Amazon web services Ansible和AWS子网

我对Ansible Core/Tower的工作比较陌生，我完全不知道是什么导致了以下问题。在过去的两天里，我一直在阅读我能找到的关于这个话题的所有东西，但我仍然在寻找帮助

以下是我目前的设置（以及创建全新VPC的其他Ansible剧本、角色和任务）

下面是我用来创建一组新子网的任务，每个可用性区域一个子网，并从创建的子网中获取结果。通过AWS控制台验证，这些任务都可以完美地工作

### Create the Internet-facing DMZ subnets ###
- name: Create Subnet(s) in VPC - DMZ
  ec2_vpc_subnet:
    state: present
    vpc_id: "{{ new_vpc_info['vpcs'][0]['id'] }}"
    region: "{{ vpc_region }}"
    az: "{{ item.az }}"
    cidr: "{{ item.subnet }}"
    resource_tags:
       Name: "{{ item.name }}"
       Role: "{{ role_tag }}"
       Team: "{{ team_tag }}"
       Product Area: "{{ product_area_tag }}"
       Portfolio: "{{ portfolio_tag }}"
  with_items: "{{ dmz_subnet_az }}"

- name: Get Sunbet Info - DMZ
  ec2_vpc_subnet_facts:
    region: "{{ vpc_region }}"
    filters:
      "tag:Name": "{{ item.name }}"
  with_items: "{{ dmz_subnet_az }}"
  register: new_dmz_subnets

- debug:
    var=new_dmz_subnets

{
    "changed": false,
    "_ansible_verbose_always": true,
    "new_dmz_subnets": {
        "msg": "All items completed",
        "changed": false,
        "results": [
            {
                "_ansible_parsed": true,
                "subnets": [
                    {
                        "tags": {
                            "Product Area": "Engineering Tools",
                            "Portfolio": "Shared Platform and Operations",
                            "Role": "splunk-proof-of-concept",
                            "Name": "DMZ_Subnet_A",
                            "Team": "Engineering Tools"
                        },
                        "subnet_id": "subnet-XXXX",
                        "assign_ipv6_address_on_creation": false,
                        "default_for_az": false,
                        "state": "available",
                        "ipv6_cidr_block_association_set": [],
                        "availability_zone": "us-east-1a",
                        "vpc_id": "vpc-XXXX",
                        "cidr_block": "x.x.x.x/24",
                        "available_ip_address_count": 251,
                        "id": "subnet-XXXX",
                        "map_public_ip_on_launch": false
                    }
                ],
                "changed": false,
                "_ansible_item_label": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1a",
                    "name": "DMZ_Subnet_A"
                },
                "item": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1a",
                    "name": "DMZ_Subnet_A"
                },
                "_ansible_item_result": true,
                "failed": false,
                "invocation": {
                    "module_args": {
                        "profile": null,
                        "aws_secret_key": null,
                        "aws_access_key": null,
                        "security_token": null,
                        "region": "us-east-1",
                        "filters": {
                            "tag:Name": "DMZ_Subnet_A"
                        },
                        "ec2_url": null,
                        "subnet_ids": [],
                        "validate_certs": true
                    }
                },
                "_ansible_ignore_errors": null,
                "_ansible_no_log": false
            },
            {
                "_ansible_parsed": true,
                "subnets": [
                    {
                        "tags": {
                            "Product Area": "Engineering Tools",
                            "Portfolio": "Shared Platform and Operations",
                            "Role": "splunk-proof-of-concept",
                            "Name": "DMZ_Subnet_B",
                            "Team": "Engineering Tools"
                        },
                        "subnet_id": "subnet-XXXX",
                        "assign_ipv6_address_on_creation": false,
                        "default_for_az": false,
                        "state": "available",
                        "ipv6_cidr_block_association_set": [],
                        "availability_zone": "us-east-1b",
                        "vpc_id": "vpc-XXXX",
                        "cidr_block": "x.x.x.x/24",
                        "available_ip_address_count": 251,
                        "id": "subnet-XXXX",
                        "map_public_ip_on_launch": false
                    }
                ],
                "changed": false,
                "_ansible_item_label": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1b",
                    "name": "DMZ_Subnet_B"
                },
                "item": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1b",
                    "name": "DMZ_Subnet_B"
                },
                "_ansible_item_result": true,
                "failed": false,
                "invocation": {
                    "module_args": {
                        "profile": null,
                        "aws_secret_key": null,
                        "aws_access_key": null,
                        "security_token": null,
                        "region": "us-east-1",
                        "filters": {
                            "tag:Name": "DMZ_Subnet_B"
                        },
                        "ec2_url": null,
                        "subnet_ids": [],
                        "validate_certs": true
                    }
                },
                "_ansible_ignore_errors": null,
                "_ansible_no_log": false
            },

......

