In our previous articles, How to scale smarter with Ansible and amazon.aws 9.0.0 and 3 steps to secure network segmentation with Ansible Automation Platform and AWS, we explored key updates in the amazon.aws 9.0.0 Ansible collection. We have demonstrated how to automate cloud scaling and how to implement strong security and network segmentation in Amazon Web Services (AWS) environments.
In this final article of our three-part series, we will focus on multi-Virtual Private Cloud (VPC) connectivity—a critical component for modern cloud architectures. As organizations expand their cloud environments, they often operate multiple VPCs to isolate workloads, improve security, and optimize resource management across regions. Ensuring secure and efficient communication between these VPCs, as well as with on-premise networks, is a challenge that requires a robust, automated solution.
This article will demonstrate how to automate multi-VPC connectivity using VPC peering and virtual private network (VPN) gateways, which are critical components for building scalable, secure cloud architectures.
How to secure multi-VPC connectivity
Many organizations operate multiple VPCs in order to separate workloads, enhance security, or manage resources across different regions. These environments often require secure communication between VPCs and with on-premise networks. This use case demonstrates how to establish secure multi-VPC connectivity using peering, VPN gateways, and egress-only internet gateways for IPv6 traffic.
First, we create a VPC peering connection to enable private communication between two VPCs. VPC peering is a cost-effective way to connect resources without exposing them to the public internet.
Next, we set up a VPN gateway for one of the VPCs to establish secure communication with an on-premise data center. This step is essential for hybrid cloud setups where sensitive data must be transmitted securely between the cloud and on-premise environments.
Finally, we configure an egress-only internet gateway for IPv6 traffic within the VPC. This gateway allows instances to initiate outbound internet connections while blocking inbound traffic, enhancing security for IPv6-enabled applications. Retrieving the gateway’s details confirms that it is ready to manage outbound IPv6 traffic.
This use case showcases how to create secure and efficient multi-VPC and hybrid cloud architectures involving the following modules:
ec2_vpc_peering: Creates, deletes, accepts, and rejects VPC peering connections between two VPCs.ec2_vpc_peering_info: Retrieves information about AWS VPC peerings.ec2_vpc_vpn: Manages EC2 VPN connections.ec2_vpc_vpn_info: Retrieves information about EC2 VPN connections.ec2_vpc_egress_igw: Manages AWS VPC egress-only internet gateways.ec2_vpc_egress_igw_info: Retrieves information about AWS VPC egress-only internet gateways.
3-step implementation guide
Now that we’ve outlined the key automation modules involved in multi-VPC connectivity with peering and VPN gateways, let’s walk through the implementation of an automated, scalable, and resilient infrastructure using Ansible Automation Platform.
This guide will explain how to:
- Create a VPC peering connection to enable private communication between multiple VPCs.
- Set Up a VPN connection to securely link the cloud environment with an on-premise network.
- Configure an egress-only internet gateway for secure outbound IPv6 traffic.
By following these steps, we will ensure that our infrastructure remains highly available, cost-optimized, and secure, while automating the process of establishing connectivity between VPCs and on-premise networks.
We'll break down the Ansible playbook into steps and demonstrate how each task automates and streamlines the multi-VPC connectivity setup.
1. Create VPC peering connection
The first step is to establish private communication between two VPCs using a VPC peering connection. This allows the VPCs to exchange traffic securely without the need for a public IP or internet exposure. The amazon.aws.ec2_vpc_peering module creates a peering connection between two VPCs and accepts the peering request to enable communication between the VPCs. The amazon.aws.ec2_vpc_peering_info module retrieves information about the VPC peering connections:
---
- name: Multi-VPC Connectivity with Peering and VPN Gateways
hosts: localhost
gather_facts: false
tasks:
- name: Create an EC2 VPC peering connection request
amazon.aws.ec2_vpc_peering:
state: present
vpc_id: "vpc-12345678"
peer_vpc_id: "vpc-87654321"
register: _result_vpc_peering
- name: Get all the EC2 VPC peering connections with specific filters
amazon.aws.ec2_vpc_peering_info:
filters:
status-code: ["pending-acceptance"]
register: _result_vpc_peering_info
- name: Accept the EC2 VPC peering request
amazon.aws.ec2_vpc_peering:
peering_id: '{{ _result_vpc_peering_info.pending_vpc_peers.vpc_peering_connections[0].vpc_peering_connection_id }}'
state: "accept"
wait: true2. Create VPN connection
