ansible-maven sandbox

Terraform + Ansible to provision and configure an AWS EC2 instance that mirrors the setup-sandbox workshop environment (Vault CLI, JDK 23, Maven 3, Helm, kubectl, k3s, PostgreSQL, and the workshop-vault-agent-devs repo running under Docker Compose).

Access is provided via Doormat Session using the AWS SSM Agent — no bastion or open inbound ports required.

Prerequisites

Tool	Purpose
Terraform >= 1.15	Provision EC2 infrastructure
Ansible >= 2.14	Configure the EC2 instance

Terraform

Provision the instance

cd terraform
terraform init
terraform apply

The default region is us-east-2.

The configuration creates the ansible/inventory.ini and sandbox.pem files dynamically.

Destroy the instance

terraform destroy

Ansible

Configure the inventory

Set the AWS region to match your deployment:

export AWS_DEFAULT_REGION=us-east-2

Run the playbook

cd ansible
ansible-playbook -i inventory.ini playbook.yml

The playbook will:

1. Verify the SSM Agent is running
2. Install base packages (jq, postgresql-client, unzip, docker.io, etc.)
3. Install kubectl (latest stable)
4. Install Helm 3.17.3
5. Install Vault CLI 1.21.4
6. Install Oracle JDK 23.0.2
7. Install Apache Maven 3.9.16 (added to system-wide PATH)
8. Clone workshop-vault-agent-devs and start the Docker Compose services

Version pins live in ansible/vars.yml.

SSM Agent / Doormat Session notes

• Ubuntu 24.04 EC2 images from Canonical ship snapd and auto-install amazon-ssm-agent via cloud-init on first boot.
• The IAM instance profile created by Terraform attaches two policies:
  • AmazonSSMManagedInstanceCore — allows SSM Agent to register and communicate
  • SecurityComputeAccess — required for Doormat Session access
• The instance has no inbound security group rules. All Doormat connectivity is outbound on port 443.
• Access is unrestricted to all users with session group access to the AWS account. To restrict to specific Google groups, tag the instance with hc-doormat-restrict.