Ansible Dynamic Inventory: Complete Guide to AWS, Azure, GCP, and Custom Plugins

# Install AWS collection
ansible-galaxy collection install amazon.aws

# Install boto3
pip install boto3 botocore

# Configure AWS credentials
export AWS_ACCESS_KEY_ID="your-key"
export AWS_SECRET_ACCESS_KEY="your-secret"
export AWS_DEFAULT_REGION="us-east-1"
# Or use ~/.aws/credentials

# inventory/aws_ec2.yml
plugin: amazon.aws.aws_ec2

# Regions to query
regions:
  - us-east-1
  - eu-west-1

# Filter instances
filters:
  instance-state-name: running
  "tag:Environment":
    - production
    - staging

# Group by tags, instance type, region
keyed_groups:
  - key: tags.Environment
    prefix: env
    separator: "_"
  - key: instance_type
    prefix: type
  - key: placement.region
    prefix: region
  - key: tags.Role
    prefix: role

# Set connection variables
compose:
  ansible_host: private_ip_address
  # Use public IP if no VPN:
  # ansible_host: public_ip_address | default(private_ip_address)
  ansible_user: "'ubuntu'"
  ansible_ssh_private_key_file: "'~/.ssh/aws-key.pem'"

# Create groups from tags
groups:
  webservers: tags.Role == 'web'
  databases: tags.Role == 'database'
  monitoring: tags.Role == 'monitoring'

# Caching (optional, speeds up repeated runs)
cache: true
cache_plugin: jsonfile
cache_connection: /tmp/aws_inventory_cache
cache_timeout: 300  # 5 minutes

# List all discovered hosts
ansible-inventory -i inventory/aws_ec2.yml --graph

# Output:
# @all:
#   |--@env_production:
#   |  |--web-01
#   |  |--web-02
#   |  |--db-01
#   |--@env_staging:
#   |  |--staging-web-01
#   |--@role_web:
#   |  |--web-01
#   |  |--web-02
#   |--@type_t3_medium:
#   |  |--web-01
#   |  |--web-02

# Show all variables for a host
ansible-inventory -i inventory/aws_ec2.yml --host web-01

# Use in a playbook
ansible-playbook -i inventory/aws_ec2.yml site.yml

# Install Azure collection
ansible-galaxy collection install azure.azcollection
pip install azure-identity azure-mgmt-compute azure-mgmt-network azure-mgmt-resource

# inventory/azure_rm.yml
plugin: azure.azcollection.azure_rm

# Authentication (or use env vars / managed identity)
auth_source: auto

# Include only running VMs
include_vm_resource_groups:
  - production-rg
  - staging-rg

# Conditional groups
conditional_groups:
  webservers: "'web' in tags.Role | default('')"
  databases: "'db' in tags.Role | default('')"

# Keyed groups
keyed_groups:
  - key: tags.Environment | default('untagged')
    prefix: env
  - key: location
    prefix: region
  - key: os_profile.system | default('linux')
    prefix: os

# Connection settings
compose:
  ansible_host: private_ipv4_addresses[0] | default(public_ipv4_addresses[0])
  ansible_user: "'azureadmin'"

# Exclude deallocated VMs
exclude_host_filters:
  - powerstate != "running"

# Caching
cache: true
cache_plugin: jsonfile
cache_connection: /tmp/azure_inventory_cache
cache_timeout: 600

ansible-galaxy collection install google.cloud
pip install google-auth requests

# inventory/gcp.yml
plugin: google.cloud.gcp_compute

# Authentication
auth_kind: serviceaccount
service_account_file: /path/to/service-account.json

# Projects to query
projects:
  - my-gcp-project

# Zones
zones:
  - us-central1-a
  - us-central1-b
  - europe-west1-b

# Filters
filters:
  - status = RUNNING
  - labels.environment = production

# Grouping
keyed_groups:
  - key: labels.role
    prefix: role
  - key: zone
    prefix: zone
  - key: machine_type | basename
    prefix: type

compose:
  ansible_host: networkInterfaces[0].networkIP
  ansible_user: "'ansible'"

groups:
  webservers: labels.role == "web"
  databases: labels.role == "database"

cache: true
cache_plugin: jsonfile
cache_connection: /tmp/gcp_inventory_cache
cache_timeout: 300

ansible-galaxy collection install community.vmware
pip install pyvmomi

# inventory/vmware.yml
plugin: community.vmware.vmware_vm_inventory

hostname: vcenter.company.com
username: "ansible@vsphere.local"
password: "{{ vault_vcenter_password }}"
validate_certs: false

