Setup AWS Load Balancer Using Ansible

...So we were given this task in the Altschool School of Cloud Engineering to setup an Nginx load balanced application using AWS, having learnt about Ansible, I decided to automate the task using Ansible's IaC capabilities.

Load balancing your applications help you attain high availability/up time. Imagine you were tasked to provision 10+ servers in various availability zones (AZ) using the AWS console, I bet that would be a pain and boring task which can also lead to inconsistencies and human error.

In this article, I will walk you through how we can provision a load balanced application using Ansible which makes it really efficient to provision your infrastructures consistently.

By the end of this article, we'll get the following setup and running with Ansible;

VPC with 2 public and private subnets
Security Groups to manage traffic within our VPC
Internet Gateway
NAT Gateway
Two EC2 AMIs running with nginx server
ALB to balance our requests in the AZs

Architecture Overview

image credit: AWS

Prerequisites:

AWS CLI
Boto3 Library
IAM user role with EC2 & Elastic Load Balancing access (following the principle of least privilege)
Ansible
Ansible collection for AWS ansible-galaxy collection install community.aws
Optional - AWS Vault - you might want to also setup aws-vault for your IAM user role access key and secret key (recommended)

Let's get started;

Create/update your inventory file: hosts.yml

I will be using my local machine as the control node, a bastion host or Ansible tower can suffice.

---
localhost:
  hosts:
    127.0.0.1:

Playbook file: main.yml

---
- name: ansible aws alb
  hosts: localhost
  gather_facts: no
  tasks:

1. AWS VPC: Think of a VPC as your own data centre where you will setup your traditional network and add subnets, but here, everything is virtual and AWS helps you with scaling without much thinkering on your part.

As a private network, we would use a private Classless Interdomain Routing (CIDR) block. As a rule of thumb, let's take note of the AWS rules for creating a best practice VPC;

CIDR block size must be between /28 & /16 subnet mask.
The CIDR block must not overlap with any existing CIDR block that's associated with the VPC.
You cannot increase or decrease the size of an existing CIDR block.
The first four and last IP addresses are not available for use, this is a very important point to note so you have enough addresses for the instances and resources you deploy.
Use CIDR blocks from the RFC 1918 ranges.

Using this 10.0.0.0/16 CIDR block, we have enough networks and hosts per network.

N.B: I would only use IPv4 addresses in this article. We'll use the register to retrieve/reference variables.


    - name: setup altschool vpc.
      amazon.aws.ec2_vpc_net:
        name: Altschool VPC
        cidr_block: 10.0.0.0/16
        region: us-east-1
        tags:
          module: ec2_vpc_net
          this: altschool_vpc
      register: vpc_id

2. SUBNETS FOR OUR VPC: A subnet is a range of IP addresses in your VPC, here, we will create four subnets; 2 public and 2 private. You can leverage this IP Subnet Tool to help you create your subnets.

Public Subnet: This subnet will have a direct route to an internet gateway as in our diagram, this is where we would launch our ALB later on. Make sure to create them in more than one AZs (ex: us-east-1a & us-east-1b) for high availability; this helps your load balancer to keep serving your users from the available zones when one server in an AZ goes down while you bring them back up.


# public subnet 1
    - name: create Public 1A subnet
      amazon.aws.ec2_vpc_subnet:
        state: present
        cidr: 10.0.1.0/24
        region: us-east-1
        az: us-east-1a
        vpc_id: "{{ vpc_id.vpc.id }}"
        tags:
          Name: Public 1A
      register: public_1a


# public subnet 2
    - name: create Public 1B subnet
      amazon.aws.ec2_vpc_subnet:
        state: present
        cidr: 10.0.2.0/24
        region: us-east-1
        az: us-east-1b
        vpc_id: "{{ vpc_id.vpc.id }}"
        tags:
          Name: Public 1B
      register: public_1b

Private Subnet: This subnet does not have a direct route to an internet gateway. Resources in a private subnet require a NAT device/gateway to access the public internet. We'll launch our ec2 instances in this subnet. Make sure to create them in different AZs for high availability.


