Security group for database servers"
        vpc_id: "{{ staging_vpc }}"
        region: "{{ region }}"
        rules: []
        rules_egress: []
      register: db_sg
        
    - name: 建立 NAT 執行個體安全群組
      ec2_group:
        name: "staging_nat"
        description: "Security group for NAT instances"
        vpc_id: "{{ staging_vpc }}"
        region: "{{ region }}"
        rules: []
        rules_egress: []
      register: nat_sg

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars:
    region: ap-southeast-2
    # 你的辦公室或家庭 IP
    my_ip: 203.0.113.0/24
  vars_files:
    - staging_vpc_info
  tasks:
    - name: 建立 Web 伺服器安全群組
      ec2_group:
        name: "staging_webservers"
        description: "Security group for web servers"
        vpc_id: "{{ staging_vpc }}"
        region: "{{ region }}"
        rules:
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: "{{ my_ip }}"
        rules_egress:
          - proto: tcp
            from_port: 3306
            to_port: 3306
            group_id: "{{ db_sg.group_id }}"
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: 0.0.0.0/0
      register: web_sg
        
    - name: 建立資料函式庫群組
      ec2_group:
        name: "staging_db"
        description: "Security group for database servers"
        vpc_id: "{{ staging_vpc }}"
        region: "{{ region }}"
        rules:
          - proto: tcp
            from_port: 3306
            to_port: 3306
            group_id: "{{ web_sg.group_id }}"
        rules_egress:
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: 0.0.0.0/0
      register: db_sg

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - staging_vpc_info
  vars:
    #your region
    region: ap-southeast-2
    #prefix for naming
    prefix: staging
    vpc_id: "{{ staging_vpc }}"
  tasks:
    - name: create empty security group for webservers
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        name: "{{ prefix }}_sg_web"
        description: security group for webservers
    - name: create empty security group for databases
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        name: "{{ prefix }}_sg_database"
        description: security group for databases
    - name: create empty security group for nat
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        name: "{{ prefix }}_sg_nat"
        description: security group for nat

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - staging_vpc_info
  vars:
    #your region
    region: ap-southeast-2
    #your ip address
    allowed_ip: 123.xxx.xxx.xxx/32
    #prefix for naming
    prefix: staging
    vpc_id: "{{ staging_vpc }}"
    private_subnet: 10.0.1.0/24
  tasks:
    - name: modify sg_web rules
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        #your security group name
        name: "{{ prefix }}_sg_web"
        description: security group for webservers
        rules:
          # allow ssh access from your ip address
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: "{{ allowed_ip }}"
          # allow http access from anywhere
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          # allow https access from anywhere
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: 0.0.0.0/0
        rules_egress:
          - proto: tcp
            from_port: 3306
            to_port: 3306
            group_name: "{{ prefix }}_sg_database"
    - name: modify sg_database rules
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        name: "{{ prefix }}_sg_database"
        description: security group for databases
        rules:
          - proto: tcp
            from_port: 3306
            to_port: 3306
            group_name: "{{ prefix }}_sg_web"
        rules_egress:
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: 0.0.0.0/0
    - name: modify sg_nat rules
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        name: "{{ prefix }}_sg_nat"
        description: security group for nat
        rules:
          # allow ssh access from your ip address
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: "{{ allowed_ip }}"
          # allow http access from private subnet
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: "{{ private_subnet }}"
          # allow https access from private subnet
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: "{{ private_subnet }}"
        rules_egress:
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 443
            to_port: 443
            cidr_ip: 0.0.0.0/0

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - staging_vpc_info
  vars:
    #your region
    region: ap-southeast-2
    #prefix for naming
    prefix: staging
    vpc_id: "{{ staging_vpc }}"
  tasks:
    - name: delete {{ prefix }}_sg_web
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        name: "{{ prefix }}_sg_web"
        description: security group for webservers
        state: absent
    - name: delete {{ prefix }}_sg_database
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        name: "{{ prefix }}_sg_database"
        description: security group for databases
        state: absent
    - name: delete {{ prefix }}_sg_nat
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        name: "{{ prefix }}_sg_nat"
        description: security group for nat
        state: absent

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - staging_vpc_info
  vars:
    region: ap-southeast-2
    key: yan-key-pair-apsydney
    instance_type: t2.micro
    image: ami-d9fe9be3
    prefix: staging
  tasks:
    - name: web instance provisioning
      ec2:
        region: "{{ region }}"
        key_name: "{{ key }}"
        instance_type: "{{ instance_type }}"
        image: "{{ image }}"
        wait: yes
        group: "{{ prefix }}_sg_web"
        instance_tags:
          Name: "{{ prefix }}_web"
          class: web
          environment: staging
          id: web_launch_01
        vpc_subnet_id: "{{ staging_subnet_public }}"
      register: ec2
    - name: associate new EIP for the instance
      ec2_eip:
        region: "{{ region }}"
        instance_id: "{{ item.id }}"
      with_items: ec2.instances

