Skip to content

Getting started

This page takes you from the AWS Marketplace listing to your first playbook run: subscribe, launch, connect, then run the example playbook against the instance itself.

You need: an AWS account with permission to subscribe to AWS Marketplace products, launch EC2 instances and use AWS Systems Manager.

1. Subscribe

Open the Ansible listing in AWS Marketplace, choose View purchase options, review the terms and subscribe. When the subscription is confirmed, choose Launch your software.

2. Launch the instance

On the EC2 launch page:

  1. Keep the instance type at t3.medium.
  2. Under Configure storage, use an encrypted gp3 root volume of at least 16 GiB.
  3. Under Network settings, allow no inbound traffic. If you also want SSH, allow port 22 from your administrative address range only.
  4. Under Advanced details, choose an IAM instance profile that includes the AWS managed policy AmazonSSMManagedInstanceCore, so you can connect with Session Manager.
  5. Choose Launch instance.

3. Connect

In the EC2 console, select the instance, choose Connect, then Session Manager, then Connect. Switch to the ubuntu user:

sudo -iu ubuntu

4. Wait for first boot

On first boot the instance writes /etc/ansible/ansible.cfg, /etc/ansible/hosts, the vault password and the workspace:

cloud-init status --wait
systemctl is-active sushi-ansible-core-firstboot
ansible --version

ansible --version reports core 2.21.4.

5. Run the walkthrough

bash /opt/sushi/docs/demo.sh

6. Run the example playbook

Check that the inventory holds only the local host, then run the example:

ansible-inventory --sushi-check-local
ansible-playbook /var/lib/ansible-core/workspace/site.yml

The example uses both pinned collections to write a small JSON file to /var/lib/ansible-core/workspace/published/. It does not reach the network. Run it a second time: the recap shows changed=0, because nothing needed to change.

Write your own playbooks

Put your playbooks in /var/lib/ansible-core/workspace, which the ubuntu user owns. Target hosts: local (or localhost) to manage the instance itself.

Privilege escalation is off, so tasks that write to system paths fail until you ask for it. See Configuration to use become, add remote hosts or install more collections.