# Playbook can't connect to EC2 instance, but SSH works fine?

**URL:** <https://forum.ansible.com/t/playbook-cant-connect-to-ec2-instance-but-ssh-works-fine/22876>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [October 25, 2016, 2:58am UTC](https://forum.ansible.com/t/playbook-cant-connect-to-ec2-instance-but-ssh-works-fine/22876 "2016-10-25T02:58:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Eric\_Campusano](https://avatars.discourse-cdn.com/v4/letter/e/ee7513/32.png) [@Eric\_Campusano](https://forum.ansible.com/u/Eric_Campusano)\
**Post date:** [October 25, 2016, 2:58am UTC](https://forum.ansible.com/t/playbook-cant-connect-to-ec2-instance-but-ssh-works-fine/22876/1 "2016-10-25T02:58:00Z")

</div>

New to Ansible but I’m really enjoying working with it so far. I’ve started writing a playbook that creates an EC2 instance and then attempts to connect to it and configure it. For some reason it’s failing to connect, even though it appears to be using the correct key and attempting to connect as the correct user. It’s also using the correct hostname. I turned verbose output on and I still don’t see what the issue is. Can anyone suggest what the issue might be?

I provisioned an EC2 instance and now I want to connect to it:

Here’s my play:

# Configure instances

- include: configure-ireland.yml #This just installs a single package, httpd, nothing fancy  
vars:  
ansible\_ssh\_user: ec2-user  
ansible\_ssh\_private\_key\_file: keys/eric\_eu\_west\_1.pem

Here’s the output of ansible-playbook -vvvvv myplay.yml when it fails to connect to my instance via ssh:

TASK [setup] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> ESTABLISH SSH CONNECTION FOR USER: ec2-user  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> ESTABLISH SSH CONNECTION FOR USER: ec2-user  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: ansible.cfg set ssh\_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> ESTABLISH SSH CONNECTION FOR USER: ec2-user  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_PRIVATE\_KEY\_FILE/private\_key\_file/ansible\_ssh\_private\_key\_file set: (-o)(IdentityFile=“keys/eric\_eu\_west\_1.p  
em”)  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: ansible\_password/ansible\_ssh\_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssapi  
-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no)  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=ec2-user)  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: PlayContext set ssh\_common\_args: ()  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: ansible.cfg set ssh\_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_PRIVATE\_KEY\_FILE/private\_key\_file/ansible\_ssh\_private\_key\_file set: (-o)(IdentityFile=“keys/eric\_eu\_west\_1.$  
em”)  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: ansible.cfg set ssh\_args: (-o)(ControlMaster=auto)(-o)(ControlPersist=60s)  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: ansible\_password/ansible\_ssh\_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssap$  
-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no)  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_PRIVATE\_KEY\_FILE/private\_key\_file/ansible\_ssh\_private\_key\_file set: (-o)(IdentityFile=“keys/eric\_eu\_west\_1.$  
em”)  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=ec2-user)  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: ansible\_password/ansible\_ssh\_pass not set: (-o)(KbdInteractiveAuthentication=no)(-o)(PreferredAuthentications=gssap$  
-with-mic,gssapi-keyex,hostbased,publickey)(-o)(PasswordAuthentication=no)  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_REMOTE\_USER/remote\_user/ansible\_user/user/-u set: (-o)(User=ec2-user)  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: ANSIBLE\_TIMEOUT/timeout set: (-o)(ConnectTimeout=10)  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: PlayContext set ssh\_common\_args: ()  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: PlayContext set ssh\_common\_args: ()  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: PlayContext set ssh\_extra\_args: ()  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: PlayContext set ssh\_extra\_args: ()  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/campee/.ansible/cp/ansible-ssh-%h-%p-%r)  
\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/campee/.ansible/cp/ansible-ssh-%h-%p-%r)  
\<[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)\> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o ‘IdentityFile=“keys/eric\_eu\_west\_1.pem”’ -o KbdInte$  
activeAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 -o C$  
ntrolPath=/home/campee/.ansible/cp/ansible-ssh-%h-%p-%r [ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com) ‘/bin/sh -c ‘"’"’( umask 77 && mkdir -p “`echo $HOME/.ansible/tmp$ ansible-tmp-1477363326.38-254627066289692`” && echo ansible-tmp-1477363326.38-254627066289692=“`echo $HOME/.ansible/tmp/ansible-tmp-1477363326.38-254627066289692`” ) && $sleep 0’“'”‘’

