# {'msg': 'FAILED: not a valid DSA private key file', 'failed': True} when configuring newly created EC2 instances

**URL:** <https://forum.ansible.com/t/msg-failed-not-a-valid-dsa-private-key-file-failed-true-when-configuring-newly-created-ec2-instances/13755>\
**Category:** Ansible Project\
**Created:** [October 23, 2013, 8:36pm UTC](https://forum.ansible.com/t/msg-failed-not-a-valid-dsa-private-key-file-failed-true-when-configuring-newly-created-ec2-instances/13755 "2013-10-23T20:36:15Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Teg\_Ryan](https://avatars.discourse-cdn.com/v4/letter/t/9dc877/32.png) [@Teg\_Ryan](https://forum.ansible.com/u/Teg_Ryan)\
**Post date:** [October 23, 2013, 8:36pm UTC](https://forum.ansible.com/t/msg-failed-not-a-valid-dsa-private-key-file-failed-true-when-configuring-newly-created-ec2-instances/13755/1 "2013-10-23T20:36:15Z")

</div>

When I provision a new EC2 instance and then try to connect using the IP or DNS name, I get the error message above.

When I call the same configuration play using the DNS name in the inventory file it works fine.

More details:

When I call a playbook using:  
ansible-playbook -i provision provision.yml -e “dc=eu-ireland”

it creates an instance, waits for SSH to come up, but then fails on the config play with:  
fatal: [ec2-.eu-west-1.compute.amazonaws.com] =\> {‘msg’: ‘FAILED: not a valid DSA private key file’, ‘failed’: True}

but when I add “ec2-.eu-west-1.compute.amazonaws.com” to the webservers (inventory file) and run:  
ansible-playbook -i webservers webservers.yml

it connects and runs fine.

provision.yml:  
[http://pastebin.com/9u4FUtXJ](http://pastebin.com/9u4FUtXJ)

webservers.yml:  
[http://pastebin.com/k9mCu587](http://pastebin.com/k9mCu587)

ansible.cgf:  
[http://pastebin.com/NzF2Lc1Y](http://pastebin.com/NzF2Lc1Y)

OS: CentOS 6.4 on both config and remote machines.

If there is anything else that would help, please let me know.

---

<div class="post-metadata">

**Author:** ![Teg\_Ryan](https://avatars.discourse-cdn.com/v4/letter/t/9dc877/32.png) [@Teg\_Ryan](https://forum.ansible.com/u/Teg_Ryan)\
**Post date:** [October 23, 2013, 9:25pm UTC](https://forum.ansible.com/t/msg-failed-not-a-valid-dsa-private-key-file-failed-true-when-configuring-newly-created-ec2-instances/13755/2 "2013-10-23T21:25:45Z")

</div>

I changed the task where I was adding the EC2 instance to the host group to this instead:

- name: Add hosts to webserver inventory file  
lineinfile: dest=/home/ec2-user/ansible/webservers regexp={{ item.public\_dns\_name }} line={{ item.public\_dns\_name }} state=present  
with\_items: ec2.instances

And everything works fine. I think there might be a bug with running plays against a host group created dynamically from EC2 instances.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [October 24, 2013, 3:28am UTC](https://forum.ansible.com/t/msg-failed-not-a-valid-dsa-private-key-file-failed-true-when-configuring-newly-created-ec2-instances/13755/3 "2013-10-24T03:28:00Z")

</div>

There’s no difference from where the system comes in this case, whether in inventory or static, FWIW.

I strongly recommend not editing the inventory file via Ansible and using the dynamic source.

Sounds like you need to set the pem file via the right parameter (–help) and might need to be calling something via local\_action but I haven’t seen the whole playbook so hard to say for sure.

---

<div class="post-metadata">

**Author:** ![Teg\_Ryan](https://avatars.discourse-cdn.com/v4/letter/t/9dc877/32.png) [@Teg\_Ryan](https://forum.ansible.com/u/Teg_Ryan)\
**Post date:** [October 24, 2013, 5:20pm UTC](https://forum.ansible.com/t/msg-failed-not-a-valid-dsa-private-key-file-failed-true-when-configuring-newly-created-ec2-instances/13755/4 "2013-10-24T17:20:16Z")

</div>

Thanks for the input Michael. I’m not sure where the issue is, but when I call both playbooks with --private-key=/path/to/key the provisioning one fails, and the configure one works. The same is true when I set the pem file via ansible.cfg.

The part that confuses me is that the host is correct in the -vvvv output - ie I see the SSH command going to the correct hostname, so I don’t really understand why the host group wouldn’t work but when I pull it from an inventory file it would.

I set up a blank-slate config management server, installed ansible from scratch and it exhibited the same behaviour.

This is the whole playbook: [http://pastebin.com/9u4FUtXJ](http://pastebin.com/9u4FUtXJ)  
common is empty, and webtier has any command you want that works in it, right now it’s just:

nano roles/webtier/tasks/main.yml