AnsibleByExample

amazon.aws 11.5.0 Released - Whats New and How to Test

Beginner
2024-01-014By Luca Berton

Lesson 1 of 25 in AWS Automation

AWS with Ansible — full curriculum
  1. 1. AWS Basics for Ansible
  2. 2. Installing the amazon.aws Collection and boto3
  3. 3. AWS Credentials and Profiles: Safe Configuration
  4. 4. Your First AWS Playbook: Regions, Tags and Idempotency
  5. 5. AWS Dynamic Inventory with the aws_ec2 Plugin
  6. 6. Grouping and Filtering Hosts with keyed_groups and Filters
  7. 7. Provisioning EC2 Instances
  8. 8. AMIs and Launch Templates
  9. 9. Building VPC Networks with Ansible
  10. 10. Security Groups and Network Access Control
  11. 11. Elastic IPs and Load Balancers
  12. 12. S3 Buckets and Object Management
  13. 13. IAM Users, Roles and Policies
  14. 14. RDS Databases with Ansible
  15. 15. Route 53 DNS Automation
  16. 16. CloudWatch Monitoring and Alarms
  17. 17. Managing Secrets: Secrets Manager, SSM Parameter Store and Ansible Vault
  18. 18. Post-Provisioning Configuration with Roles
  19. 19. Bridging Provisioning and Configuration: add_host and wait_for
  20. 20. Auto Scaling Groups and Rolling Updates
  21. 21. Validating Infrastructure with Assertions and Health Checks
  22. 22. Error Handling and Rollback in AWS Playbooks
  23. 23. Structuring a Reusable AWS Automation Project
  24. 24. Cost Control and Teardown Playbooks
  25. 25. Capstone: Provision and Configure a Multi-Tier AWS Application
View path overview →

Introduction

amazon.aws is the Ansible collection that provides modules, inventory plugins, and the aws_ssm connection plugin used to manage Amazon Web Services resources and connect to EC2 instances through AWS Systems Manager. Version 11.5.0 has been published on Ansible Galaxy, replacing 11.4.0.

This is a minor release: it introduces a new option on the aws_ec2 inventory plugin, removes a deprecated compatibility shim in favor of the Python standard library, and ships five bugfixes affecting ec2_spot_instance, aws_sqs_queue, rds_cluster, and the aws_ssm connection plugin.

Whats New

Minor Changes

  • The deprecated ansible.module_utils.six compatibility shims have been replaced with their Python standard library equivalents. ansible.module_utils.six is deprecated starting in ansible-core 2.21 and is scheduled for removal in 2.24 (PR #3039).
  • The aws_ec2 inventory plugin gains a use_deprecated_tags option, which allows disabling the deprecated tags host variable (and its associated deprecation and reserved-name warnings) independently of the global deprecation warning settings (issue #3028).

Bugfixes

  • aws_sqs_queue - Fixed UUID generation in the EDA event source plugin so that meta.uuid is set as a flat key readable by ansible-rulebook. The SQS MessageId is now validated as a proper RFC 4122 UUID, falling back to a deterministic UUID5 when it is invalid (PR #3034).
  • aws_ssm - The transfer bucket's server-side-encryption settings are now applied when uploading files from the controller to the managed node (put_file), matching the existing fetch_file behaviour. Previously the upload was made without encryption settings, so buckets whose policy denies unencrypted PutObject requests rejected every file transfer with AccessDenied (issue #3018).
  • aws_ssm connection plugin - Fixed a hang on reboot by handling ValidationException when terminating sessions that are already disconnected (issue #3044).
  • ec2_spot_instance - Fixed the network_interfaces.ipv6_addresses suboption, which was defined as ipv6address and serialized to the invalid boto3 key Ipv6address instead of Ipv6Address, causing a ParamValidationError when requesting a spot instance with an IPv6 address (issue #2557, PR #3110).
  • module_utils - Fixed fail_json_aws() to work with Python 3.14 and ansible-core 2.19+ by using try/except to detect fail_json exception parameter support instead of traceback.format_exc(), which fails outside an exception context in Python 3.14 (PR #3103).
  • rds_cluster - Fixed final_snapshot_identifier being silently dropped when deleting a DB cluster with skip_final_snapshot=false, which made the deletion fail. The option is now called final_db_snapshot_identifier, matching rds_instance and the FinalDBSnapshotIdentifier API parameter, with final_snapshot_identifier kept as an alias (issue #3084).
  • aws_ssm connection plugin - Fixed timeouts on Ubuntu clients, where dash on Ubuntu requires one-line commands without embedded \n (PR #3036).

Affected Components

ComponentTypeChange
aws_ec2Inventory pluginNew use_deprecated_tags option
module_utilsCoresix shim removed, fail_json_aws fixed for Python 3.14
aws_sqs_queueModuleEDA UUID generation fix
aws_ssmModuleSSE applied on put_file
aws_ssmConnection pluginFixed reboot hang and Ubuntu dash timeout
ec2_spot_instanceModuleFixed ipv6_addresses suboption serialization
rds_clusterModuleRenamed final_snapshot_identifier to final_db_snapshot_identifier (alias kept)

How to Install and Verify

# Install or upgrade the collection from Ansible Galaxy
ansible-galaxy collection install amazon.aws:==11.5.0

# Or upgrade to the latest available version
ansible-galaxy collection install amazon.aws --upgrade

# Verify the installed version
ansible-galaxy collection list amazon.aws

# Confirm from Python/ansible-doc
ansible-doc -t module amazon.aws.rds_cluster | head -n 20

Conclusion

Users relying on the aws_ssm connection plugin with Ubuntu managed nodes, or performing put_file transfers into encryption-enforcing S3 buckets, should prioritize this upgrade. Anyone calling rds_cluster with final_snapshot_identifier should also check their playbooks, since the option has been renamed to final_db_snapshot_identifier (the old name remains available as an alias, so existing playbooks keep working without changes).

All Tutorials