skills.rest
rbudiharso
rbudiharsoCOMMUNITY
Explore all skills by this author →
Website𝕏@rbudiharsoGitHub

ec2-instance-analysis

Inventory EC2 instances via SSM and export them to OpenTofu and Ansible IaC.

2|Updated Oct 20, 2017
Search Tags:#devops#aws#ec2#ansible#infrastructure-as-code#opentofu#ssm
One-click install
npx skills add https://github.com/rbudiharso/dotfiles --skill ec2-instance-analysis-rbudiharso
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ec2-instance-analysis
Source: https://github.com/rbudiharso/dotfiles/tree/main/hermes/.hermes/skills/devops/ec2-instance-analysis
Command: npx skills add https://github.com/rbudiharso/dotfiles --skill ec2-instance-analysis-rbudiharso

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Understanding and reproducing a live EC2 instance is slow and error-prone: SSH access may be unavailable, installed software is undocumented, and hand-written infrastructure code drifts from reality. This Skill inventories an EC2 instance entirely through AWS Systems Manager (no SSH keys needed) and converts the findings into OpenTofu and Ansible code that matches the live environment. ## Core Features & Use Cases - SSM-based inventory: Run parallel send-command batches to collect OS details, running services, listening ports, Docker containers, databases, and TLS certificates without SSH. - IaC export: Generate OpenTofu (EC2, security groups, IAM, EIP, Route53, S3 backend) and Ansible roles with Jinja2 templates extracted from live configs, then import existing resources into state and iterate tofu plan to zero diffs. - Migration and rebuild workflows: Diagnose cross-VPC connectivity, migrate local MySQL to RDS, set up nginx reverse proxy with Let's Encrypt, and validate full destroy-and-rebuild cycles via SSM. - Use Case: You inherit an undocumented production EC2 instance. Use this Skill to inventory its software stack via SSM, export it to OpenTofu + Ansible, import the live resources into state, and verify tofu plan shows zero changes. ## Quick Start Analyze EC2 instance i-0123456789abcdef0 in region ap-southeast-1 using SSM and export it to OpenTofu and Ansible code.

Frequently Asked Questions about ec2-instance-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I inventory an EC2 instance without SSH access?▼

Use AWS Systems Manager send-command with the AWS-RunShellScript document to run inspection commands remotely. Send 3-4 parallel command batches covering OS release, running services, listening ports, and Docker containers, then collect output with get-command-invocation after a short wait.

How to export an existing EC2 instance to Terraform or OpenTofu?▼

Gather live data with describe-instances, describe-security-groups, and related AWS calls, then write OpenTofu resources referencing the existing VPC and subnet by ID. Import each resource with tofu import and iterate tofu plan -detailed-exitcode until it exits 0 with no changes.

Why does SSM send-command fail with shell syntax errors?▼

The SSM agent runs commands via /bin/sh and inline JSON parameters mangle nested quotes, pipes, and parentheses. Write the commands to a JSON parameter file and pass it with --parameters file://params.json so the AWS CLI reads it directly without shell interpretation.

Can Ansible connect to EC2 without an SSH key?▼

Yes, the amazon.aws.aws_ssm connection plugin runs Ansible over Systems Manager using the instance ID instead of SSH. It requires the session-manager-plugin binary locally, and on macOS you must set OBJC_DISABLE_INITIALIZE_FORK_SAFETY=YES to avoid worker crashes.

Why does tofu plan show diffs after importing existing AWS resources?▼

Common causes are AMI data sources picking a newer image, mismatched security group names, missing IAM tags, and provider default_tags that imported resources lack. Pin the AMI ID directly, match names and metadata_options to live values, and remove default_tags when importing.

What are the limitations of SSM-based instance analysis?▼

The instance must have the SSM agent online and an IAM role with AmazonSSMManagedInstanceCore. Commands run as the SSM user via /bin/sh, so local scripts are unavailable, complex quoting fails, and interactive or long-running commands need polling with get-command-invocation.

Related Skills

Explore More Software Engineering Skills→
david-2814david-2814
3

ssm

Automate AWS Systems Manager fleet operations across EC2 instances.

Community
Advanced
drewid74drewid74
8

infrastructure-as-code

Automates Terraform/OpenTofu planning and Ansible-driven host configuration with safe change controls.

Community
Advanced
dgethingsdgethings

aws-security-audit

Inspect IAM users, roles, policies, and CloudTrail events across AWS accounts.

Community
Advanced
zb-sszb-ss
1

Epic Orchestration Instructions

Orchestrate multi-component software workflows with isolated git worktrees and dependency-ordered merging.

Official
Advanced