AnsibleByExample

Amazon.aws 11.4.0 Released - aws_ssm Connection Plugin Overhaul and RDS Active Directory Support

Beginner
2024-01-013By Luca Berton

Lesson 1 of 25 in AWS Automation

AWS with Ansible — full curriculum
  1. 1. AWS Basics for Ansible
  2. 2. Installing the amazon.aws Collection and boto3
  3. 3. AWS Credentials and Profiles: Safe Configuration
  4. 4. Your First AWS Playbook: Regions, Tags and Idempotency
  5. 5. AWS Dynamic Inventory with the aws_ec2 Plugin
  6. 6. Grouping and Filtering Hosts with keyed_groups and Filters
  7. 7. Provisioning EC2 Instances
  8. 8. AMIs and Launch Templates
  9. 9. Building VPC Networks with Ansible
  10. 10. Security Groups and Network Access Control
  11. 11. Elastic IPs and Load Balancers
  12. 12. S3 Buckets and Object Management
  13. 13. IAM Users, Roles and Policies
  14. 14. RDS Databases with Ansible
  15. 15. Route 53 DNS Automation
  16. 16. CloudWatch Monitoring and Alarms
  17. 17. Managing Secrets: Secrets Manager, SSM Parameter Store and Ansible Vault
  18. 18. Post-Provisioning Configuration with Roles
  19. 19. Bridging Provisioning and Configuration: add_host and wait_for
  20. 20. Auto Scaling Groups and Rolling Updates
  21. 21. Validating Infrastructure with Assertions and Health Checks
  22. 22. Error Handling and Rollback in AWS Playbooks
  23. 23. Structuring a Reusable AWS Automation Project
  24. 24. Cost Control and Teardown Playbooks
  25. 25. Capstone: Provision and Configure a Multi-Tier AWS Application
View path overview →

Introduction

The amazon.aws collection provides the core Ansible modules and plugins for managing AWS resources, including EC2, RDS, Route 53, VPC, and the aws_ssm connection plugin used to reach instances via AWS Systems Manager instead of SSH or WinRM. Version 11.4.0 has been published to Galaxy, and it focuses on a significant refactor of the aws_ssm connection plugin (particularly for Windows targets), new Active Directory support in rds_instance, and a broad documentation cleanup that replaces realistic-looking IPs, keys, and fingerprints with RFC-compliant placeholder values.

Whats New

aws_ssm connection plugin refactor

The bulk of the functional changes in this release land in the aws_ssm connection plugin, tracked under PR #2909:

  • Added the endpoint_url option (alias aws_endpoint_url) for connecting to alternate AWS endpoints.
  • Extracted Windows command execution logic into a dedicated WindowsCommandExecutor class, improving code organisation for Windows-targeted sessions.
  • Refactored the plugin to inherit from AWSConnectionBase, giving it consistent AWS credential handling shared with the other AWS connection/inventory plugins.
  • Renamed several connection options for consistency across the collection, while keeping the old names as aliases:
Old optionNew option
aws_access_key_idaccess_key
aws_secret_access_keysecret_key
aws_session_tokensession_token
aws_profileprofile

Additional aliases access_key_id and secret_access_key were also introduced. Existing playbooks and inventories using the old option names continue to work unchanged.

rds_instance Active Directory support

rds_instance gains support for joining RDS instances to a self-managed Active Directory domain, via PR #2977, with four new parameters:

  • domain_fqdn
  • domain_ou
  • domain_auth_secret_arn
  • domain_dns_ips

Documentation cleanup (RFC-compliant examples)

A large batch of minor changes under PR #3008 replaces realistic-looking data in module documentation with clearly fake, RFC-compliant values, so examples can no longer be mistaken for real infrastructure details. This touches:

  • backup_plan, backup_plan_info - example UUIDs instead of realistic version IDs.
  • ec2_eip, ec2_instance, ec2_instance_info, ec2_metadata_facts, ec2_vpc_nat_gateway, ec2_vpc_nat_gateway_info, ec2_vpc_vpn, ec2_vpc_vpn_info, route53, route53_health_check - RFC 5737 TEST-NET addresses instead of real-looking public IPs.
  • ec2_eni_info - RFC 1918 private addresses in examples.
  • ec2_key_info - an example SSH fingerprint instead of a realistic-looking one.
  • ec2_vpc_dhcp_option - public DNS servers (8.8.4.4, 8.8.8.8) used for DNS example values instead of RFC 5737 addresses.
  • ec2_vpc_vpn - an obvious placeholder pre-shared key instead of a realistic-looking one.

None of these documentation changes affect module behavior, but they are worth knowing about if any automation or tests scrape example blocks from the module docs.

Installation and Verification

# Install or upgrade to amazon.aws 11.4.0
ansible-galaxy collection install amazon.aws:==11.4.0

# Verify the installed version
ansible-galaxy collection list amazon.aws

# Inspect changelog and metadata for the installed collection
ansible-doc -t connection amazon.aws.aws_ssm
ansible-doc amazon.aws.rds_instance

Conclusion

Users relying on aws_ssm for Windows targets should review the option renames in PR #2909 before upgrading, even though backward-compatible aliases are provided. Anyone managing RDS instances that need self-managed Active Directory integration can now do so natively through rds_instance without custom workarounds.

All Tutorials