In our previous article, How to scale smarter with Ansible and amazon.aws 9.0.0, we explored key updates in the amazon.aws 9.0.0 Ansible collection and demonstrated how to automate cloud scaling in Amazon Web Services (AWS) environments.
This article is the second in a three-part series exploring real-world use cases that showcase the power of these new capabilities. Today, we’ll focus on secure network segmentation—leveraging Red Hat Ansible Automation Platform to efficiently manage AWS Transit Gateways, Virtual Private Cloud (VPC) attachments, and Network Access Control Lists (ACLs) for centralized connectivity and robust security controls.
Stay tuned for the final article, where we’ll cover multi-VPC connectivity. For now, let’s dive into automation strategies that help you build a secure and scalable network infrastructure with Ansible Automation Platform and AWS.
Secure network segmentation
As organizations adopt cloud-native architectures, maintaining seamless communication between multiple VPCs while enforcing strong security controls becomes critical.
AWS Transit Gateways and Network ACLs enable this by simplifying network connections and providing robust traffic filtering. This use case explores how to set up a Transit Gateway to centralize VPC connectivity and implement Network ACLs to secure traffic within a VPC.
The scenario starts by creating a Transit Gateway, which acts as a network hub to interconnect multiple VPCs. This centralization reduces complexity and improves network performance. Next, we attach a VPC to the Transit Gateway to enable communication between resources in different VPCs. To enhance security, we create a Network ACL for the VPC to manage inbound and outbound traffic at the subnet level. Network ACLs allow us to define rules that filter traffic based on IP addresses, ports, and protocols, providing an additional layer of protection.
This use case emphasizes the importance of balancing connectivity and security in cloud environments. We use the following modules:
ec2_transit_gateway: Manages EC2 Transit Gateways.ec2_transit_gateway_info: Retrieves information about EC2 Transit Gateways in AWS.ec2_transit_gateway_vpc_attachment: Manages EC2 Transit Gateway VPC attachments.ec2_transit_gateway_vpc_attachment_info: Retrieves information about EC2 Transit Gateway VPC Attachments.ec2_vpc_nacl: Manages Network ACLs.ec2_vpc_nacl_info: Retrieves information about Network ACLs in an AWS VPC.
3-step implementation guide
Now that we've outlined the key automation modules for secure network segmentation, let's walk through the step-by-step implementation of a secure and scalable network infrastructure using Ansible. This guide will explain how to:
- Create a Transit Gateway to centralize VPC connectivity.
- Attach a VPC to the Transit Gateway to enable seamless inter-VPC communication.
- Configure a Network ACL to secure traffic at the subnet level.
By following these steps, you ensure that your network remains highly secure, resilient, and scalable, without the need for manual intervention.
Let’s break down the Ansible Playbook into these clear, actionable steps and see how each one streamlines the process of implementing secure network segmentation in AWS.
1. Create a Transit Gateway
The amazon.aws.ec2_transit_gateway module creates a Transit Gateway for interconnecting VPCs. A Transit Gateway acts as a central hub for VPC connections, simplifying routing and reducing the complexity of managing multiple point-to-point connections. We also use the amazon.aws.ec2_transit_gateway_info module to check for any existing gateways before creating a new one:
---
- name: Secure Network Segmentation with Transit Gateways and Network ACLs
hosts: localhost
gather_facts: false
tasks:
- name: Check if any transit gateway exists using some filters before creating a new one
amazon.aws.ec2_transit_gateway_info:
filters:
options.dns-support: enable
options.vpn-ecmp-support: enable
register: _result_transit_gateway_info
- name: Create transit gateway
amazon.aws.ec2_transit_gateway:
state: present
description: "Transit Gateway for inter-VPC communication"
