# Calling ec2 from ec2\_vpc **URL:** \ **Category:** Ansible Developer\ **Tags:** aws\ **Created:** [January 29, 2014, 3:52pm UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453 "2014-01-29T15:52:24Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Scott\_Anderson](https://avatars.discourse-cdn.com/v4/letter/s/ed655f/32.png) [@Scott\_Anderson](https://forum.ansible.com/u/Scott_Anderson)\ **Post date:** [January 29, 2014, 3:52pm UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/1 "2014-01-29T15:52:24Z")
All, I’m starting a fairly heavy Ansible + AWS project and wanted to bounce some approaches around before embarking on a heavy feature implementation. So far I’ve written an ec2\_rds\_paramgroup module that allows maintenance of database parameter groups. I’ll be submitting this for core when I get some time to clean it up and after I’ve used it a bit to make sure there aren’t extant use cases I missed. I was starting on the VPC infrastructure for the site I’m working on and discovered a chicken and egg problem with ec2\_vpc: if I want to create a VPC with private and public subnets using a NAT instance for external communication, I have to do the following if I want to use ec2\_vpc and not hack in something with the vpc CLI: 1. Create the VPC with the subnets, leaving off all references in the route tables to the currently non-existing NAT instance. 2. Create the NAT instance using the ec2 module in a new task 3. Re-configure the VPC with the subnets, now including references to the NAT instance as the 0.0.0.0 gateway in the route tables of the private subnets that need Internet access. Very not DRY if I use ec2\_vpc as I have to respecify everything in step 1. The reason for this being that it’s not possible to create a NAT instance in a non-existent VPC with non-existent subnets for use in that VPC. 🙂 So I’m considering a modification to the ec2\_vpc module to allow specifying a NAT instance as part of a subnet, creating the instance in the subnet creation code and referencing it in the route tables later on; this would be similar to the use of the private/public VPC Wizard in the AWS console. Since I can’t (that I know of) call one module from another, I’ll need to move the ec2 instance creation code to module\_utils/ec2.py and call it there. Any pitfalls/comments/Scott-you-idiot-there’s-a-better-way? Thanks, -scott ---
**Author:** ![Alexander\_Popov](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Alexander\_Popov](https://forum.ansible.com/u/Alexander_Popov)\ **Post date:** [February 20, 2014, 10:18pm UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/2 "2014-02-20T22:18:02Z")
I’m in a similar situation and my approach was to create a ElasticNetworkInterface first and reference it as the 0.0.0.0/0 gateway for the private subnet when creating the VPC and the routing. Then create NAT instance in the private subnet and attach it to the ENI created earlier. Obviously, ec2 and ec2\_vpc modules will have to be modified and a new ec2\_eni module is needed but it I think the result would be more elegant than configuring VPC twice. -Alex ---
**Author:** ![Alexander\_Popov](https://avatars.discourse-cdn.com/v4/letter/a/a88e57/32.png) [@Alexander\_Popov](https://forum.ansible.com/u/Alexander_Popov)\ **Post date:** [February 20, 2014, 11:04pm UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/3 "2014-02-20T23:04:34Z")
It seems boto.ec2.networkinterface.NetworkInterfaceSpecification requires a subnet\_id… so, it’s back to sq1. ---
**Author:** ![Gary\_Morse](https://avatars.discourse-cdn.com/v4/letter/g/85f322/32.png) [@Gary\_Morse](https://forum.ansible.com/u/Gary_Morse)\ **Post date:** [March 24, 2015, 8:12pm UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/4 "2015-03-24T20:12:39Z")
I’m in the same boat here. Anyone come up with a solution? ---
**Author:** ![Gerard\_Lynch](https://avatars.discourse-cdn.com/v4/letter/g/958977/32.png) [@Gerard\_Lynch](https://forum.ansible.com/u/Gerard_Lynch)\ **Post date:** [March 28, 2015, 8:22pm UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/5 "2015-03-28T20:22:17Z")
Maybe an action\_plugin, that calls the ec2\_vpc and ec2 modules. Although it would still probably need to do the 3 steps, create VPC, create VM, update VPC. Although I do not know whether it’s considered ‘good practise’ to have an action\_plugin call multiple modules. ---