\<[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)\> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o ‘IdentityFile=“keys/eric\_eu\_west\_1.pem”’ -o KbdInte$  
activeAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 -o C$  
ntrolPath=/home/campee/.ansible/cp/ansible-ssh-%h-%p-%r [ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com) ‘/bin/sh -c ‘"’"’( umask 77 && mkdir -p “`echo $HOME/.ansible/tmp$ ansible-tmp-1477363326.38-141287772563957`” && echo ansible-tmp-1477363326.38-141287772563957=“`echo $HOME/.ansible/tmp/ansible-tmp-1477363326.38-141287772563957`” ) && s  
leep 0’“'”‘’  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: PlayContext set ssh\_extra\_args: ()  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: found only ControlPersist; added ControlPath: (-o)(ControlPath=/home/campee/.ansible/cp/ansible-ssh-%h-%p-%r)  
\<[ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com)\> SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o ‘IdentityFile=“keys/eric\_eu\_west\_1.pem”’ -o KbdInter  
activeAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 -o Co  
ntrolPath=/home/campee/.ansible/cp/ansible-ssh-%h-%p-%r [ec2-54-194-134-79.eu-west-1.compute.amazonaws.com](http://ec2-54-194-134-79.eu-west-1.compute.amazonaws.com) ‘/bin/sh -c ‘"’"’( umask 77 && mkdir -p “`echo $HOME/.ansible/tmp/ ansible-tmp-1477363326.38-145537136827503`” && echo ansible-tmp-1477363326.38-145537136827503=“`echo $HOME/.ansible/tmp/ansible-tmp-1477363326.38-145537136827503`” ) && s  
leep 0’“'”‘’  
fatal: [[ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com)]: UNREACHABLE! =\> {“changed”: false, “msg”: “Failed to connect to the host via ssh.”, “unreachable”: true}

But if I run SSH manually, it works just fine:

$ ssh -i keys/eric\_eu\_west\_1.pem [ec2-user@ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](mailto:ec2-user@ec2-54-171-76-221.eu-west-1.compute.amazonaws.com)  
Warning: Permanently added ‘[ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com),54.171.76.221’ (ECDSA) to the list of known hosts.

\_\_| _| )  
 | ( / Amazon Linux AMI  
 **|\_** |_|

> **[Amazon Linux AMI](https://aws.amazon.com/amazon-linux-ami/)**

3 package(s) needed for security, out of 10 available  
Run “sudo yum update” to apply all updates.

My key is chmod 0700:

$ ls -l keys/eric\_eu\_west\_1.pem  
-rwx------ 1 campee campee 1696 Oct 23 21:30 keys/eric\_eu\_west\_1.pem

---

<div class="post-metadata">

**Author:** ![Jinesh\_Choksi](https://avatars.discourse-cdn.com/v4/letter/j/a6a055/32.png) [@Jinesh\_Choksi](https://forum.ansible.com/u/Jinesh_Choksi)\
**Post date:** [October 27, 2016, 7:58am UTC](https://forum.ansible.com/t/playbook-cant-connect-to-ec2-instance-but-ssh-works-fine/22876/2 "2016-10-27T07:58:20Z")

</div>

Hi

1. Ansible is failing to connect to: [ec2-54-194-77-121.eu-west-1.compute.amazonaws.com](http://ec2-54-194-77-121.eu-west-1.compute.amazonaws.com/)
2. Your manual SSH test is against a different host: [ec2-54-171-76-221.eu-west-1.compute.amazonaws.com](http://ec2-54-171-76-221.eu-west-1.compute.amazonaws.com/)

54.194.77.121  
vs  
54.171.76.221

Was this a typo?

The “unreachable” part means Ansible couldn’t make a network connection to the 54.194.77.121 host. So try a telnet test (telnet 54.194.77.121 22) to see if SSHD is listening on the port.

Regards,  
Jinesh