AnsibleでAWSのセキュリティグループを管理する方法｜ec2_security_groupモジュールとrole設計でネットワークポリシーを自動化する

この記事のポイント

・ec2_security_groupモジュールで冪等なSG管理ができる
・roleのdefaultsに変数を切り出すとstaging/productionの差分管理が楽になる
・group_varsでCIDRや許可ポートを環境別に上書きするのが設計の定石
・Web層とDB層をrole分割すると責務が明確になりレビューコストが下がる

# コレクションのインストール（requirements.yml を使う場合は後述）
ansible-galaxy collection install amazon.aws

- name: Create web-sg security group
  amazon.aws.ec2_security_group:
    name: "web-sg"
    description: "Security group for web servers"
    vpc_id: "{{ vpc_id }}"
    region: "{{ aws_region }}"
    rules:
      - proto: tcp
        ports:
          - 80
          - 443
        cidr_ip: "0.0.0.0/0"
      - proto: tcp
        ports:
          - 22
        cidr_ip: "{{ admin_cidr }}"
  register: web_sg_result

roles/
└── aws_security_group/
    ├── defaults/
    │   └── main.yml     # デフォルト変数（最低優先度）
    ├── tasks/
    │   └── main.yml     # 実際のec2_security_group呼び出し
    └── vars/
        └── main.yml     # 変更しない固定値（高優先度）

# roles/aws_security_group/defaults/main.yml

aws_region: "ap-northeast-1"
vpc_id: ""                    # 必須。呼び出し元で渡す

# Web層SG
web_sg_name: "web-sg"
web_sg_admin_cidr: "10.0.0.0/8"
web_sg_allow_public_ports:
  - 80
  - 443

# DB層SG
db_sg_name: "db-sg"
db_sg_port: 3306

# roles/aws_security_group/tasks/main.yml

- name: Create or update web-sg
  amazon.aws.ec2_security_group:
    name: "{{ web_sg_name }}"
    description: "Web servers - managed by Ansible"
    vpc_id: "{{ vpc_id }}"
    region: "{{ aws_region }}"
    rules:
      - proto: tcp
        ports: "{{ web_sg_allow_public_ports }}"
        cidr_ip: "0.0.0.0/0"
      - proto: tcp
        ports:
          - 22
        cidr_ip: "{{ web_sg_admin_cidr }}"
    purge_rules: true
  register: web_sg

- name: Create or update db-sg (allow from web-sg only)
  amazon.aws.ec2_security_group:
    name: "{{ db_sg_name }}"
    description: "DB servers - managed by Ansible"
    vpc_id: "{{ vpc_id }}"
    region: "{{ aws_region }}"
    rules:
      - proto: tcp
        ports:
          - "{{ db_sg_port }}"
        group_id: "{{ web_sg.group_id }}"
    purge_rules: true

# site.yml

- name: Manage AWS security groups
  hosts: localhost
  connection: local
  gather_facts: false
  roles:
    - role: aws_security_group
      vars:
        vpc_id: "{{ lookup('env', 'AWS_VPC_ID') }}"

inventories/
├── staging/
│   ├── hosts.yml
│   └── group_vars/
│       └── all.yml     # staging用変数
└── production/
    ├── hosts.yml
    └── group_vars/
        └── all.yml     # production用変数

# inventories/staging/group_vars/all.yml
vpc_id: "vpc-0staging0000000"
web_sg_admin_cidr: "0.0.0.0/0"     # staging: 自分のPCから直接SSHできるよう全開放

# inventories/production/group_vars/all.yml
vpc_id: "vpc-0prod0000000000"
web_sg_admin_cidr: "203.0.113.0/28"  # production: 管理拠点のCIDRのみ

$ ansible-playbook -i inventories/staging site.yml

PLAY [Manage AWS security groups] ********************************************

TASK [aws_security_group : Create or update web-sg] **************************
changed: [localhost] => {
    "changed": true,
    "description": "Web servers - managed by Ansible",
    "group_id": "sg-0a1b2c3d4e5f67890",
    "group_name": "web-sg",
    "ip_permissions": [
        {
            "from_port": 80,
            "ip_protocol": "tcp",
            "ip_ranges": [{"cidr_ip": "0.0.0.0/0"}],
            "to_port": 80
        },
        {
            "from_port": 443,
            "ip_protocol": "tcp",
            "ip_ranges": [{"cidr_ip": "0.0.0.0/0"}],
            "to_port": 443
        },
        {
            "from_port": 22,
            "ip_protocol": "tcp",
            "ip_ranges": [{"cidr_ip": "0.0.0.0/0"}],
            "to_port": 22
        }
    ],
    "vpc_id": "vpc-0staging0000000"
}

TASK [aws_security_group : Create or update db-sg (allow from web-sg only)] **
changed: [localhost] => {
    "changed": true,
    "group_id": "sg-0f9e8d7c6b5a43210",
    "group_name": "db-sg",
    "ip_permissions": [
        {
            "from_port": 3306,
            "ip_protocol": "tcp",
            "ip_ranges": [],
            "user_id_group_pairs": [
                {"group_id": "sg-0a1b2c3d4e5f67890"}
            ],
            "to_port": 3306
        }
    ],
    "vpc_id": "vpc-0staging0000000"
}

PLAY RECAP *******************************************************************
localhost                  : ok=2    changed=2    unreachable=0    failed=0

# production は admin CIDR が制限されている
$ ansible-playbook -i inventories/production site.yml