# private subnet 1
    - name: create Private 1A subnet
      amazon.aws.ec2_vpc_subnet:
        state: present
        cidr: 10.0.3.0/24
        region: us-east-1
        az: us-east-1a
        vpc_id: "{{ vpc_id.vpc.id }}"
        tags:
          Name: Private 1A
      register: private_1a


# private subnet 2
    - name: create Private 1B subnet
      amazon.aws.ec2_vpc_subnet:
        state: present
        cidr: 10.0.4.0/24
        region: us-east-1
        az: us-east-1b
        vpc_id: "{{ vpc_id.vpc.id }}"
        tags:
          Name: Private 1B
      register: private_1b

3. INTERNET GATEWAY: The internate gateway allows communication between our VPC and the internet, here, we need to route internet-bound traffic to the internet gateway from the public subnet where our load balancer sits.


    - name: create internet gateway
      amazon.aws.ec2_vpc_igw:
        vpc_id: "{{ vpc_id.vpc.id }}"
        state: present
        tags:
          Name: Altschool igw
      register: igw_id

4. NAT GATEWAY: We need a NAT device to allow our private ec2 instance access to donwload initial updates and install the neccessary components. You can decide to use a the AWS managed NAT gateway or choose to create your own NAT instance, here I'll be using a NAT gateway. NAT gateways are paid, make sure to review its pricing, also remember to shut it down when done configuring your instances, you can always attach a new NAT gateway later on.


    - name: Create new nat gateway
      amazon.aws.ec2_vpc_nat_gateway:
        state: present 
        subnet_id: "{{ public_1a.subnet.id }}"
        if_exist_do_not_create: yes
        release_eip: true
        wait: true
        region: us-east-1
      register: natgw_id

5. ROUTE TABLES: We need to create route tables for the internet gateway and NAT gateway. By default, AWS creates a route table for every VPC.

Internet Gateway Route Table: We create a router to route traffic from anywhere on the internet 0.0.0.0/0 to our internet gateway. This is going to be our main route table because we'll also associate our public subnets to it.


    - name: create internet gateway route table
      amazon.aws.ec2_vpc_route_table:
        vpc_id: "{{ vpc_id.vpc.id }}"
        region: us-east-1
        tags:
          Name: Public Web
        subnets:
          - "{{ public_1a.subnet.id }}"
          - "{{ public_1b.subnet.id }}"
        routes:
          - dest: 0.0.0.0/0
            gateway_id: "{{ igw_id.gateway_id }}"
      register: public_route_table

NAT Gateway Route Table: We also create another route table to route traffic from the internet to our NAT gateway and then associate our private subnets to it.


    - name: create NAT gateway route table
      amazon.aws.ec2_vpc_route_table:
        vpc_id: "{{ vpc_id.vpc.id }}"
        region: us-east-1
        tags:
          Name: Private Web
        subnets:
          - "{{ private_1a.subnet.id }}"
          - "{{ private_1b.subnet.id }}"
        routes:
          - dest: 0.0.0.0/0
            gateway_id: "{{ natgw_id.nat_gateway_id }}"
      register: private_route_table

6. SECURITY GROUPS: These are stateful traffic controllers that determine the traffic allowed to reach a certain resource attached to it. We'll create ALB & Instance security groups.

ALB Security Group: For this, we need to create an inbound rule to allow http traffic on port 80 for our load balancer, we will keep the default outbound rules as we would be deploying a static app.


    - name: create ALB security group
      amazon.aws.ec2_security_group:
        name: alb-sg
        description: allow internet access to ALB
        vpc_id: "{{ vpc_id.vpc.id }}"
        region: us-east-1
        tags:
          Name: Altschool alb sg
        rules:
          - proto: tcp
            ports:
            - 80
            cidr_ip: 0.0.0.0/0
            rule_desc: allow http traffic from anywhere
      register: alb_sg

Instance Security Group: We also create a rule to allow inbound ssh traffic to our local machine IP (optional) and http traffic from the ALB security group.


- name: create private ec2 instance security group
      amazon.aws.ec2_security_group:
        name: altschool-ec2-sg
        description: allow internet-facing ALB access
        vpc_id: "{{ vpc_id.vpc.id }}"
        region: us-east-1
        tags:
          Name: Altschool sg
        rules:
          - proto: tcp
            ports:
            - 22
            # replace the IP with your host machine IP
            cidr_ip: 197.xxx.xx.xx/32
            rule_desc: allow ssh traffic from local machine
          - proto: tcp
            ports:
            - 80
            group_id: "{{ alb_sg.group_id }}"
            rule_desc: allow traffic from ALB security group
      register: ec2_sg

7. TARGET GROUP: We need to create a target group for our load balancer, we'll register our targets later on.

ensure you already setup ansible community module for this.


