Ansible for Cloud Automation: AWS, Azure, and GCP Complete Guide

# AWS
ansible-galaxy collection install amazon.aws
pip install boto3 botocore

# Azure
ansible-galaxy collection install azure.azcollection
pip install -r ~/.ansible/collections/ansible_collections/azure/azcollection/requirements.txt

# GCP
ansible-galaxy collection install google.cloud
pip install google-auth google-api-python-client

# Option 1: Environment variables
export AWS_ACCESS_KEY_ID="AKIA..."
export AWS_SECRET_ACCESS_KEY="secret..."
export AWS_REGION="us-east-1"

# Option 2: AWS CLI profile
aws configure --profile ansible
export AWS_PROFILE=ansible

# Option 3: IAM role (on EC2 instances) — no credentials needed

# Or in playbook
- amazon.aws.ec2_instance:
    access_key: "{{ vault_aws_access_key }}"
    secret_key: "{{ vault_aws_secret_key }}"
    region: us-east-1

# Option 1: Environment variables
export AZURE_SUBSCRIPTION_ID="..."
export AZURE_CLIENT_ID="..."
export AZURE_SECRET="..."
export AZURE_TENANT="..."

# Option 2: Azure CLI (interactive)
az login

# Option 1: Service account JSON
export GCP_SERVICE_ACCOUNT_FILE=/path/to/service-account.json

# Option 2: Application Default Credentials
gcloud auth application-default login

# Or in playbook
- google.cloud.gcp_compute_instance:
    auth_kind: serviceaccount
    service_account_file: /path/to/sa.json
    project: my-project

---
- name: AWS Infrastructure
  hosts: localhost
  connection: local
  vars:
    region: us-east-1
    instance_type: t3.medium
    ami: ami-0c55b159cbfafe1f0
  tasks:
    - name: Create VPC
      amazon.aws.ec2_vpc_net:
        name: production-vpc
        cidr_block: 10.0.0.0/16
        region: "{{ region }}"
        tags:
          Environment: production
      register: vpc

    - name: Create subnet
      amazon.aws.ec2_vpc_subnet:
        vpc_id: "{{ vpc.vpc.id }}"
        cidr: 10.0.1.0/24
        az: "{{ region }}a"
        region: "{{ region }}"
        tags:
          Name: public-subnet
      register: subnet

    - name: Create internet gateway
      amazon.aws.ec2_vpc_igw:
        vpc_id: "{{ vpc.vpc.id }}"
        region: "{{ region }}"
      register: igw

    - name: Create security group
      amazon.aws.ec2_security_group:
        name: web-sg
        description: Web server security group
        vpc_id: "{{ vpc.vpc.id }}"
        region: "{{ region }}"
        rules:
          - proto: tcp
            ports: [80, 443]
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            ports: [22]
            cidr_ip: 10.0.0.0/8
      register: sg

    - name: Launch EC2 instances
      amazon.aws.ec2_instance:
        name: "web-{{ item }}"
        instance_type: "{{ instance_type }}"
        image_id: "{{ ami }}"
        subnet_id: "{{ subnet.subnet.id }}"
        security_group: "{{ sg.group_id }}"
        key_name: deploy-key
        region: "{{ region }}"
        network:
          assign_public_ip: true
        tags:
          Role: webserver
          Environment: production
        wait: true
      loop: "{{ range(1, 4) | list }}"
      register: ec2_instances

- name: Create S3 bucket
  amazon.aws.s3_bucket:
    name: my-app-assets-{{ aws_account_id }}
    region: "{{ region }}"
    versioning: true
    encryption: AES256
    public_access:
      block_public_acls: true
      block_public_policy: true
      ignore_public_acls: true
      restrict_public_buckets: true
    tags:
      Purpose: application-assets

- name: Upload files to S3
  amazon.aws.s3_object:
    bucket: my-app-assets-{{ aws_account_id }}
    object: "config/{{ item | basename }}"
    src: "{{ item }}"
    mode: put
  loop: "{{ lookup('fileglob', 'configs/*', wantlist=True) }}"

- name: Create ALB
  amazon.aws.elb_application_lb:
    name: web-alb
    region: "{{ region }}"
    subnets:
      - "{{ subnet_a.subnet.id }}"
      - "{{ subnet_b.subnet.id }}"
    security_groups:
      - "{{ sg.group_id }}"
    listeners:
      - Protocol: HTTPS
        Port: 443
        Certificates:
          - CertificateArn: "{{ acm_cert_arn }}"
        DefaultActions:
          - Type: forward
            TargetGroupName: web-targets

