Ansible on AWS: Automate EC2, S3, IAM & More (Complete Guide 2026)

ansible-galaxy collection install amazon.aws
pip install boto3 botocore

# Option 1: AWS CLI credentials file (~/.aws/credentials)
aws configure

# Option 2: Environment variables
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
export AWS_DEFAULT_REGION=us-east-1

- hosts: localhost
  connection: local
  vars:
    aws_access_key: "{{ vault_aws_access_key }}"
    aws_secret_key: "{{ vault_aws_secret_key }}"
    region: us-east-1

- name: Launch EC2 instance
  amazon.aws.ec2_instance:
    name: web-server-01
    instance_type: t3.micro
    image_id: ami-0c55b159cbfafe1f0
    key_name: my-ssh-key
    vpc_subnet_id: subnet-0123456789abcdef0
    security_group: web-sg
    network:
      assign_public_ip: true
    tags:
      Environment: production
      App: webserver
    state: running
  register: ec2_result

- name: Show instance details
  ansible.builtin.debug:
    msg: "Instance {{ ec2_result.instances[0].instance_id }} at {{ ec2_result.instances[0].public_ip_address }}"

- name: Stop instance
  amazon.aws.ec2_instance:
    instance_ids: ["i-0123456789abcdef0"]
    state: stopped

- name: Terminate instance
  amazon.aws.ec2_instance:
    instance_ids: ["i-0123456789abcdef0"]
    state: absent

# inventory/aws_ec2.yml
plugin: amazon.aws.aws_ec2
regions:
  - us-east-1
  - eu-west-1
filters:
  tag:Environment: production
  instance-state-name: running
keyed_groups:
  - key: tags.App
    prefix: app
  - key: placement.region
    prefix: region
compose:
  ansible_host: public_ip_address

ansible-inventory -i inventory/aws_ec2.yml --list
ansible -i inventory/aws_ec2.yml all -m ping

- name: Create S3 bucket
  amazon.aws.s3_bucket:
    name: my-app-assets-{{ env }}
    state: present
    versioning: true
    encryption: AES256
    tags:
      Environment: "{{ env }}"

- name: Upload file to S3
  amazon.aws.s3_object:
    bucket: my-app-assets-prod
    object: config/app.conf
    src: files/app.conf
    mode: put

- name: Download file from S3
  amazon.aws.s3_object:
    bucket: my-app-assets-prod
    object: backups/latest.tar.gz
    dest: /tmp/latest.tar.gz
    mode: get

- name: Create VPC
  amazon.aws.ec2_vpc_net:
    name: app-vpc
    cidr_block: 10.0.0.0/16
    region: us-east-1
    tags:
      Environment: production
  register: vpc

- name: Create subnet
  amazon.aws.ec2_vpc_subnet:
    vpc_id: "{{ vpc.vpc.id }}"
    cidr: 10.0.1.0/24
    az: us-east-1a
    tags:
      Name: public-subnet-1a
  register: subnet

- name: Create security group
  amazon.aws.ec2_security_group:
    name: web-sg
    description: Web server security group
    vpc_id: "{{ vpc.vpc.id }}"
    rules:
      - proto: tcp
        ports: [80, 443]
        cidr_ip: 0.0.0.0/0
      - proto: tcp
        ports: [22]
        cidr_ip: 10.0.0.0/8

- name: Create IAM user
  amazon.aws.iam_user:
    name: deploy-bot
    state: present
    tags:
      Purpose: CI/CD deployment

- name: Create IAM role
  amazon.aws.iam_role:
    name: ec2-s3-access
    assume_role_policy_document: "{{ lookup('file', 'trust-policy.json') }}"
    managed_policies:
      - arn:aws:iam::aws:policy/AmazonS3ReadOnlyAccess
    state: present

- name: Create RDS PostgreSQL instance
  amazon.aws.rds_instance:
    db_instance_identifier: app-db-prod
    engine: postgres
    engine_version: "16.3"
    db_instance_class: db.t3.medium
    allocated_storage: 50
    master_username: dbadmin
    master_user_password: "{{ vault_rds_password }}"
    vpc_security_group_ids:
      - sg-0123456789abcdef0
    db_subnet_group_name: app-db-subnet-group
    multi_az: true
    backup_retention_period: 7
    tags:
      Environment: production
  no_log: true

---
- name: Deploy full AWS infrastructure
  hosts: localhost
  connection: local
  vars_files:
    - vars/aws-{{ env }}.yml
    - vars/vault-aws.yml
  
  tasks:
    - name: Create VPC
      amazon.aws.ec2_vpc_net:
        name: "{{ project }}-vpc"
        cidr_block: "{{ vpc_cidr }}"
        region: "{{ aws_region }}"
      register: vpc

    - name: Create subnets
      amazon.aws.ec2_vpc_subnet:
        vpc_id: "{{ vpc.vpc.id }}"
        cidr: "{{ item.cidr }}"
        az: "{{ item.az }}"
        tags:
          Name: "{{ item.name }}"
      loop: "{{ subnets }}"

    - name: Launch web servers
      amazon.aws.ec2_instance:
        name: "{{ project }}-web-{{ item }}"
        instance_type: "{{ instance_type }}"
        image_id: "{{ ami_id }}"
        key_name: "{{ ssh_key }}"
        vpc_subnet_id: "{{ subnet_id }}"
        state: running
      loop: "{{ range(1, web_count + 1) | list }}"

    - name: Create S3 bucket for assets
      amazon.aws.s3_bucket:
        name: "{{ project }}-assets-{{ env }}"
        versioning: true