Chapter 79: DevOps Projects Part 9: Ansible Nginx Roles Vault Patch Inventory Agents

79.5 Project 65: Dynamic AWS inventory

By Ravindra Bagale Last updated: 28 October 2026

Friends, static host files go stale when ASGs replace nodes. Today we write an aws_ec2 inventory plugin file, filter by tags, list groups, and ping role_web.

What you will build in this project

aws_ec2.yaml plugin.
Tag contract.
ansible-inventory graph.
Ping dynamic group.

1. Start from a real company story

At Freshworks in Chennai, a static hosts.ini pointed at an old private IP after ASG rotation and the patch playbook missed live nodes.

Rough waste: about ₹12 lakh in a bad patch weekend and rollback.

Divya switched the team to aws_ec2 inventory keyed by Role tags.

Today we build that dynamic inventory.

Picture 1: EC2 tags → aws_ec2 plugin → role_web group → playbook

Ravindra Bagale's Tip

Students put AWS access keys inside the inventory YAML. Keys belong in the instance role or the environment. Keep that habit.

2. Start and prepare

Step 1: Why dynamic

Why: IPs change; tags stay. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'AWS inventory plugin builds host lists from EC2 tags'

You will see:

AWS inventory plugin builds host lists from EC2 tags

What it means: What.

Example 2: a2

Type this:

mkdir -p /tmp/ans65 && echo 'No more stale hosts.ini after ASG replace'

You will see:

No more stale hosts.ini after ASG replace

What it means: Why.

Example 3: a3

Type this:

echo 'Today: aws_ec2.yaml plugin, tag filters, ansible-inventory'

You will see:

Today: aws_ec2.yaml plugin, tag filters, ansible-inventory

What it means: Scope.

Step 2: Plugin file

Why: amazon.aws.aws_ec2. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: yaml inventory. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' 'plugin: amazon.aws.aws_ec2' 'regions:' '  - ap-south-1' 'filters:' '  tag:Project: shop' '  instance-state-name: running' 'hostnames:' '  - private-ip-address' 'keyed_groups:' '  - key: tags.Role' '    prefix: role' 'compose:' '  ansible_host: private_ip_address' > /tmp/ans65/aws_ec2.yaml && cat /tmp/ans65/aws_ec2.yaml

You will see:

plugin: amazon.aws.aws_ec2

What it means: Plugin.

Example 5: b2

Type this:

echo 'ansible-galaxy collection install amazon.aws'

You will see:

ansible-galaxy collection install amazon.aws

What it means: Collection.

Example 6: b3

Type this:

echo 'IAM needs ec2:DescribeInstances on the control role'

You will see:

IAM needs ec2:DescribeInstances on the control role

What it means: IAM tip.

Step 3: List inventory

Why: See groups. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ansible-inventory. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

echo 'ansible-inventory -i aws_ec2.yaml --graph'

You will see:

ansible-inventory -i aws_ec2.yaml --graph

What it means: Graph.

Example 8: c2

Type this:

echo 'ansible-inventory -i aws_ec2.yaml --list | head'

You will see:

ansible-inventory -i aws_ec2.yaml --list | head

What it means: List.

Example 9: c3

Type this:

echo 'Expect groups like role_web from tag Role=web'

You will see:

Expect groups like role_web from tag Role=web

What it means: Expect.

3. Build the main pieces

Step 4: Tagging contract

Why: Hosts must be tagged. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: TAGS.txt. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' 'Required tags:' '  Project=shop' '  Role=web|app|db' '  Env=dev|stage|prod' > /tmp/ans65/TAGS.txt && cat /tmp/ans65/TAGS.txt

You will see:

Role=web|app|db

What it means: Contract.

Example 11: d2

Type this:

echo 'ASG launch templates must stamp the same tags'

You will see:

ASG launch templates must stamp the same tags

What it means: ASG tip.

Example 12: d3

Type this:

echo 'Untagged instances are invisible to this inventory'

You will see:

Untagged instances are invisible to this inventory

What it means: Warning.

Step 5: ansible.cfg

Why: Point at plugin. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: cfg. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' '[defaults]' 'inventory = ./aws_ec2.yaml' 'interpreter_python = auto_silent' > /tmp/ans65/ansible.cfg && cat /tmp/ans65/ansible.cfg

You will see:

inventory = ./aws_ec2.yaml

What it means: cfg.

Example 14: e2

Type this:

echo 'Enable inventory cache only with a short timeout in labs'

You will see:

Enable inventory cache only with a short timeout in labs

What it means: Cache tip.

Example 15: e3

Type this:

echo 'Disable cache when debugging missing hosts'

You will see:

Disable cache when debugging missing hosts

What it means: Debug.

Step 6: Target by group

Why: Play against role_web. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: play tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' '---' '- name: Ping dynamic web' '  hosts: role_web' '  tasks:' '    - ping:' > /tmp/ans65/ping-web.yml && cat /tmp/ans65/ping-web.yml

You will see:

hosts: role_web

What it means: Play.