The amazon.aws.ec2_vpc_vpn module sets up a VPN connection using the customer gateway (on-premise device) and virtual private gateway (in the VPC). This establishes a secure communication channel between the VPC and an on-premise network, which is critical for hybrid cloud scenarios where sensitive data must be transferred securely between the cloud and the data center. The community.aws.ec2_customer_gateway module allows you to manage customer gateways in AWS. Customer gateways are used in VPN connections between an AWS Virtual Private Gateway (VPG) or a transit gateway and your on-premise network. The amazon.aws.ec2_vpc_vpn_info module retrieves information about the VPN connection:
- name: Create VPN connection
amazon.aws.ec2_vpc_vpn:
state: present
customer_gateway_id: "cgw-abc123" # The ID of the customer gateway (on-premises device)
vpn_gateway_id: "vgw-xyz789" # The ID of the virtual private gateway in the VPC
static_only: false # Indicating that BGP (dynamic routing) is used, not static routing
tunnel_options:
- TunnelInsideCidr: "169.254.10.0/30" # Internal CIDR range for the VPN tunnel
PreSharedKey: "myPreSharedKey" # Pre-shared key for authentication
register: _vpn_connection
- name: Retrieve VPN connection information
amazon.aws.ec2_vpc_vpn_info:
filters:
vpn-gateway-id: "{{ _vpn_connection.vpn_connection_id }}"The following are the logs of the amazon.aws.ec2_vpc_vpn_info module:
[Partial log]
…
"vpn_connections": [
{
"category": "VPN",
"customer_gateway_configuration": "<?xml version=\"1.0\" encoding=\"UTF-8\”?>\n …\n”,
"customer_gateway_id": "cgw-abc123",
"gateway_association_state": "associated",
"options": {
"enable_acceleration": false,
"local_ipv4_network_cidr": "0.0.0.0/0",
"outside_ip_address_type": "PublicIpv4",
"remote_ipv4_network_cidr": "0.0.0.0/0",
"static_routes_only": false,
"tunnel_inside_ip_version": "ipv4",
"tunnel_options": [
{
"log_options": {
"cloud_watch_log_options": {
"log_enabled": false
}
},
"outside_ip_address": "3.229.0.8",
"pre_shared_key": "myPreSharedKey",
"tunnel_inside_cidr": "169.254.10.0/30"
},
{
"log_options": {
"cloud_watch_log_options": {
"log_enabled": false
}
},
"outside_ip_address": "184.72.102.191",
"pre_shared_key": "2hKkGhWeDD03dxs6332EEV7gwo.CeSaJ",
"tunnel_inside_cidr": "169.254.193.20/30"
}
]
},
"routes": [],
"state": "available",
"tags": {},
"type": "ipsec.1",
"vgw_telemetry": [
{
"accepted_route_count": 0,
"last_status_change": "2025-01-20T10:56:37+00:00",
"outside_ip_address": "3.229.0.8",
"status": "DOWN",
"status_message": "IPSEC IS DOWN"
},
{
"accepted_route_count": 0,
"last_status_change": "2025-01-20T10:56:22+00:00",
"outside_ip_address": "184.72.102.191",
"status": "DOWN",
"status_message": "IPSEC IS DOWN"
}
],
"vpn_connection_id": "vpn-07934309550c3a585",
"vpn_gateway_id": "vgw-xyz789"
}
]3. Set up egress-only internet gateway for IPv6
The amazon.aws.ec2_vpc_egress_igw module configures an egress-only gateway. This gateway is used to manage outbound IPv6 traffic from the VPC to the internet while blocking any inbound IPv6 traffic. This is critical when instances in your VPC need to access the internet (e.g., software updates, accessing public services, etc.) but you don’t want to expose them to external inbound connections over IPv6. The amazon.aws.ec2_vpc_egress_igw_info module retrieves information about the egress-only internet gateway:
- name: Set up egress-only internet gateway for IPv6
amazon.aws.ec2_vpc_egress_igw:
vpc_id: "vpc-12345678"
register: _egress_igw
- name: Gather information about a filtered list of VPC egress only internet gateways
amazon.aws.ec2_vpc_egress_igw_info:
filters:
"tag:Name": "{{ _egress_igw.gateway_id }}"The following is a sample partial log output from the amazon.aws.ec2_vpc_iwg_info module:
[Partial log]
…
"egress_only_internet_gateways": [
{
"attachments": [
{
"state": "attached",
"vpc_id": "vpc-12345678”
}
],
"egress_only_internet_gateway_id": "eigw-0e91a0f2433018227",
"tags": {}
}
]What's next?
In this final article of our series, we’ve demonstrated how the latest features in the amazon.aws 9.0.0 collection empower you to automate secure and scalable multi-VPC connectivity. By leveraging VPC peering, VPN connections, and egress-only internet gateways, we’ve shown how to build efficient and secure network architectures in AWS. This automation helps to reduce manual intervention, improve scalability, and ensure robust security for cloud environments.
We hope this series has provided you with a deeper understanding of how these new modules and features can streamline the management of your AWS infrastructure. Stay tuned for future insights and tutorials on how to optimize and scale your AWS architecture with Ansible!
Looking to get started with Red Hat Ansible Automation Platform for Amazon Web Services?
- Check out the Amazon Web Services Collection.
- Try out our hands-on Interactive Labs.
- Read the e-book Using automation to get the most from your public cloud.
Learn more:
- For further reading and information, visit the other articles related to Ansible Automation Platform.
- Check out Red Hat Summit 2025.
- Watch the YouTube playlist for everything about Ansible Collections.
- If you're new to Ansible automation, check out our getting started guide on developers.redhat.com.