- name: Create target group
  amazon.aws.elb_target_group:
    name: web-targets
    protocol: HTTP
    port: 80
    vpc_id: "{{ vpc.vpc.id }}"
    region: "{{ region }}"
    health_check_path: /health
    targets:
      - Id: "{{ item.instance_id }}"
        Port: 80
    loop: "{{ ec2_instances.results }}"

---
- name: Azure Infrastructure
  hosts: localhost
  connection: local
  vars:
    resource_group: production-rg
    location: eastus
  tasks:
    - name: Create resource group
      azure.azcollection.azure_rm_resourcegroup:
        name: "{{ resource_group }}"
        location: "{{ location }}"
        tags:
          Environment: production

    - name: Create virtual network
      azure.azcollection.azure_rm_virtualnetwork:
        resource_group: "{{ resource_group }}"
        name: production-vnet
        address_prefixes: "10.0.0.0/16"

    - name: Create subnet
      azure.azcollection.azure_rm_subnet:
        resource_group: "{{ resource_group }}"
        virtual_network: production-vnet
        name: web-subnet
        address_prefix: "10.0.1.0/24"

    - name: Create network security group
      azure.azcollection.azure_rm_securitygroup:
        resource_group: "{{ resource_group }}"
        name: web-nsg
        rules:
          - name: AllowHTTP
            protocol: Tcp
            destination_port_range: [80, 443]
            access: Allow
            priority: 100
            direction: Inbound
          - name: AllowSSH
            protocol: Tcp
            destination_port_range: 22
            access: Allow
            priority: 200
            direction: Inbound
            source_address_prefix: 10.0.0.0/8

    - name: Create public IP
      azure.azcollection.azure_rm_publicipaddress:
        resource_group: "{{ resource_group }}"
        name: "web-{{ item }}-pip"
        allocation_method: Static
        sku: Standard
      loop: "{{ range(1, 4) | list }}"
      register: public_ips

    - name: Create VM
      azure.azcollection.azure_rm_virtualmachine:
        resource_group: "{{ resource_group }}"
        name: "web-{{ item }}"
        vm_size: Standard_B2s
        admin_username: deploy
        ssh_password_enabled: false
        ssh_public_keys:
          - path: /home/deploy/.ssh/authorized_keys
            key_data: "{{ lookup('file', '~/.ssh/deploy_key.pub') }}"
        image:
          offer: 0001-com-ubuntu-server-jammy
          publisher: Canonical
          sku: 22_04-lts
          version: latest
        os_disk_size_gb: 30
        virtual_network: production-vnet
        subnet: web-subnet
        tags:
          Role: webserver
      loop: "{{ range(1, 4) | list }}"

- name: Create AKS cluster
  azure.azcollection.azure_rm_aks:
    resource_group: "{{ resource_group }}"
    name: production-aks
    location: "{{ location }}"
    kubernetes_version: "1.30"
    dns_prefix: prod-aks
    agent_pool_profiles:
      - name: default
        count: 3
        vm_size: Standard_D2s_v3
        os_disk_size_gb: 100
        mode: System
    network_profile:
      network_plugin: azure
      service_cidr: 172.16.0.0/16
      dns_service_ip: 172.16.0.10
    tags:
      Environment: production

---
- name: GCP Infrastructure
  hosts: localhost
  connection: local
  vars:
    project: my-gcp-project
    zone: us-central1-a
    region: us-central1
  tasks:
    - name: Create VPC network
      google.cloud.gcp_compute_network:
        name: production-network
        project: "{{ project }}"
        auto_create_subnetworks: false
        auth_kind: serviceaccount
        service_account_file: "{{ gcp_sa_file }}"
      register: network

    - name: Create subnet
      google.cloud.gcp_compute_subnetwork:
        name: web-subnet
        ip_cidr_range: 10.0.1.0/24
        network: "{{ network }}"
        region: "{{ region }}"
        project: "{{ project }}"
        auth_kind: serviceaccount
        service_account_file: "{{ gcp_sa_file }}"
      register: subnet

    - name: Create firewall rules
      google.cloud.gcp_compute_firewall:
        name: allow-web
        network: "{{ network }}"
        project: "{{ project }}"
        allowed:
          - ip_protocol: tcp
            ports: ['80', '443']
        source_ranges: ['0.0.0.0/0']
        target_tags: ['web']
        auth_kind: serviceaccount
        service_account_file: "{{ gcp_sa_file }}"

