Ansible: setting user on dynamic ec2

Question

I don't appear to be connecting to the remote host. Why not?

Command-line: ansible-playbook -i "127.0.0.1," -c local playbook.yml

This is the playbook. The role, create_ec2_instance, creates the variable ec2hosts used within the second portion of the playbook (ansible/playbook.yml):

# Create instance
- hosts: 127.0.0.1
  connection: local
  gather_facts: false
  roles:
    - create_ec2_instance

# Configure and install all we need
- hosts: ec2hosts
  remote_user: admin
  gather_facts: false
  roles:
    - show-hosts
    - prepare-target-system
    - install-project-dependencies
    - install-project

This is just a simple ec2 module creation. This works as desired. (ansible/roles/create-ec2-instance/tasks/main.yml):

- name: Create instance
  ec2:
    region: "{{ instance_values['region'] }}"
    zone: "{{ instance_values['zone'] }}"
    keypair: "{{ instance_values['key_pair'] }}"
    group: "{{ instance_values['security_groups'] }}"
    instance_type: "{{ instance_values['instance_type'] }}"
    image: "{{ instance_values['image_id'] }}"
    count_tag: "{{ instance_values['name'] }}"
    exact_count: 1
    wait: yes
    instance_tags:
      Name: "{{ instance_values['name'] }}"
  when: ec2_instances.instances[instance_values['name']]|default("") == ""
  register: ec2_info

- name: Wait for instances to listen on port 22
  wait_for:
    state: started
    host: "{{ ec2_info.instances[0].public_dns_name }}"
    port: 22
  when: ec2_info|changed

- name: Add new instance to ec2hosts group
  add_host:
    hostname: "{{ ec2_info.instances[0].public_ip }}"
    groupname: ec2hosts
    instance_id: "{{ ec2_info.instances[0].id }}"
  when: ec2_info|changed

I've included extra methods for transparency, though these are really basic (ansible/roles/show-hosts/tasks/main.yml):

- name: List hosts
  debug: msg="groups={{groups}}"
  run_once: true

and we have (ansible/roles/prepare-target-system/tasks/main.yml):

- name: get the username running the deploy
  local_action: command whoami
  register: username_on_the_host

- debug: var=username_on_the_host

- name: Add necessary system packages
  become: yes
  become_method: sudo
  package: "name={{item}} state=latest"
  with_items:
    - software-properties-common
    - python-software-properties
    - devscripts
    - build-essential
    - libffi-dev
    - libssl-dev
    - vim

Edit: I've updated to remote_user above and below is the error output:

TASK [prepare-target-system : debug] *******************************************
task path: <REDACTED>/ansible/roles/prepare-target-system/tasks/main.yml:5
ok: [35.166.52.247] => {
    "username_on_the_host": {
        "changed": true,
        "cmd": [
            "whoami"
        ],
        "delta": "0:00:00.009067",
        "end": "2017-01-07 08:23:42.033551",
        "rc": 0,
        "start": "2017-01-07 08:23:42.024484",
        "stderr": "",
        "stdout": "brianbruggeman",
        "stdout_lines": [
            "brianbruggeman"
        ],
        "warnings": []
    }
}

TASK [prepare-target-system : Ensure that we can update apt-repository] ********
task path: /<REDACTED>/ansible/roles/prepare-target-system/tasks/Debian.yml:2
Using module file <REDACTED>/.envs/dg2/lib/python2.7/site-packages/ansible/modules/core/packaging/os/apt.py
<35.166.52.247> ESTABLISH LOCAL CONNECTION FOR USER: brianbruggeman
<35.166.52.247> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769 `" && echo ansible-tmp-1483799022.33-268449475843769="` echo $HOME/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769 `" ) && sleep 0'
<35.166.52.247> PUT /var/folders/r9/kv1j05355r34570x2f5wpxpr0000gn/T/tmpK2__II TO <REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/apt.py
<35.166.52.247> EXEC /bin/sh -c 'chmod u+x <REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/ <REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/apt.py && sleep 0'
<35.166.52.247> EXEC /bin/sh -c 'sudo -H -S -n -u root /bin/sh -c '"'"'echo BECOME-SUCCESS-owktjrfvqssjrqcetaxjkwowkzsqfitq; /usr/bin/python <REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/apt.py; rm -rf "<REDACTED>/.ansible/tmp/ansible-tmp-1483799022.33-268449475843769/" > /dev/null 2>&1'"'"' && sleep 0'
failed: [35.166.52.247] (item=[u'software-properties-common', u'python-software-properties', u'devscripts', u'build-essential', u'libffi-dev', u'libssl-dev', u'vim']) => {
    "failed": true,
    "invocation": {
        "module_name": "apt"
    },
    "item": [
        "software-properties-common",
        "python-software-properties",
        "devscripts",
        "build-essential",
        "libffi-dev",
        "libssl-dev",
        "vim"
    ],
    "module_stderr": "sudo: a password is required\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE"
}
  to retry, use: --limit @<REDACTED>/ansible/<redacted playbook>.retry

PLAY RECAP *********************************************************************
127.0.0.1                  : ok=6    changed=2    unreachable=0    failed=0
35.166.52.247              : ok=3    changed=1    unreachable=0    failed=1

A K A K · Accepted Answer · 2017-01-08T10:24:42

Use become:

remote_user: ansible
become: true
become_user: root

Ansible docs: Become (Privilege Escalation)

For example: in my scripts i connect to remote host as user 'ansible' (because ssh is disabled for root), and then become 'root'. Rarely, i connect as 'ansible', then become 'apache' user. So, remote_user specify username to connect, become_user is username after connection.

PS Passwordless sudo for user ansible:

- name: nopasswd sudo for ansible user
  lineinfile: "dest=/etc/sudoers state=present regexp='^{{ ansible_user }}' line='{{ ansible }} ALL=(ALL) NOPASSWD: ALL'"

This is known workaround, see here: Specify sudo password for Ansible

Ansible: setting user on dynamic ec2

1 Answers