# Only powered-on VMs
with_nested_properties: true
resources:
  - datacenter:
      - DC1
    resources:
      - compute_resource:
          - Cluster1

filters:
  - runtime.powerState == "poweredOn"

keyed_groups:
  - key: config.guestId
    prefix: os
  - key: guest.net[0].network | default('unknown')
    prefix: network

compose:
  ansible_host: guest.ipAddress
  ansible_user: "'ansible'"

properties:
  - config.name
  - config.guestId
  - guest.ipAddress
  - runtime.powerState
  - config.hardware.memoryMB
  - config.hardware.numCPU

inventory/
├── 01-static.yml          # Static hosts (network devices, etc.)
├── 02-aws_ec2.yml         # AWS dynamic inventory
├── 03-azure_rm.yml        # Azure dynamic inventory
├── group_vars/
│   ├── all.yml            # Variables for all hosts
│   ├── webservers.yml     # Variables for web group
│   └── databases.yml      # Variables for db group
└── host_vars/
    └── special-host.yml   # Host-specific variables

# Ansible reads ALL files in the directory
ansible-playbook -i inventory/ site.yml

# Or set in ansible.cfg
[defaults]
inventory = ./inventory/

#!/usr/bin/env python3
"""Custom dynamic inventory from CMDB API."""
import json
import argparse
import requests

CMDB_URL = "https://cmdb.company.com/api/v1"
API_KEY = "your-api-key"

def get_inventory():
    """Fetch hosts from CMDB and build Ansible inventory."""
    headers = {"Authorization": f"Bearer {API_KEY}"}
    hosts = requests.get(f"{CMDB_URL}/hosts", headers=headers).json()

    inventory = {
        "_meta": {"hostvars": {}},
        "all": {"children": []}
    }

    groups = {}
    for host in hosts:
        hostname = host["fqdn"]

        # Add to groups
        for group in host.get("groups", []):
            if group not in groups:
                groups[group] = {"hosts": []}
                inventory["all"]["children"].append(group)
            groups[group]["hosts"].append(hostname)

        # Host variables
        inventory["_meta"]["hostvars"][hostname] = {
            "ansible_host": host["ip_address"],
            "ansible_user": host.get("ssh_user", "ansible"),
            "os_type": host.get("os", "linux"),
            "datacenter": host.get("datacenter", "unknown"),
            "environment": host.get("environment", "unknown"),
        }

    inventory.update(groups)
    return inventory

def get_host(hostname):
    """Fetch single host variables."""
    headers = {"Authorization": f"Bearer {API_KEY}"}
    host = requests.get(f"{CMDB_URL}/hosts/{hostname}", headers=headers).json()
    return {
        "ansible_host": host["ip_address"],
        "ansible_user": host.get("ssh_user", "ansible"),
    }

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("--list", action="store_true")
    parser.add_argument("--host", type=str)
    args = parser.parse_args()

    if args.list:
        print(json.dumps(get_inventory(), indent=2))
    elif args.host:
        print(json.dumps(get_host(args.host), indent=2))

# Make executable
chmod +x cmdb_inventory.py

# Test
./cmdb_inventory.py --list | jq

# Use
ansible-playbook -i cmdb_inventory.py site.yml

# plugins/inventory/cmdb.py
from ansible.plugins.inventory import BaseInventoryPlugin, Constructable, Cacheable

DOCUMENTATION = """
    name: cmdb
    plugin_type: inventory
    short_description: CMDB dynamic inventory
    options:
        api_url:
            description: CMDB API endpoint
            required: true
        api_key:
            description: API authentication key
            required: true
            env:
                - name: CMDB_API_KEY
"""

class InventoryModule(BaseInventoryPlugin, Constructable, Cacheable):
    NAME = "cmdb"

    def verify_file(self, path):
        return super().verify_file(path) and path.endswith(("cmdb.yml", "cmdb.yaml"))

    def parse(self, inventory, loader, path, cache=True):
        super().parse(inventory, loader, path, cache)
        self._read_config_data(path)

        api_url = self.get_option("api_url")
        api_key = self.get_option("api_key")

        # Fetch and populate inventory
        # self.inventory.add_host(hostname)
        # self.inventory.add_group(group)
        # self.inventory.add_child(group, hostname)
        # self.inventory.set_variable(hostname, key, value)

# In your inventory plugin config
cache: true
cache_plugin: jsonfile
cache_connection: /tmp/ansible_inventory_cache
cache_timeout: 300

# Clear cache when needed
ansible-inventory -i inventory/ --flush-cache

# Required tags for all cloud resources
tags:
  Environment: production    # Groups: env_production
  Role: web                  # Groups: role_web
  Team: platform             # Groups: team_platform
  Application: api           # Groups: app_api
  CostCenter: engineering    # For billing

compose:
  # Choose IP based on network access
  ansible_host: >-
    private_ip_address if 'vpn' in group_names
    else public_ip_address | default(private_ip_address)

  # Set user based on OS
  ansible_user: >-
    'ec2-user' if image_id.startswith('ami-amazon')
    else 'ubuntu' if image_id.startswith('ami-ubuntu')
    else 'centos'