+---
+- assert:
+ that:
+ tags: ['check_vars']
+
+- name: vpcaccess iam
+ iam:
+ name: vpcaccess
+ iam_type: role
+ state: present
+
+- name: sg vpcaccess
+ ec2_group:
+ vpc_id: "{{ vpc.vpc.id }}"
+ region: "{{ vpc_region }}"
+ state: present
+ name: vpcaccess
+ description: "vpcaccess rules"
+ purge_rules: false
+ rules:
+ rules_egress:
+ - proto: all
+ cidr_ip: 0.0.0.0/0
+ register: sg_vpcaccess
+
+- name: vpcaccess lc
+ ec2_lc:
+ region: "{{ vpc_region }}"
+ name: vpcaccess-0000
+ image_id: "{{ DEFAULT_AMI }}"
+ key_name: "{{ MANAGEMENT_KEY_NAME }}"
+ instance_profile_name: vpcaccess
+ security_groups:
+ - "{{ sg_vpcaccess.group_id }}"
+ - "{{ sg_ssh.group_id }}"
+ instance_type: m4.large
+ volumes:
+# setting the root volume seems to prevent instances from launching
+# - device_name: /dev/sda1
+# volume_size: 8
+# volume_type: gp2
+# delete_on_termination: true
+ - device_name: /dev/sdb
+ ephemeral: ephemeral0
+ - device_name: /dev/sdc
+ ephemeral: ephemeral1
+ - device_name: /dev/sdd
+ ephemeral: ephemeral2
+ - device_name: /dev/sde
+ ephemeral: ephemeral3
+ register: vpcaccess_lc
+
+- name: suss out our subnets
+ ec2_vpc_subnet_facts:
+ region: "{{ vpc_region }}"
+ filters:
+ vpc_id: "{{ vpc.vpc.id }}"
+ "tag:zone": pub
+ register: public_subnet_ids
+
+- debug:
+ var: public_subnet_ids
+
+- name: vpcaccess asg
+ ec2_asg:
+ region: "{{ vpc_region }}"
+ name: vpcaccess
+ min_size: 1
+ max_size: 1
+ desired_capacity: 1
+ default_cooldown: 10
+ vpc_zone_identifier: "{{ public_subnet_ids.subnets|map(attribute='id')|list }}"
+ launch_config_name: "{{ vpcaccess_lc.name|default('checkmode') }}"
+ notification_topic: "{{ management_topic.sns_arn }}"
+ notification_types:
+ - autoscaling:EC2_INSTANCE_LAUNCH
+ load_balancers:
+ tags:
+ - account: "{{ ACCT_NAME }}"
+ propagate_at_launch: yes
+ - module: vpcaccess
+ propagate_at_launch: yes
+ - stack: ""
+ propagate_at_launch: yes
+ - country: ""
+ propagate_at_launch: yes
+ - phase: dev
+ propagate_at_launch: yes
+
+- name: not implemented yet
+ debug:
+ msg: |
+ attach policies to iam role