如何通过Ansible在创建VPC时自动为关联服务添加AWS标签？

Absolutely—this is a common gotcha when provisioning VPCs with Ansible, since cloud providers (like AWS, which I’m assuming you’re using given the VPC terminology) don’t automatically propagate VPC tags to default associated resources like the main route table or DHCP options set. Here are two reliable ways to handle this cleanly:

Method 1: Capture VPC Outputs and Tag Associated Resources Manually #

This is the most straightforward approach, leveraging Ansible’s ability to register module outputs and reuse them across tasks.

Step 1: Create the VPC and Register Results #

First, define your VPC creation task and register the output to capture IDs for the auto-generated resources:

- name: Provision custom VPC with base tags
  amazon.aws.ec2_vpc_net:
    name: my-production-vpc
    cidr_block: 10.0.0.0/16
    tags:
      Name: my-production-vpc
      Environment: production
      Project: my-app
  register: provisioned_vpc

The provisioned_vpc variable will include critical IDs you need:

• provisioned_vpc.vpc.id: The VPC itself
• provisioned_vpc.vpc.main_route_table_id: The auto-created main route table
• provisioned_vpc.vpc.dhcp_options_id: The default DHCP options set linked to the VPC

Step 2: Tag the Main Route Table #

Use the ec2_tag module to apply the same tags from the VPC to the main route table:

- name: Propagate VPC tags to main route table
  amazon.aws.ec2_tag:
    resource: "{{ provisioned_vpc.vpc.main_route_table_id }}"
    state: present
    tags: "{{ provisioned_vpc.vpc.tags }}"

Step 3: Tag the DHCP Options Set #

Repeat the process for the DHCP options set:

- name: Propagate VPC tags to DHCP options set
  amazon.aws.ec2_tag:
    resource: "{{ provisioned_vpc.vpc.dhcp_options_id }}"
    state: present
    tags: "{{ provisioned_vpc.vpc.tags }}"

Pro Tip: Centralize Tag Definitions #

To avoid duplicating tag values, define them in a shared variable first for cleaner code:

vars:
  vpc_base_tags:
    Name: my-production-vpc
    Environment: production
    Project: my-app

tasks:
  - name: Provision custom VPC
    amazon.aws.ec2_vpc_net:
      name: "{{ vpc_base_tags.Name }}"
      cidr_block: 10.0.0.0/16
      tags: "{{ vpc_base_tags }}"
    register: provisioned_vpc

  # Tag tasks can now reference "{{ vpc_base_tags }}" directly

Method 2: AWS Tag Policies (Account-Wide Enforcement) #

If you need a broader, account-wide solution (not just per-playbook), you can set up an AWS Tag Policy via AWS Organizations. This enforces tag propagation to VPC-associated resources retroactively if they’re out of compliance, but note it won’t apply tags at creation time—it’s a cloud-side guardrail rather than an Ansible fix.

Key Notes #

• Ensure you’re using the latest version of the amazon.aws Ansible collection; old versions may have different output structures for the ec2_vpc_net module.
• If you’re using a custom DHCP options set (not the default auto-generated one), tag it explicitly when you create it in your playbook instead of using the dhcp_options_id from the VPC output.

内容的提问来源于stack exchange，提问作者David Wer