Ansible: running through a bastion host

E.g. in inventory create:



ansible_ssh_common_args: "-o ProxyCommand='ssh -W %h:%p {{ AWS_IAM_ID }}@hostname' -o ControlMaster=auto -o ControlPersist=30m -o StrictHostKeyChecking=no"

Then make sure you’ve got both your private keys (bastion and destination) added via ssh-add.

E.g. ssh-add ~/.ssh/id_rsa




Ansible: Dynamic Inventory (using the AWS EC2 External Inventory Script)

Where hosts can appear and disappear (e.g. with AWS ASGs) the EC2 external inventory script ( comes in useful.

All you need to do is to export your AWS keys as environment variables and is good.

ec2.ini options

The EC2 inventory output can become very large. To manage its size, you can configure which groups should be created using ec2.ini options. E.g.

Note on how these are created:

  • format is tag_KEY_VALUE
  • special characters are changed to an underscore

E.g. with a NAME of my instance name we would get a tag of  tag_NAME_my_instance_name.


These inikeys are read in E.g.

See also: