How to Create a FREE Ansible Lab in Public Cloud (AWS, GCP, Azure)


As we all know, learning Ansible is not just a reading process and you really need to do a lot of hands-on and practice with all use-cases you have. And when it comes to create an ansible lab, you can easily spin-up one using Vagrant/Terraform on top of local virtualization like VirtualBox or Hyper-V.

Other ways to create Quick Ansible Lab to practice.

Watch Ansible for Beginners YouTube Playlist

Even though we are creating small lab (eg: nodes with 1GB memory etc), still some of the students wants to setup their Ansible Lab on Public Cloud due to various reasons. (I have a Terraform repository for quick spinning of Ansible Lab on Top of AWS if you prefer automated lab provisioning.) It is good to setup this on Public Cloud as you will automatically learn Public Cloud as well. In this guide, we will learn how to setup an ansible lab from scratch and everything manually, so that you will learn how ansible is connecting to its target nodes etc.


  • AWS Account – You can Sign up for AWS Free Tier; Credit Card is needed but it won’t be charged if you are using the free tier services. We need only Free tier services to setup this Lab.
  • Basic Linux knowledge – To install and configure the nodes.

Create Instances for Ansible Lab

Login to AWS Console and Select EC2. (You can choose any region). Click on Launch Instance.

  • Step 1 – Choose AMI : Amazon Linux 2 AMI (HVM), SSD Volume Type (64 bit)
  • Step 2 – Instance Type: t2.micro (Free Tier Eligible)
  • Step 3 – Number of Instances: 3 (You can add more if need to test with many nodes). Keep other settings as default (Default VPC, Subnet etc)
  • Step 4 – Add Storage: Keep default (8G General Purpose SSD)
  • Step 5 – Add Tags: lab = Ansible (Optional but best practice)
  • Step 6 – Configure Security Group: Select option Create a new Security Group and add below ports to allow. (If you have any existing SG with those ports opened, you can use that as well)
  • Step 7 – Review Instance Launch: Verify all values and launch instances.

Wizard will popup and ask for selecting the SSH key pair to access the instance once created. If no SSH Key created, choose “Create a new key pair” option and give Key Pair name as shown below.

Download Key Pair and save it to a safe location; you will need this later to connect to the instance once launched.

Click Launch Instances.

You will get a status message and you can click the button View Instances to see the instances details.

Rename Instance for better visibility

This is optional but highly recommended to identify the instances.

Click on the edit option under the Name column of instance and use some names.

Configure Instances

We will use instance private IP to access the ansible-nodes as the private IP will not change during instance lifetime. (Public IP will change when you Power off the instance as we will power off when we are not using the instances)

You can allocate Elastic IP (EIP) for instance to keep the public IP same but this is not really required for this lab. Please note using Elastic IP is free as long as you are using it with a running instance; otherwise it will charge you !

Verify Public IP or DNS from the console. (You can use IP or DNS; some other cloud providers do not have DNS for instances, so use it as available).

You can use any ssh client applications like Putty, mRemoteNG, MobaXterm etc(in Windows) or native ssh clients (on Linux machines). Please note, the default username in instance will be ec2-user.

Configure ansible-nodes

(Remember to configure the same for both ansible-nodes.)

$ ssh -i ansible-lab-access.pem [email protected]
The authenticity of host ' (' can't be established.
ECDSA key fingerprint is SHA256:yG4T1SVot1ZT5ypjTDlaaLEDRjjM0OarhEsprYk20bc.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '' (ECDSA) to the list of known hosts.

       __|  __|_  )
       _|  (     /   Amazon Linux 2 AMI
6 package(s) needed for security, out of 17 available
Run "sudo yum update" to apply all updates.
[[email protected] ~]$

Set the system hostname to identify the machines.

[[email protected] ~]$ sudo hostnamectl set-hostname  ansible-node1

Create user for ansible remote access and Configure Sudo.

