AWS托管小型DC的EC2实例审计方案咨询：Boto3还是Ansible？

Hey, great call leaning towards Ansible for this audit task—its native SSH capabilities are perfect for pulling the kind of local runtime info (OS versions, Java versions) you need from your DEV/PROD EC2 instances. Let’s break down how to make this work smoothly, plus where Boto3 can still play a helpful role:

一、Why Ansible is your best bet here #

• SSH-first approach: Ansible lets you directly log into instances and run commands locally, which is exactly what you need to grab details like java -version or OS release info that can’t be pulled via AWS APIs alone.
• Dynamic inventory magic: No need to manually maintain a list of instances. Ansible’s official aws_ec2 plugin can auto-discover your DEV/PROD instances using tags (like Environment=DEV), grouping them automatically for batch operations.
• Easy result export: You can quickly dump audit data into JSON/CSV files or even send it to a database, making post-audit analysis a breeze.

二、Step-by-step Ansible implementation #

1. Set up AWS dynamic inventory #

First, enable the aws_ec2 plugin in your ansible.cfg:

[defaults]
inventory = ./inventory.yml
[inventory]
enable_plugins = aws_ec2

Then create an inventory.yml file to filter instances by environment:

plugin: aws_ec2
regions:
  - us-east-1  # Replace with your AWS region
filters:
  tag:Environment: ["DEV", "PROD"]
keyed_groups:
  - key: tags.Environment
    prefix: env
    separator: "_"

This will auto-group your instances into env_DEV and env_PROD so you can target specific environments if needed.

2. Write the audit playbook #

Create a ec2_audit.yml playbook to collect all the data you need:

- name: Audit EC2 instances for OS and Java versions
  hosts: all
  gather_facts: true  # Auto-collects OS family/version, no extra commands needed
  tasks:
    - name: Fetch Java version
      command: java -version
      register: java_version_raw
      ignore_errors: true  # Handle instances without Java installed

    - name: Structure audit data
      set_fact:
        audit_record:
          instance_id: "{{ ansible_ec2_instance_id }}"
          environment: "{{ tags.Environment }}"
          os: "{{ ansible_distribution }} {{ ansible_distribution_version }}"
          java_version: "{{ java_version_raw.stderr_lines[0] | default('Java not installed') }}"

    - name: Save audit results locally
      copy:
        content: "{{ audit_record | to_nice_json }}"
        dest: "./audit_results/{{ ansible_ec2_instance_id }}.json"
      delegate_to: localhost

A few notes here:

• gather_facts pulls OS details automatically, saving you from writing cat /etc/os-release or similar commands.
• java -version outputs to stderr, so we grab stderr_lines[0] for the version string.
• Results are saved to a local audit_results directory, one file per instance.

3. Run the playbook #

Make sure your local machine has AWS credentials set up (via ~/.aws/credentials or environment variables), then run:

ansible-playbook -i inventory.yml ec2_audit.yml

If you need to specify an SSH key for EC2 access, add --private-key=/path/to/your/key.pem or set it in ansible.cfg.

三、Where Boto3 fits in #

While Ansible handles the on-instance audit, Boto3 can help with pre-audit setup or supplementary data collection:

• Pre-filter instances: Use Boto3 to pull instance metadata (like launch time, IAM role, or private IP) that doesn’t require SSH access, then merge it with your Ansible audit results for a fuller picture.
• Automate triggers: Write a small Boto3 script to monitor for new EC2 instances in DEV/PROD and auto-run your Ansible playbook to audit them.
• Permission checks: Verify that your audit user has the right IAM permissions to list instances and access SSH keys.

Quick Boto3 example to pull instance metadata:

import boto3

ec2 = boto3.resource('ec2', region_name='us-east-1')
target_instances = ec2.instances.filter(
    Filters=[{'Name': 'tag:Environment', 'Values': ['DEV', 'PROD']}]
)

for instance in target_instances:
    instance_name = next(tag['Value'] for tag in instance.tags if tag['Key'] == 'Name')
    print(f"Instance {instance.id} ({instance_name}) is in {instance.state['Name']} state")

四、PROD environment best practices #

• Test first: Run the playbook against DEV instances before touching PROD to catch any issues.
• Batch execution: Add serial: 10% to your playbook to audit instances in small batches, reducing impact on production workloads.
• Low-hour runs: Schedule audits during off-peak times to avoid disrupting user traffic.
• Check mode: Use ansible-playbook --check to simulate the audit without making any changes, just to verify everything works as expected.

内容的提问来源于stack exchange，提问作者felli fel