**Author:** ![Chris\_Grigor](https://avatars.discourse-cdn.com/v4/letter/c/34f0e0/32.png) [@Chris\_Grigor](https://forum.ansible.com/u/Chris_Grigor)\ **Post date:** [July 20, 2015, 8:02am UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/6 "2015-07-20T08:02:52Z")
Hi all, I’m facing a similar situation. I’m creating a vpc with public route tables, then I’m creating an auto scaling group to bring up my NAT boxes. However I need to add the routes from the private networks to the NAT boxes. I followed Scotts suggestion above, whilst this works the first time you run the playbook and it adds the routes, if you were to add an additional NAT box for redundancy you would need to rerun the ec2\_vpc stepo again, at this point your private route from the previous step has been added and you get a dependency violation. “msg”: “Unable to delete old route table rtb-28b8d64d, error: EC2ResponseError: 400 Bad Request\n\\n`DependencyViolation`The routeTable ‘rtb-28b8d64d’ has dependencies and cannot be deleted.8b33537f-522c-466b-9c3a-68f95f474c82” The other option is to update the routes via a launch configuration but to do this you require the routes to exist first - so kind of a catch 22 situation. Anyone get this working yet? thanks in advance Chris ---
**Author:** ![igorc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/igorc/32/5491_2.png) [@igorc](https://forum.ansible.com/u/igorc)\ **Post date:** [July 22, 2015, 8:56am UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/7 "2015-07-22T08:56:36Z")
How about adding separate NAT instance in the ASG per zone and making it default gw for the private subnets of that zone only? Each NAT instance will be created with instance role that will make it possible to query the ec2 service and find the private subnets in it's own AZ and create the routing table. The private subnets can be also tagged upon creation for easier discovery. ---
**Author:** ![Chris\_Grigor](https://avatars.discourse-cdn.com/v4/letter/c/34f0e0/32.png) [@Chris\_Grigor](https://forum.ansible.com/u/Chris_Grigor)\ **Post date:** [July 22, 2015, 9:32am UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/8 "2015-07-22T09:32:38Z")
Hi Igor, I’m creating a nat instance per asg per zone already. I’ve found a way to update the routes separately from the ec2\_vpc, there is a pull request pending for this on github. The task is called ec2\_vpc\_route\_table.py Thanks for the help! ---
**Author:** ![Jonathan\_Davila](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jonathan\_Davila](https://forum.ansible.com/u/Jonathan_Davila)\ **Post date:** [July 23, 2015, 12:55am UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/9 "2015-07-23T00:55:11Z")
Hello, there are new vpc related modules in the queue or in the devel branch already. vpc was split into ec2\_vpc\_net =\> creates vpcs, dhcp options, etc ec2\_vpc\_route\_table =\> makes route tables ec2\_vpc\_igw =\> igws ec2\_vpc\_subnets It would be super valuable if you guys could see if the problem is solvable with this breakout. Also, there is a pull request I’ve made for boto3 connection support in module\_utils/ec2.py which could help for any future AWS related modules. ---
**Author:** ![Chris\_Grigor](https://avatars.discourse-cdn.com/v4/letter/c/34f0e0/32.png) [@Chris\_Grigor](https://forum.ansible.com/u/Chris_Grigor)\ **Post date:** [July 23, 2015, 7:06am UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/10 "2015-07-23T07:06:42Z")
Hi Jonathan, I can confirm that by using ec2\_vpc\_route\_table I’m able to update the routes to the private ip of the NAT instance created from my auto scaling group. However the playbook can only be run once, on subsequent runs it fails with the same error I initially posted ‘Unable to delete the old route table…’ constraint violation etc etc. If you’d like a copy of the playbook to test with I’m happy to share it with you. Cheers, Chris ---
**Author:** ![Jonathan\_Davila](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jonathan\_Davila](https://forum.ansible.com/u/Jonathan_Davila)\ **Post date:** [July 23, 2015, 12:27pm UTC](https://forum.ansible.com/t/calling-ec2-from-ec2-vpc/14453/11 "2015-07-23T12:27:49Z")
Yes that would be very helpful if you don’t mind, depending on how quickly you’re able to provide the playbook I could probably submit a patch today.