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - staging_vpc_info
  vars:
    region: ap-southeast-2
    key: yan-key-pair-apsydney
    instance_type: t2.micro
    image: ami-d9fe9be3
    prefix: staging
  tasks:
    - name: database instance provisioning
      ec2:
        region: "{{ region }}"
        key_name: "{{ key }}"
        instance_type: "{{ instance_type }}"
        image: "{{ image }}"
        wait: yes
        group: "{{ prefix }}_sg_database"
        instance_tags:
          Name: "{{ prefix }}_database"
          class: database
          environment: staging
          id: db_launch_01
        vpc_subnet_id: "{{ staging_subnet_private }}"
        assign_public_ip: no

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - staging_vpc_info
  vars:
    region: ap-southeast-2
    key: yan-key-pair-apsydney
    instance_type: t1.micro
    image: ami-3bae3201
    prefix: staging
  tasks:
    - name: NAT instance provisioning
      ec2:
        region: "{{ region }}"
        key_name: "{{ key }}"
        instance_type: "{{ instance_type }}"
        image: "{{ image }}"
        wait: yes
        group: "{{ prefix }}_sg_nat"
        instance_tags:
          Name: "{{ prefix }}_nat"
          class: nat
          environment: staging
          id: nat_launch_01
        vpc_subnet_id: "{{ staging_subnet_public }}"
        source_dest_check: no
        wait: yes
      register: ec2
    - name: associate new EIP for the instance
      tags: eip
      ec2_eip:
        region: "{{ region }}"
        instance_id: "{{ item.id }}"
      with_items: ec2.instances
      when: item.id is defined

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars:
    region: ap-southeast-2
    # prefix for naming
    prefix: staging
    # availability zones
    az0: ap-southeast-2a
    az1: ap-southeast-2b
  tasks:
    - name: create vpc with multi-az subnets
      ec2_vpc:
        region: "{{ region }}"
        cidr_block: 10.0.0.0/16
        resource_tags: '{"Name":"{{ prefix }}_vpc"}'
        subnets:
          - cidr: 10.0.0.0/24
            az: "{{ az0 }}"
            resource_tags: '{"Name":"{{ prefix }}_subnet_public_0"}'
          - cidr: 10.0.1.0/24
            az: "{{ az0 }}"
            resource_tags: '{"Name":"{{ prefix }}_subnet_private_0"}'
          - cidr: 10.0.2.0/24
            az: "{{ az1 }}"
            resource_tags: '{"Name":"{{ prefix }}_subnet_public_1"}'
          - cidr: 10.0.3.0/24
            az: "{{ az1 }}"
            resource_tags: '{"Name":"{{ prefix }}_subnet_private_1"}'
        internet_gateway: yes
        route_tables:
          - subnets:
              - 10.0.0.0/24
              - 10.0.2.0/24
            routes:
              - dest: 0.0.0.0/0
                gw: igw
      register: vpc
    - name: write vpc id to {{ prefix }}_vpc_info file
      shell: echo "{{ prefix }}"_vpc":" "{{ vpc.vpc_id }}"
             > "{{ prefix }}"_vpc_info
    - name: write subnets id to {{ prefix }}_vpc_info file
      shell: echo "{{ item.resource_tags.Name }}"":" "{{ item.id }}"
             >> "{{ prefix }}"_vpc_info
      with_items: vpc.subnets

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - staging_vpc_info
  vars:
    #your region
    region: ap-southeast-2
    #your ip address
    allowed_ip: 123.xxx.xxx.xxx/32
    #prefix for naming
    prefix: staging
    vpc_id: "{{ staging_vpc }}"
  tasks:
    - name: create security group for jump box instance
      ec2_group:
        region: "{{ region }}"
        vpc_id: "{{ vpc_id }}"
        #your security group name
        name: "{{ prefix }}_sg_jumpbox"
        description: security group for jump box
        rules:
          # allow ssh access from your ip address
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: "{{ allowed_ip }}"
        rules_egress:
          - proto: all
            cidr_ip: 0.0.0.0/0

---
- hosts: localhost
  connection: local
  gather_facts: no
  vars_files:
    - staging_vpc_info
  vars:
    region: ap-southeast-2
    key: yan-key-pair-apsydney
    instance_type: t2.micro
    image: ami-d9fe9be3
    prefix: staging
    vpc_subnet_id: "{{ staging_subnet_public_0 }}"
  tasks:
    - name: jump box instance provisioning
      ec2:
        region: "{{ region }}"
        key_name: "{{ key }}"
        instance_type: "{{ instance_type }}"
        image: "{{ image }}"
        wait: yes
        group: "{{ prefix }}_sg_jumpbox"
        instance_tags:
          Name: "{{ prefix }}_jumpbox"
          class: jump