Also read : Password-less SSH Access in Linux

## create devops user (password devops)
[[email protected] ~]$ sudo useradd devops
[[email protected] ~]$ sudo passwd devops

## Enable password authentication
[[email protected] ~]$ sudo sed -i "s/PasswordAuthentication no/PasswordAuthentication yes/g" /etc/ssh/sshd_config

[[email protected] ~]$ sudo systemctl restart sshd

## Enable sudo access for devops user;
## create sudo file and add content-> devops ALL=(ALL) NOPASSWD: ALL
[[email protected] ~]$ sudo vim /etc/sudoers.d/devops

## the content of file should be like below
[[email protected] ~]$ sudo cat /etc/sudoers.d/devops

Configure the same for both ansible-nodes.

Configure ansible-engine node

$ ssh -i ansible-lab-access.pem [email protected]
The authenticity of host ' (' can't be established.
ECDSA key fingerprint is SHA256:H5IHPA9+DwjIjxoeidkahDR8juLDkioyu6iLgYYN7TA.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '' (ECDSA) to the list of known hosts.

       __|  __|_  )
       _|  (     /   Amazon Linux 2 AMI
6 package(s) needed for security, out of 17 available
Run "sudo yum update" to apply all updates.
[[email protected] ~]$
[[email protected] ~]$ cat /etc/*release

Set the system hostname to identify the machines.

[[email protected] ~]$ sudo hostnamectl set-hostname ansible-engine
[[email protected] ~]$ sudo hostnamectl 
   Static hostname: ansible-engine
         Icon name: computer-vm
           Chassis: vm
        Machine ID: ec2d0f46985d6ec5013a525e909aa54e
           Boot ID: ac2e93325a7d4bbeb843c1776f632bef
    Virtualization: xen
  Operating System: Amazon Linux 2
       CPE OS Name: cpe:2.3:o:amazon:amazon_linux:2
            Kernel: Linux 4.14.231-173.361.amzn2.x86_64
      Architecture: x86-64

Install Ansible

## Confirm Python is installed (python2 or python3)
[[email protected] ~]$ sudo yum list installed python*

## Install EPEL from amazon
[[email protected] ~]$ sudo amazon-linux-extras install epel

## Install Ansible 
[[email protected] ~]$ sudo yum install ansible

## Check Ansible Version and Configuration
[[email protected] ~]$ ansible --version
ansible 2.9.21
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/ec2-user/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.18 (default, Feb 18 2021, 06:07:59) [GCC 7.3.1 20180712 (Red Hat 7.3.1-12)] 

You can use other installation methods as well, refer documentation.

Configure Ansible

We will create a basic ansible.cfg and inventory to verify installation.

Create Ansible Configuration

## Create a Demo directory
[[email protected] ~]$ mkdir ansible-demo
[[email protected] ~]$ cd ansible-demo/

## Create an ansible.cfg as below and add content; see sample content below
[[email protected] ansible-demo]$ vim ansible.cfg 

## Sample file content
[[email protected] ansible-demo]$ cat ansible.cfg 
# inventory file to use
inventory = ./inventory

# ansible remote user
remote_user = devops

Create Ansible Inventory

## Create inventory with our ansible-nodes as below; see sample content below
[[email protected] ansible-demo]$ vim inventory 

## Sample inventory
[[email protected] ansible-demo]$ cat inventory 
ansible-engine ansible_connection=local

node1 ansible_host=
node2 ansible_host=

Add node details to /etc/hosts

We can use in-build private DNS to access the nodes but those are not so easy to remember or type. Hence we will create entries in /etc/hosts with private IPs for easy access

## add entries in /etc/hosts for eazy access; see sample below
[[email protected] ~]$ sudo vim /etc/hosts

## sample /etc/hosts 
[[email protected] ~]$ sudo cat /etc/hosts   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost6 localhost6.localdomain6

## ansible nodes with private IP  node1 node2

Install optional packages

## Optional: Install git
$ sudo yum install git

Configure SSH Key based Access from ansible-engine

Since we are talking automation, password-less but safe access is very important. We will implement password-less ssh key access from ansible-engine to ansible-nodes.

Read Password-less SSH Access in Linux for more details on this topic.

Remember to do this for both ansible-nodes.

