Create AWS security group egress rules for AWS API access, using Ansible

create_aws_api_group.py

#!/usr/bin/python
import json
import sys
# take json from stdin, from source such as https://ip-ranges.amazonaws.com/ip-ranges.json
# and turn it into an AWS security group using Ansible

region = 'eu-west-1'

header_str = """---
- hosts: 127.0.0.1
  connection: local
  gather_facts: no
  tasks:"""

task_str ="""  - name: Create AWS {} API access security group

    local_action:
      module: ec2_group
      region: "{{ aws_region }}"
      vpc_id: "{{ vpc_id }}"
      name: "{{ env }}_aws_route53_health_api"
      description: "{{ env }} AWS ROUTE53_HEALTHCHECKS API access"
      rules:"""

rule_str = """        - proto: tcp
          from_port: 443
          to_port: 443
          cidr_ip: "{}" """

obj = json.load(sys.stdin)

print header_str


api = 'ROUTE53_HEALTHCHECKS'
print task_str.format(api,api,api)
cnt = 0
for o in obj['prefixes']:
  if o['service'] == api:
    cnt += 1
    if cnt < 50:
      print rule_str.format(o['ip_prefix'])
    else:
      sys.stderr.write('exceeded 50 rules for aws-{}-api\n'.format(api))