# AWS VPC inventory no public

**URL:** <https://forum.ansible.com/t/aws-vpc-inventory-no-public/20182>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [January 12, 2016, 7:37pm UTC](https://forum.ansible.com/t/aws-vpc-inventory-no-public/20182 "2016-01-12T19:37:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Colin\_Byrne](https://avatars.discourse-cdn.com/v4/letter/c/ecd19e/32.png) [@Colin\_Byrne](https://forum.ansible.com/u/Colin_Byrne)\
**Post date:** [January 12, 2016, 7:37pm UTC](https://forum.ansible.com/t/aws-vpc-inventory-no-public/20182/1 "2016-01-12T19:37:23Z")

</div>

Hey,

So I would love to get the aws ec2 inventory working, but I cant seem to find a way to connect to my instances within a VPC subnet.

I changed the ec2.ini configuration to:

`

destination\_variable = private\_dns\_name

`

so that now the command ‘ec2.py --list’ now finds the instances, but I still cant figure out a way to route the ansible ssh requests through my aliases/gateway configuration. If I just keep my aliases in my ~/.ssh/config and my hosts in the static ansible hosts file, it of course finds them ok. The servers’ names are the same as their alias in my ssh config and in the gateway forwarding, so if I could somehow modify the ec2.py script to use their ‘Name’ tag instead of their private ip, I think it would work.

Assuming there is no easy way to do this, does anyone know which script / function or line in the ec2.py I should modify to try to make it work?

Thanks for any help!

---

<div class="post-metadata">

**Author:** ![Mitch\_Anderson](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Mitch\_Anderson](https://forum.ansible.com/u/Mitch_Anderson)\
**Post date:** [January 12, 2016, 8:58pm UTC](https://forum.ansible.com/t/aws-vpc-inventory-no-public/20182/2 "2016-01-12T20:58:20Z")

</div>

​That was the reason I wrote my one AWS inventory script. Its far from complete on some of the things I would like, but I’ve been using it for a few months now.

I’d be willing to share the script and minor configs required if you’d like.

-MItch​

---

<div class="post-metadata">

**Author:** ![Ivan\_S\_Freitas](https://avatars.discourse-cdn.com/v4/letter/i/e99b99/32.png) [@Ivan\_S\_Freitas](https://forum.ansible.com/u/Ivan_S_Freitas)\
**Post date:** [January 12, 2016, 9:09pm UTC](https://forum.ansible.com/t/aws-vpc-inventory-no-public/20182/3 "2016-01-12T21:09:58Z")

</div>

This options makes the returned address of an instance to be an  
internal IP in the  
IP range of the subnet. Unless you are also running ansible from an  
instance inside  
the same subnet (or in one which can communicate with it), it won't work.

If you set this variable to 'public\_dns\_name' or 'ip\_address' it  
should enable you  
to access the instances (given that you have the SSH port unblocked in the  
instance's security group). Or you could use the SSH config's option  
'ProxyCommand' to proxy the connection through a gateway, but personally  
I think this later is not worth the effort (unless you're configuring  
a private subnet).

---

<div class="post-metadata">

**Author:** ![Colin\_Byrne](https://avatars.discourse-cdn.com/v4/letter/c/ecd19e/32.png) [@Colin\_Byrne](https://forum.ansible.com/u/Colin_Byrne)\
**Post date:** [January 12, 2016, 10:39pm UTC](https://forum.ansible.com/t/aws-vpc-inventory-no-public/20182/4 "2016-01-12T22:39:46Z")

</div>

Hey Mitch, that would be greatly appreciated! I was thinking one of the anisble pro’s would just be able to make it an option on the present ec2.ini script but I would definitely love to give yours a try. I will try to help out with any functionality…

Thanks a bunch,  
Colin