            }
        ]
    },
    "_ansible_no_log": false
}

下面提供了“debug”命令的输出，它被截断以删除其余的子网，并进行了编辑，这样我就不会被吼叫，这与AWS控制台中的内容相匹配

### Create the Internet-facing DMZ subnets ###
- name: Create Subnet(s) in VPC - DMZ
  ec2_vpc_subnet:
    state: present
    vpc_id: "{{ new_vpc_info['vpcs'][0]['id'] }}"
    region: "{{ vpc_region }}"
    az: "{{ item.az }}"
    cidr: "{{ item.subnet }}"
    resource_tags:
       Name: "{{ item.name }}"
       Role: "{{ role_tag }}"
       Team: "{{ team_tag }}"
       Product Area: "{{ product_area_tag }}"
       Portfolio: "{{ portfolio_tag }}"
  with_items: "{{ dmz_subnet_az }}"

- name: Get Sunbet Info - DMZ
  ec2_vpc_subnet_facts:
    region: "{{ vpc_region }}"
    filters:
      "tag:Name": "{{ item.name }}"
  with_items: "{{ dmz_subnet_az }}"
  register: new_dmz_subnets

- debug:
    var=new_dmz_subnets

{
    "changed": false,
    "_ansible_verbose_always": true,
    "new_dmz_subnets": {
        "msg": "All items completed",
        "changed": false,
        "results": [
            {
                "_ansible_parsed": true,
                "subnets": [
                    {
                        "tags": {
                            "Product Area": "Engineering Tools",
                            "Portfolio": "Shared Platform and Operations",
                            "Role": "splunk-proof-of-concept",
                            "Name": "DMZ_Subnet_A",
                            "Team": "Engineering Tools"
                        },
                        "subnet_id": "subnet-XXXX",
                        "assign_ipv6_address_on_creation": false,
                        "default_for_az": false,
                        "state": "available",
                        "ipv6_cidr_block_association_set": [],
                        "availability_zone": "us-east-1a",
                        "vpc_id": "vpc-XXXX",
                        "cidr_block": "x.x.x.x/24",
                        "available_ip_address_count": 251,
                        "id": "subnet-XXXX",
                        "map_public_ip_on_launch": false
                    }
                ],
                "changed": false,
                "_ansible_item_label": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1a",
                    "name": "DMZ_Subnet_A"
                },
                "item": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1a",
                    "name": "DMZ_Subnet_A"
                },
                "_ansible_item_result": true,
                "failed": false,
                "invocation": {
                    "module_args": {
                        "profile": null,
                        "aws_secret_key": null,
                        "aws_access_key": null,
                        "security_token": null,
                        "region": "us-east-1",
                        "filters": {
                            "tag:Name": "DMZ_Subnet_A"
                        },
                        "ec2_url": null,
                        "subnet_ids": [],
                        "validate_certs": true
                    }
                },
                "_ansible_ignore_errors": null,
                "_ansible_no_log": false
            },
            {
                "_ansible_parsed": true,
                "subnets": [
                    {
                        "tags": {
                            "Product Area": "Engineering Tools",
                            "Portfolio": "Shared Platform and Operations",
                            "Role": "splunk-proof-of-concept",
                            "Name": "DMZ_Subnet_B",
                            "Team": "Engineering Tools"
                        },
                        "subnet_id": "subnet-XXXX",
                        "assign_ipv6_address_on_creation": false,
                        "default_for_az": false,
                        "state": "available",
                        "ipv6_cidr_block_association_set": [],
                        "availability_zone": "us-east-1b",
                        "vpc_id": "vpc-XXXX",
                        "cidr_block": "x.x.x.x/24",
                        "available_ip_address_count": 251,
                        "id": "subnet-XXXX",
                        "map_public_ip_on_launch": false
                    }
                ],
                "changed": false,
                "_ansible_item_label": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1b",
                    "name": "DMZ_Subnet_B"
                },
                "item": {
                    "subnet": "x.x.x.x/24",
                    "az": "us-east-1b",
                    "name": "DMZ_Subnet_B"
                },
                "_ansible_item_result": true,
                "failed": false,
                "invocation": {
                    "module_args": {
                        "profile": null,
                        "aws_secret_key": null,
                        "aws_access_key": null,
                        "security_token": null,
                        "region": "us-east-1",
                        "filters": {
                            "tag:Name": "DMZ_Subnet_B"
                        },
                        "ec2_url": null,
                        "subnet_ids": [],
                        "validate_certs": true
                    }
                },
                "_ansible_ignore_errors": null,
                "_ansible_no_log": false
            },

......