register: _result_transit_gateway
when: _result_transit_gateway_info.transit_gateways | length == 02. Attach a VPC to the Transit Gateway
Next, we attach a VPC to the Transit Gateway so that resources in different VPCs can communicate seamlessly. The amazon.aws.ec2_transit_gateway_vpc_attachment module performs this task, while the corresponding info module helps retrieve and verify the attachment details:
- name: Attach VPC to transit gateway
amazon.aws.ec2_transit_gateway_vpc_attachment:
state: present
transit_gateway_id: "{{ _result_transit_gateway.transit_gateway.id }}"
subnet_ids:
- "subnet-12345678"
- "subnet-87654321"
dns_support: true
ipv6_support: true
appliance_mode_support: false
- name: Retrieve VPC attachment details
amazon.aws.ec2_transit_gateway_vpc_attachment_info:
id: "{{ _result_transit_gateway.transit_gateway.id }}"The following is a sample partial log output from the amazon.aws.ec2_transit_gateway_vpc_attachment_info module:
[Partial log]
…
"attachments": [
{
"creation_time": "2025-01-20T09:54:58+00:00",
"options": {
"appliance_mode_support": "disable",
"dns_support": "enable",
"ipv6_support": "enable",
"security_group_referencing_support": "enable"
},
"state": "available",
"subnet_ids": [
"subnet-12345678”,
"subnet-87654321”,
],
"tags": {},
"transit_gateway_attachment_id": "tgw-attach-0c17c8a1bda4839a8",
"transit_gateway_id": "tgw-0352dd6837d1d140f",
"vpc_id": "vpc-0ef0a301a6b8a2f5c",
"vpc_owner_id": "1234567891234"
}
]3. Create a Network ACL
Finally, we configure a Network ACL to enforce security policies at the subnet level. Using the amazon.aws.ec2_vpc_nacl module, we define rules to control both inbound and outbound traffic. We use the amazon.aws.ec2_vpc_nacl_info module to retrieve and verify the ACL configuration:
- name: Configure network ACL for VPC
amazon.aws.ec2_vpc_nacl:
state: present
vpc_id: "vpc-12345678"
name: "secure-nacl"
subnets:
- "subnet-12345678"
- "subnet-87654321"
ingress:
- [100, 'tcp', 'allow', '0.0.0.0/0', null, null, 22, 22] # Allow SSH access on port 22
- [200, 'tcp', 'allow', '0.0.0.0/0', null, null, 80, 80] # Allow HTTP access on port 80
egress:
- [100, 'all', 'allow', '0.0.0.0/0', null, null, null, null] # Allow all outbound traffic
state: "present"
register: _result_network_acl
- name: Retrieve network ACL details
amazon.aws.ec2_vpc_nacl_info:
nacl_ids:
- "{{ _result_network_acl.nacl_id }}"The following is a sample partial log output from the amazon.aws.ec2_vpc_nacl_info module:
[Partial log]
…
"nacls": [
{
"egress": [
[
100,
"all",
"allow",
"0.0.0.0/0",
null,
null,
0,
65535
]
],
"ingress": [
[
100,
"tcp",
"allow",
"0.0.0.0/0",
null,
null,
22,
22
],
[
200,
"tcp",
"allow",
"0.0.0.0/0",
null,
null,
80,
80
],
],
"is_default": false,
"nacl_id": "acl-002b90246b9e3009d",
"owner_id": "721066863947",
"subnets": [
"subnet-12345678”,
"subnet-87654321" ],
"tags": {
"Name": "secure-nacl"
},
"vpc_id": "vpc-12345678"
}
]What's next?
In this article, we demonstrated how the latest new modules in the amazon.aws 9.0.0 collection empower you to automate secure network segmentation in AWS. By walking through a practical use case, from creating a Transit Gateway and attaching a VPC to configuring a Network ACL, we showcased how these new modules simplify the process of balancing connectivity with robust security controls. This automation reduces manual intervention while ensuring your network remains secure, resilient, and scalable.
In the final article of our series, we’ll explore multi-VPC connectivity, another critical component for modern, secure cloud architectures.
Looking to get started with Red Hat Ansible Automation Platform for Amazon Web Services?
- Check out the Amazon Web Services Collection.
- Try out our hands-on Interactive Labs.
- Read the e-book Using automation to get the most from your public cloud.
Learn more:
- For further reading and information, visit the other articles related to Ansible Automation Platform.
- Check out Red Hat Summit 2025.
- Watch the YouTube playlist for everything about Ansible Collections.
- If you're new to Ansible automation, check out our getting started guide on developers.redhat.com.
