14

I would like to create and provision Amazon EC2 machines with a help of Ansible. Now, I get the following error:

fatal: [localhost]: FAILED! => {"changed": false, "failed": true, "msg": "Instance creation failed => InvalidKeyPair.NotFound: The key pair '~/.keys/EC2-Kibi-Enterprise-Deployment.pem' does not exist"}

But the .pem key exists:

$ ls -lh ~/.keys/EC2-Kibi-Enterprise-Deployment.pem 
-r-------- 1 sergey sergey 1.7K Apr  6 09:56 /home/sergey/.keys/EC2-Kibi-Enterprise-Deployment.pem

And it was created in EU (Ireland) region.

Here is my playbook:

--
- name: Setup servers on Amazon EC2 machines
  hosts: localhost
  gather_facts: no

  tasks:
    - include_vars: group_vars/all/ec2_vars.yml

    ### Create Amazon EC2 instances
    - name: Amazon EC2 | Create instances
      ec2:
        count: "{{ count }}"
        key_name: "{{ key }}"
        region: "{{ region }}"
        zone: "{{ zone }}"
        group: "{{ group }}"
        instance_type: "{{ machine }}"
        image: "{{ image }}"
        wait: true
        wait_timeout: 500
        #vpc_subnet_id: "{{ subnet }}" 
        #assign_public_ip: yes
      register: ec2

    - name: Amazon EC2 | Wait for SSH to come up
      wait_for:
        host: "{{ item.public_ip }}"
        port: 22
        delay: 10
        timeout: 60
        state: started
      with_items: "{{ ec2.instances }}"

    - name: Amazon EC2 | Add hosts to the kibi_servers in-memory inventory group
      add_host: hostname={{ item.public_ip }} groupname=kibi_servers
      with_items: "{{ ec2.instances }}"
    ### END

### Provision roles
- name: Amazon EC2 | Provision new instances
  hosts: kibi_servers
  become: yes
  roles:
    - common
    - java
    - elasticsearch
    - logstash
    - nginx
    - kibi
    - supervisor
### END

And my var file:

count: 2
region: eu-west-1
zone: eu-west-1a
group: default
image:  ami-d1ec01a6
machine: t2.medium
subnet: subnet-3a2aa952
key: ~/.keys/EC2-Kibi-Enterprise-Deployment.pem

What is wrong with the .pem file here?

4 Answers 4

19

The key parameter for the ec2 module is looking for the key pair name that has been already uploaded to AWS, not a local key.

If you want to get Ansible to upload a public key you can use the ec2_key module.

So your playbook would look like this:

--
- name: Setup servers on Amazon EC2 machines
  hosts: localhost
  gather_facts: no

  tasks:
    - include_vars: group_vars/all/ec2_vars.yml

    ### Create Amazon EC2 key pair
    - name: Amazon EC2 | Create Key Pair
      ec2_key:
        name: "{{ key_name }}"
        region: "{{ region }}"
        key_material: "{{ item }}"
      with_file: /path/to/public_key.id_rsa.pub

    ### Create Amazon EC2 instances
    - name: Amazon EC2 | Create instances
      ec2:
        count: "{{ count }}"
        key_name: "{{ key_name }}"
        ...
4
  • Do I need to create an SSH key pair locally and import the public key in Amazon console? Is it the key?
    – srgbnd
    Apr 6, 2016 at 10:46
  • You need to upload the public key (not the private part) to AWS. You can do that via the console or you can do it via Ansible as per the example.
    – ydaetskcoR
    Apr 6, 2016 at 11:10
  • Seems ec2_keypair module doesn't exist. But there is ec2_key module. I used it and also indicated key_name: ~/.ssh/EC2-Kibi-Enterprise in the var file. Now I have the following error: failed: [localhost] => (item=ssh-rsa AA...", "msg": "Either region or ec2_url must be specified"}.
    – srgbnd
    Apr 6, 2016 at 12:13
  • Also, I can't create an instance via ec2 cli tools: ec2-run-instances ami-d1ec01a6 -t t2.medium --region eu-west-1 --key ~/.ssh/EC2-Kibi-Enterprise Client.InvalidKeyPair.NotFound: The key pair '/home/sergey/.ssh/EC2-Kibi-Enterprise' does not exist
    – srgbnd
    Apr 6, 2016 at 12:14
4

Do not specify extension for the key. So that key name should be " EC2-Kibi-Enterprise-Deployment " only. Ansible doesn't care if your key is on your local machine at this stage. It verifies if it exists on your AWS account. Go to 'EC2 > Key Pairs' section in your AWS account and you'll see keys are listed without file extensions.

2

The solution has been found. EC2 doesn't like when you put a full path for the .pem key file.

So, I moved EC2-Kibi-Enterprise-Deployment.pem into ~/.ssh, added it to the authentication agent with ssh-add using:

ssh-add ~/.ssh/EC2-Kibi-Enterprise-Deployment.pem

And corrected the key line in my var file to
key: EC2-Kibi-Enterprise-Deployment.pem

The same if you use EC2 cli tools, don't specify a full path to the key file.
ec2-run-instances ami-d1ec01a6 -t t2.medium --region eu-west-1 --key EC2-Kibi-Enterprise-Deployment.pem

1
  • I have to change key from: ~/.keys/EC2-Kibi-Enterprise-Deployment.pem to key: ~/.keys/EC2-Kibi-Enterprise-Deployment Dec 4, 2017 at 10:51
0

While providing Key in variable don't give file extension (.pem). Just give file name. For example: akshay.pem is my key then in vars filoe just provide akshay as key.

1
  • 1
    Could you give some link to documentation to arg our answer?
    – YLR
    Apr 13, 2021 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.