    - name: Create GCE instances
      google.cloud.gcp_compute_instance:
        name: "web-{{ item }}"
        machine_type: e2-medium
        zone: "{{ zone }}"
        project: "{{ project }}"
        disks:
          - auto_delete: true
            boot: true
            initialize_params:
              source_image: projects/ubuntu-os-cloud/global/images/family/ubuntu-2204-lts
              disk_size_gb: 30
        network_interfaces:
          - network: "{{ network }}"
            subnetwork: "{{ subnet }}"
            access_configs:
              - name: External NAT
                type: ONE_TO_ONE_NAT
        tags:
          items: ['web']
        metadata:
          ssh-keys: "deploy:{{ lookup('file', '~/.ssh/deploy_key.pub') }}"
        auth_kind: serviceaccount
        service_account_file: "{{ gcp_sa_file }}"
      loop: "{{ range(1, 4) | list }}"

- name: Create GKE cluster
  google.cloud.gcp_container_cluster:
    name: production-gke
    location: "{{ region }}"
    project: "{{ project }}"
    initial_node_count: 3
    node_config:
      machine_type: e2-standard-4
      disk_size_gb: 100
      oauth_scopes:
        - https://www.googleapis.com/auth/cloud-platform
    network: "{{ network.name }}"
    subnetwork: "{{ subnet.name }}"
    auth_kind: serviceaccount
    service_account_file: "{{ gcp_sa_file }}"

# aws_inventory.yml
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
  - eu-west-1
filters:
  tag:Managed: ansible
keyed_groups:
  - key: tags.Role
    prefix: role
  - key: placement.region
    prefix: region
compose:
  ansible_host: public_ip_address

# azure_inventory.yml
plugin: azure.azcollection.azure_rm
include_vm_resource_groups:
  - production-rg
keyed_groups:
  - key: tags.Role
    prefix: role
compose:
  ansible_host: public_ipv4_addresses[0]

# Use multiple inventories
ansible-playbook -i aws_inventory.yml -i azure_inventory.yml site.yml

---
- name: Deploy to AWS
  hosts: localhost
  connection: local
  tasks:
    - name: Provision AWS infrastructure
      ansible.builtin.include_role:
        name: aws_infra
      vars:
        instance_count: 3
        instance_type: t3.medium

- name: Deploy to Azure
  hosts: localhost
  connection: local
  tasks:
    - name: Provision Azure infrastructure
      ansible.builtin.include_role:
        name: azure_infra
      vars:
        instance_count: 3
        vm_size: Standard_B2s

- name: Configure all servers
  hosts: role_webserver
  become: true
  roles:
    - common
    - nginx
    - app_deploy

# group_vars/all.yml
cloud_config:
  aws:
    instance_type: t3.medium
    ami: ami-0c55b159cbfafe1f0
    region: us-east-1
  azure:
    vm_size: Standard_B2s
    image: Canonical:0001-com-ubuntu-server-jammy:22_04-lts:latest
    location: eastus
  gcp:
    machine_type: e2-medium
    image: ubuntu-2204-lts
    zone: us-central1-a

# Use: cloud_config[cloud_provider].instance_type

# AWS EBS snapshot
- amazon.aws.ec2_snapshot:
    instance_id: "{{ instance_id }}"
    description: "Backup {{ ansible_date_time.date }}"
    wait: true
    tags:
      Backup: daily

# Azure disk snapshot
- azure.azcollection.azure_rm_snapshot:
    resource_group: "{{ resource_group }}"
    name: "backup-{{ ansible_date_time.date }}"
    creation_data:
      create_option: Copy
      source_id: "{{ disk_id }}"

# GCP disk snapshot
- google.cloud.gcp_compute_snapshot:
    name: "backup-{{ ansible_date_time.date }}"
    source_disk: "{{ disk }}"
    zone: "{{ zone }}"
    project: "{{ project }}"
    auth_kind: serviceaccount
    service_account_file: "{{ gcp_sa_file }}"

# AWS Route53
- amazon.aws.route53:
    zone: example.com
    record: app.example.com
    type: A
    value: "{{ alb_dns_name }}"
    alias: true
    alias_hosted_zone_id: "{{ alb_zone_id }}"

# Azure DNS
- azure.azcollection.azure_rm_dnsrecordset:
    resource_group: dns-rg
    zone_name: example.com
    relative_name: app
    record_type: A
    records:
      - entry: "{{ public_ip }}"

# GCP Cloud DNS
- google.cloud.gcp_dns_resource_record_set:
    name: app.example.com.
    managed_zone: "{{ dns_zone }}"
    type: A
    ttl: 300
    target:
      - "{{ external_ip }}"
    project: "{{ project }}"
    auth_kind: serviceaccount
    service_account_file: "{{ gcp_sa_file }}"