            }
        ]
    },
    "_ansible_no_log": false
}

现在，关于我在工作中遇到的问题，下面是我最近的一次尝试，这可能完全是在左栏，因为我尝试了我发现的一切来让它工作。我试图从注册的“new_dmz_subnets”变量中获取“subnet_id”列表，然后将其与vars文件中设置的“name”连接，最后使用该信息在每个子网内创建NAT网关

### Create the NAT Gateway in VPC ###
- name: Set DMZ Subnet facts
  set_fact:
    subnet_id_items:
      subnet_id: '{{ item.subnets | map(attribute="subnet_id") | list }}'
  with_items: "{{ new_dmz_subnets }}"
  register: subnet_id_list

- name: Set Name and DMZ Subnet loop facts
  set_fact:
    name_subnet_items:
      name: "{{ nat_gateway.name }}"
      subnet_id: "{{ item.subnet_id }}"
  loop: "{{ subnet_id_list }}"
  register: name_subnet_list

- debug:
    var=name_subnet_list

- name: Create NAT Gateway, allocate new EIP, in VPC
  ec2_vpc_nat_gateway:
    state: present
    subnet_id: "{{ item.subnet_id }}"
    region: "{{ vpc_region }}"
    wait: yes
    if_exist_do_not_create: true
    tags:
      Name: "{{ item.name }}"
      Role: "{{ role_tag }}"
      Team: "{{ team_tag }}"
      Product Area: "{{ product_area_tag }}"
      Portfolio: "{{ portfolio_tag }}"
  with_items: "{{ name_subnet_list }}"
  register: new_nat_gateway

- debug:
    var=new_nat_gateway

当我运行这个安装程序时，我得到了下面的致命错误消息，这在我尝试的每个变体中几乎是相同的

12:55:15
fatal: [localhost]: FAILED! => {
    "msg": "The task includes an option with an undefined variable. The error was: 'ansible.utils.unsafe_proxy.AnsibleUnsafeText object' has no attribute 'subnets'\n\nThe error appears to have been in '/var/lib/awx/projects/_6__erik_andresen_git/ansible/splunk_poc_playbook/roles/create_networking_role/tasks/create_gateways_task.yml': line 21, column 3, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n### Starting working on this Task ###\n- name: Set DMZ Subnet facts\n  ^ here\n"
} 

请让我知道我是否可以提供任何额外的细节，并提前感谢您的帮助

---

--Erik

我遇到了一个实际可行的设置！这可能不是最好的方法，我仍然愿意接受建议，但至少是有效的

以下是“ec2_vpc_子网”模块的代码，并收集子网ID以供以后在剧本中使用

### Create the Internet-facing DMZ subnets ###
- name: Create Subnet(s) in VPC - DMZ
  ec2_vpc_subnet:
    state: present
    vpc_id: "{{ vpc_id }}"
    region: "{{ vpc_region }}"
    az: "{{ item.az }}"
    cidr: "{{ item.subnet }}"
    resource_tags:
       Name: "{{ item.name }}"
       Role: "{{ role_tag }}"
       Team: "{{ team_tag }}"
       Product Area: "{{ product_area_tag }}"
       Portfolio: "{{ portfolio_tag }}"
       Created By: "{{ created_by }}"
  with_items: "{{ dmz_subnet_az }}"
  register: new_dmz_subnets

- name: Set facts for Subnet - DMZ
  set_fact:
    subnet_dmz_id: "{{ subnet_dmz_id | default({}) | combine({ item.subnet.tags.Name: item.subnet.id }) }}"
  loop: "{{ new_dmz_subnets.results }}"

- debug:
    var=subnet_dmz_id

下面是使用“ec2_vpc_nat_网关”模块中的子网ID在每个可用区域内创建nat网关

### Create the NAT Gateway in VPC ###
- name: Create NAT Gateway, allocate new EIP, in VPC
  ec2_vpc_nat_gateway:
    state: present
    # NAT Gateways being deployed in DMZ subnets
    subnet_id: "{{ subnet_dmz_id[item.subnet_name] }}"
    region: "{{ vpc_region }}"
    wait: yes
    if_exist_do_not_create: true
    # Tags not supported in the "ec2_vpc_nat_gateway" module
    # https://github.com/ansible/ansible/issues/44339
    #tags:
    #  Name: "{{ item.name }}"
    #  Role: "{{ role_tag }}"
    #  Team: "{{ team_tag }}"
    #  Product Area: "{{ product_area_tag }}"
    #  Portfolio: "{{ portfolio_tag }}"
    #  Created By: "{{ created_by }}"
  with_items: "{{ nat_gateway }}"
  register: new_nat_gateway

- debug:
    var=new_nat_gateway