## Step 1: Create SSH
[[email protected] ~]$ ssh-keygen 
Generating public/private rsa key pair.
Enter file in which to save the key (/home/ec2-user/.ssh/id_rsa): 
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/ec2-user/.ssh/id_rsa.
Your public key has been saved in /home/ec2-user/.ssh/
The key fingerprint is:
SHA256:xGmknVQ6WpmsqNWir8PQIZWgq0SvC1Tg5Ymh1t2a9hY [email protected]
The key's randomart image is:
+---[RSA 2048]----+
|.+ o    o..      |
|+ X o .B *       |
|o* = ...#        |
|+.+  oo* .       |
|.= o+++ES        |
|= o+... .        |
|o+o    o         |
|. +.  .          |
| ..o.            |

## Copy public keys to ansible-nodes
[[email protected] ~]$ ssh-copy-id [email protected]
/usr/bin/ssh-copy-id: INFO: Source of key(s) to be installed: "/home/ec2-user/.ssh/"
The authenticity of host 'node1 (' can't be established.
ECDSA key fingerprint is SHA256:yG4T1SVot1ZT5ypjTDlaaLEDRjjM0OarhEsprYk20bc. 
ECDSA key fingerprint is MD5:e3:be:23:24:7a:dc:a5:ec:09:7a:af:92:8a:a2:93:4c.
Are you sure you want to continue connecting (yes/no)? yes
/usr/bin/ssh-copy-id: INFO: attempting to log in with the new key(s), to filter out any that are already installed
/usr/bin/ssh-copy-id: INFO: 1 key(s) remain to be installed -- if you are prompted now it is to install the new keys
[email protected]'s password: 

Number of key(s) added: 1

Now try logging into the machine, with:   "ssh '[email protected]'"    
and check to make sure that only the key(s) you wanted were added.

## Verify node access using keys
[[email protected] ~]$ ssh [email protected]

[[email protected]ansible-node1 ~]$

## Verify sudo access on node for devops user
[[email protected]ansible-node1 ~]$ sudo -i
[[email protected]ansible-node1 ~]# 

## Exit from sudo and then nodes
[[email protected] ~]# exit
[[email protected] ~]$ exit
Connection to node1 closed.
[[email protected] ~]$

Let’s Test Ansible

Now we have one ansible-engine and two ansible-nodes; we will test the ansible with nodes now.

[[email protected] ~]$ cd ansible-demo/
[[email protected] ansible-demo]$ ll
total 8
-rw-rw-r-- 1 ec2-user ec2-user 103 Jun  7 13:57 ansible.cfg
-rw-rw-r-- 1 ec2-user ec2-user 123 Jun  7 13:55 inventory

Run a simple ansible ping job to confirm access.

[[email protected] ansible-demo]$ ansible all -m ping 
ansible-engine | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    "changed": false, 
    "ping": "pong"
node1 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    "changed": false, 
    "ping": "pong"
node2 | SUCCESS => {
    "ansible_facts": {
        "discovered_interpreter_python": "/usr/bin/python"
    "changed": false, 
    "ping": "pong"

Great ! we are good to go. Ansible engine is able to access the nodes and all working as expected. Get your hands dirty now !

Maintaining the Lab Instance

As we know the FREE tier is limited (eg; 750hrs of ec2 instance in AWS etc), we are not going to keep this instance running all the time. Once you have finished your lab (learning, testing or development), you can shutdown (Stop Instance) the instances.

Stop Instances and wait for the “Stopped” Status.

So, when you want to use the lab again, just login to the AWS Console and Start those instances again.

Start Instances whenever you needed.


  • Make sure you stop the instances once you finished testing; running instances in background may exceed your AWS Free Tier Quota and may results in charging your billing account.
  • As I informed earlier, when you stop and start instance Public IP address of the instance will be changed. Remember to find the correct public IP of nodes and use it to connect via ssh.

Final Thoughts

All of the steps mentioned above are same for other public cloud providers (Other than provisioning the instances) and hence you are free to try any public cloud platforms like Google Cloud Platform (GCP Free Tier), Microsoft Azure (Azure Free Tier) etc.

Gineesh Madapparambath

(aka Gini Gangadharan) - Gineesh has worked as a Systems Engineer, Automation Specialist, and content author. His primary focus is on Ansible Automation, Containerization (OpenShift & Kubernetes), and Infrastructure as Code (Terraform).

You may also like...

%d bloggers like this: