# Using ansible inside EC2 instance to gather tags

**URL:** <https://forum.ansible.com/t/using-ansible-inside-ec2-instance-to-gather-tags/26040>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [November 15, 2017, 6:29pm UTC](https://forum.ansible.com/t/using-ansible-inside-ec2-instance-to-gather-tags/26040 "2017-11-15T18:29:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Pshem\_Kowalczyk](https://avatars.discourse-cdn.com/v4/letter/p/e480ec/32.png) [@Pshem\_Kowalczyk](https://forum.ansible.com/u/Pshem_Kowalczyk)\
**Post date:** [November 15, 2017, 6:29pm UTC](https://forum.ansible.com/t/using-ansible-inside-ec2-instance-to-gather-tags/26040/1 "2017-11-15T18:29:17Z")

</div>

Hi,

We’re starting to move our setup to AWS. In order to get an EC2 instance provisioned we use ansible in ‘pull’ mode. That works fine. The one thing that seems to be a problem is getting the tags assigned to the instance.

If the playbook is ran from the ‘outside’ the inventory script supplies all the ‘ec2\_tag\_’ variables. But from the ‘inside’ of the instance, if I wanted to do that I’d have to supply the key/secret pair into the instance.

aws cli is able to get details like that if the correct IAMProfile is attached to an instance without supplying any additional credentials. Is there a way to make ansible do the same?

kind regards  
Pshem

---

<div class="post-metadata">

**Author:** ![Pshem\_Kowalczyk](https://avatars.discourse-cdn.com/v4/letter/p/e480ec/32.png) [@Pshem\_Kowalczyk](https://forum.ansible.com/u/Pshem_Kowalczyk)\
**Post date:** [November 15, 2017, 7:45pm UTC](https://forum.ansible.com/t/using-ansible-inside-ec2-instance-to-gather-tags/26040/2 "2017-11-15T19:45:13Z")

</div>

So far I came up with the following, but it does feel a bit kludgy:

- name: check if running inside AWS  
uri:  
url: [http://169.254.169.254/latest/meta-data](http://169.254.169.254/latest/meta-data)  
timeout: 2  
register: aws\_uri\_check  
failed\_when: False

- name: store result  
set\_fact:  
inside\_aws: “{{ aws\_uri\_check.status == 200 }}”

- name: install aws cli  
command: pip install awscli  
when: inside\_aws

- name: get the list of tags  
shell: REGION=$(curl -q [http://169.254.169.254/latest/meta-data/placement/availability-zone](http://169.254.169.254/latest/meta-data/placement/availability-zone)) INSTANCE=$(curl -q [http://169.254.169.254/latest/meta-data/instance-id](http://169.254.169.254/latest/meta-data/instance-id)); aws ec2 describe-tags --region ${REGION%?} --filters “Name=resource-id,Values=$INSTANCE”  
register: tag\_list  
when: inside\_aws

- name: create facts out of the tags  
set\_fact:  
“{{‘ec2\_tag\_’ + tag.Key.replace(‘:’,‘_‘).replace(’-‘,’_’) }}”: “{{ tag.Value }}”  
with\_items: “{{ (tag\_list.stdout | from\_json)[‘Tags’] }}”  
when: inside\_aws  
loop\_control:  
loop\_var: tag  
label: “{{ tag.Key }}”

- name: remove awscli tools  
command: pip uninstall -y awscli  
when: inside\_aws

kind regards  
Pshem