Ansible SSH connections via AWS EC2 Instance Connect Endpoint

aws_ec2.yml

# The dynamic inventory

# https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ec2_inventory.html
plugin: amazon.aws.aws_ec2
profile: "{{ lookup('env', 'AWS_PROFILE') | default('aws_profile', true) }}"
regions:
  - ap-northeast-1
  - eu-central-1
cache: True
cache_timeout: 600
cache_plugin: "jsonfile"
cache_connection: '~/.ansible/tmp_staging'
hostnames:
  - tag:Name
keyed_groups:
  - key: tags
    prefix: tag
groups:
  cloud_aws: 'true'
filters:
  instance-state-name: running
compose:
  ansible_host: instance_id
  tag_env: tags.Environment
  tag_name: tags.Name
  tag_provider: "'aws'"

In the vars file:

---
ansible_ssh_common_args: >-
  -o ProxyCommand='aws ec2-instance-connect open-tunnel --region {{ placement['region'] }} --instance-id {{ ansible_host }}'

You can still use ansible.cfg combination with it, e.g.:

[ssh_connection]
ssh_args = -o ControlMaster=auto -o ControlPersist=1500s -o ForwardAgent=yes

Command to test after being authenticated with AWS:

ssh user@i-xxx -o ProxyCommand='aws ec2-instance-connect --region eu-central-1 open-tunnel --instance-id i-xxx'