    - name: Create a target group with a default health check
      community.aws.elb_target_group:
        name: altschool-tg
        protocol: http
        port: 80
        vpc_id: "{{ vpc_id.vpc.id }}"
        state: present

8. APPLICATION LOAD BALANCER: Go ahead and configure the ALB in the public subnet.


    - name: setup load balancer
      amazon.aws.elb_application_lb:
        name: altschool-alb
        subnets:
          - "{{ public_1a.subnet.id }}"
          - "{{ public_1b.subnet.id }}"
        security_groups:
          - "{{ alb_sg.group_id }}"
        region: us-east-1
        listeners:
          - Protocol: HTTP
            Port: 80
            DefaultActions:
              - Type: forward
                TargetGroupName: altschool-tg
        state: present
      register: altschool_lb

9. EC2 AMIs: We go ahead and launch our ec2 instances using a simple user data script to install Nginx and display the hostname of our individual servers. Here, I used the AWS linux 2 AMI image ami-0b5eea76982371e91 you can use any distro of your choice, be sure to specify them appropriately.

Optional: Import a Key Pair. Before launching an EC2 instance, it is recommended to create a key pair or attach an existing key, this will enable you access your private instances later using their private IPs. Here I'll choose to import a key pair with the default name of each OS. In this case, we'll use ec2-user since we'll be using Amazon Linux 2 AMI. Make sure to create one beforehand and name it appropriately (eg: ec2-user) from the AWS console.


# change the user-name path accordingly
- name: import ec2 key pair
      amazon.aws.ec2_key:
        name: ec2-user
        key_material: "{{ lookup('file', '/home/user-name/.ssh/id_rsa.pub') }}"
      tags:
        - ec2_create
        - ec2_keypair

Write this script in a file and specify the location in the lookup file user_data.sh:

#!/bin/bash

yum update -y

amazon-linux-extras install nginx1.12

systemctl start nginx

systemctl enable nginx

echo "<h1>This server has the IP: $(hostname -f)</h1>" > /usr/share/nginx/html/index.html


    - name: create server1 ec2 instance with user data
      amazon.aws.ec2_instance:
        name: server1
        region: us-east-1
        key_name: ec2-user
        instance_type: t2.micro
        security_group: "{{ ec2_sg.group_id }}"
        vpc_subnet_id: "{{ private_1a.subnet.id }}"
        network:
          assign_public_ip: false
          delete_on_termination: true
        image_id: ami-0b5eea76982371e91
        user_data: "{{ lookup('file', 'user_data.sh') }}"
      tags:
        - ec2_create
      register: server1

Repeat same for server 2


    - name: create server2 ec2 instance with user data
      amazon.aws.ec2_instance:
        name: server2
        region: us-east-1
        key_name: ec2-user
        instance_type: t2.micro
        security_group: "{{ ec2_sg.group_id }}"
        vpc_subnet_id: "{{ private_1b.subnet.id }}"
        network:
          assign_public_ip: false
          delete_on_termination: true
        image_id: ami-0b5eea76982371e91
        user_data: "{{ lookup('file', 'user_data.sh') }}"
      tags:
        - ec2_create
      register: server2

10. ATTACH INSTANCES TO TARGET GROUP Finally, we now attach our private instances to our load balancer target group.


# Register server1 & 2 instance targets to our target group
    - name: Register targets
      community.aws.elb_target:
        target_group_name: altschool-tg
        target_id: 
          - "{{ server1.instances[0].instance_id }}"
          - "{{ server2.instances[0].instance_id }}"
        state: present

Checkout the final playbook.

Go ahead and run the playbook.

N.B >> Using the Ansible --check flag fails on some modules like amazon.aws.ec2_vpc_net etc, doesn't mean they are wrong)

You should have similar results if there are no errors :) Live demo

Please leave a comment if you've got better ways to implement this, I'll be in the comment section. Ka emesia.

Ndubuisi Ugwulo

Ndubuisi Ugwulo

Setting up AWS Application Load Balancer Using Ansible

Architecture Overview

Prerequisites: