IP whitelisting challenge

[Gary Malouf]

We have used Ansible to automate all of our deployments to EC2 (via the EC2 packages included with Ansible) and custom roles for our own services.  Our production instances run in a vpc within public subnets.  

In order to do an integration with a partner, we've been asked to provide a range of ip addresses from which we will send them http requests.  While one approach is to use elastic ips, this is quite limiting if we need to scale up our number of instances.  Is there a cleaner way to do this in EC2 via Ansible - i.e. ensure the public ips of all instances in a subnet fall within the same range?

[Brian Coca]

I don't think Ansible is your limiting factor, it is AWS.


--
Brian Coca

[Jon Hadfield]

I had a similar issue, the difference being that I'm using only private addresses within the VPC subnets.

As Brian said, your limiting factor is AWS, so apologies if the following is a bit off-topic for this group...

The solution I used was to use ansible to automate a redundant pair of NAT instances in separate subnets based on the following guide: http://aws.amazon.com/articles/2781451301784570. By setting the service's subnets to have a default gateway of the NAT instance in the respective AZ, you ensure all instances in the subnet advertise on the static NAT instance IP. It also allows for auto-scaling as the route is set at the subnet level and inherited by all instances.

This is a functional solution but does suffer from a number of drawbacks, e.g. not an instant failover if a NAT instance fails, your throughput is limited by the instance types for the NAT instances, etc.

[Gary Malouf]

Thanks Jon, I appreciate hearing how you handled this.  Apologies that my issue was not limited by Ansible.