Example 17: f2

Type this:

echo 'ansible-playbook ping-web.yml'

You will see:

ansible-playbook ping-web.yml

What it means: Run.

Example 18: f3

Type this:

echo 'Compose ansible_user from tags if your AMI user differs'

You will see:

Compose ansible_user from tags if your AMI user differs

What it means: User tip.

4. Automate and verify

Step 7: Credentials

Why: Env or instance role. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: auth tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

echo 'Prefer the control node instance role over long-lived keys'

You will see:

Prefer the control node instance role over long-lived keys

What it means: Role.

Example 20: g2

Type this:

echo 'If keys are required: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the environment'

You will see:

If keys are required: AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY in the environment

What it means: Env tip.

Example 21: g3

Type this:

echo 'Never put access keys inside aws_ec2.yaml'

You will see:

Never put access keys inside aws_ec2.yaml

What it means: No keys in file.

Step 8: Refresh habit

Why: Before every patch night. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: refresh. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'ansible-inventory -i aws_ec2.yaml --graph > /tmp/ans65/INV.txt'

You will see:

ansible-inventory -i aws_ec2.yaml --graph > /tmp/ans65/INV.txt

What it means: Refresh.

Example 23: h2

Type this:

printf '%s\n' 'Refresh inventory at the start of every change window' > /tmp/ans65/HABIT.txt && cat /tmp/ans65/HABIT.txt

You will see:

Refresh inventory at the start of every change window

What it means: Habit.

Example 24: h3

Type this:

echo 'Compare host count to the ASG desired capacity'

You will see:

Compare host count to the ASG desired capacity

What it means: Compare.

Step 9: Story Freshworks

Why: Stale IP. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'At Freshworks in Chennai, a static hosts.ini pointed at an old private IP after ASG rotation. The patch playbook updated a decommissioned box and skipped the live ones.' 'Divya switched the team to aws_ec2 inventory keyed by Role tags.' > /tmp/ans65/STORY.txt && wc -l /tmp/ans65/STORY.txt

You will see:

2 /tmp/ans65/STORY.txt

What it means: Story.

Example 26: i2

Type this:

echo 'Rough waste: about ₹12 lakh in a bad patch weekend and rollback'

You will see:

Rough waste: about ₹12 lakh in a bad patch weekend and rollback

What it means: Cost.

Example 27: i3

Type this:

echo 'Divya: PASS'

You will see:

Divya: PASS

What it means: Sign-off.

5. Harden and accept

Step 10: Local proof

Why: Plugin present. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: files. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

test -f /tmp/ans65/aws_ec2.yaml && echo 'plugin ok'

You will see:

plugin ok

What it means: Plugin.

Example 29: j2

Type this:

grep keyed_groups -A2 /tmp/ans65/aws_ec2.yaml

You will see:

keyed_groups:\n  - key: tags.Role\n    prefix: role

What it means: Groups.

Example 30: j3

Type this:

cat /tmp/ans65/TAGS.txt

You will see:

Required tags:\n  Project=shop\n  Role=web|app|db\n  Env=dev|stage|prod

What it means: Tags.

Step 11: Acceptance

Why: Dynamic inventory ready. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

echo 'Plugin filters Project=shop running instances'

You will see:

Plugin filters Project=shop running instances

What it means: Filter.

Example 32: k2

Type this:

echo 'No credentials inside yaml'

You will see:

No credentials inside yaml

What it means: Security.

Example 33: k3

Type this:

echo 'Next: Jenkins agents with Ansible project 66'

You will see:

Next: Jenkins agents with Ansible project 66

What it means: Bridge.

Step 12: Bridge

Why: Agents next. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: bridge. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'Dynamic groups feed agent provisioning next'

You will see:

Dynamic groups feed agent provisioning next

What it means: Link.

Example 35: z2

Type this:

echo 'Tag every EC2 at launch'

You will see:

Tag every EC2 at launch

What it means: Habit.

Example 36: z3

Type this:

echo 'Divya: PASS'

You will see:

Divya: PASS

What it means: Done.

Check yourself

Q1. Who fixed Freshworks stale inventory?

Divya

Q2. Plugin name?

amazon.aws.aws_ec2

Q3. Group prefix tip?

role

Q4. Keys in yaml?

Q5. Filter tag?

Project

Q6. List command?

ansible-inventory

Friends, you built a dynamic AWS inventory. Did you understand? Let us try it once more. Add a second keyed group on tags.Env so you can target role_web:&env_prod.

Lab: try at home

Write aws_ec2.yaml.
Document required tags.
Graph inventory.
Ping role_web.

Recap

Tags drive groups.
Plugin replaces stale IPs.
IAM describe only.
No keys in YAML.
Refresh each window.