☁️Module 09 — Dynamic Inventory & Cloud

Wrong filename:

@all:
  |--@ungrouped:

Correct filename:

@all:
  |--@aws_ec2:
  |  |--10.0.1.15
  |  |--10.0.1.22
  |  |--10.0.2.8
  |--@ungrouped:

And the reason, only visible at -vvvv:

auto declined parsing /home/zaeem/lab/inventory/wrongname.yml as it did not pass its verify_file() method

An empty inventory is not an error to Ansible. "No hosts matched" is a legitimate outcome, so the run exits successfully having done nothing at all. In CI that is a green pipeline that patched zero servers.

The diagnostic worth memorising: when a dynamic inventory returns nothing, run -vvvv and grep for declined. It tells you which plugin refused the file and why, and nine times out of ten the answer is the filename.

Build the habit: always ansible-inventory --graph after touching an inventory config, before running any playbook against it. It costs nothing and it is the only thing standing between you and a silent no-op.

It is a hand-maintained cache of reality that nothing invalidates. The moment autoscaling, spot instances or console-created resources exist, the file is wrong and nobody is notified.

Both failure modes are bad: missing hosts go silently unpatched and unmonitored, and stale entries produce unreachable errors on every run until people learn to ignore red output — which is how a genuinely down production host gets overlooked.

Dynamic inventory makes the host list a query against the source of truth, evaluated at run time.

Plugin. It is a YAML config declaring plugin: and its options, runs in-process, and gets caching, keyed_groups, compose and constructed for free.

Scripts are the legacy mechanism — any executable printing inventory JSON for --list. Still supported and still common in older repositories, but every feature had to be reimplemented inside each script, which is why plugins replaced them. Modernising one typically replaces several hundred lines of Python with about fifteen lines of YAML.

The filename first — it must end in aws_ec2.yml or aws_ec2.yaml, or the plugin silently declines the file and you get an empty inventory with no error.

Then -vvvv and grep for declined, which names the plugin that refused it and why. Then credentials, then region, then whether the filters match anything.

The dangerous part is that an empty inventory is a successful run — in CI, a green pipeline that configured nothing.

@all:
  |--@aws_ec2:
  |  |--web01
  |  |--web02
  |  |--db01
  |--@az_ap_southeast_1a:
  |  |--web01
  |  |--db01
  |--@az_ap_southeast_1b:
  |  |--web02
  |--@env_production:
  |  |--web01
  |  |--web02
  |  |--db01
  |--@role_db:
  |  |--db01
  |--@role_web:
  |  |--web01
  |  |--web02
  |--@type_t3_medium:
  |  |--web01
  |  |--web02
  |--@ungrouped:

{
    "ansible_host": "10.0.1.15",
    "app_tier": "web",
    "ec2_instance_id": "i-0abc123def456",
    "instance_type": "t3.medium",
    "placement": {"availability_zone": "ap-southeast-1a"},
    "private_ip_address": "10.0.1.15",
    "tags": {"Environment": "production", "Name": "web01", "Role": "web"}
}

Read three things out of this.

1. The group names are sanitised — az_ap_southeast_1a, not az_ap-southeast-1a, and type_t3_medium from t3.medium. Writing hosts: type_t3.medium in a playbook would match nothing. Never guess these; read them from --graph.
2. ansible_host is 10.0.1.15 while the inventory name is web01. That is hostnames and compose doing their separate jobs — readable output, correct connection target.
3. Every EC2 attribute is available as a host variable, so instance_type, tags, placement and the rest are usable in when: conditions and templates directly. A playbook can branch on when: instance_type.startswith('m5') with no extra work.

--host <name> is the fastest way to answer "why did this host get that value?" and it makes no connection to the host at all.

It generates Ansible groups from instance attributes or tags — tags.Role=web becomes a group role_web with a prefix.

It matters because hosts: role_web then stays correct as an autoscaling group grows and shrinks, with nobody editing an inventory file. The tag becomes the contract between whoever provisions infrastructure and whoever automates it.

The organisational consequence worth naming: your tagging discipline becomes your inventory, and an untagged instance is an unmanaged one.

hostnames sets the inventory label — what shows in output and what inventory_hostname returns. ansible_host, usually set through compose, is the address Ansible connects to.

So hostnames: [tag:Name] with compose: {ansible_host: private_ip_address} gives readable output naming web01 while connecting to 10.0.1.15. Omit the compose line and Ansible tries to DNS-resolve web01 and fails.

Through the standard boto3 chain — environment variables, a named profile, or best, an IAM role attached to the control node, or OIDC federation in CI.

Never aws_access_key in the inventory file, since that commits credentials to Git.

The policy should be read-only: ec2:DescribeInstances, ec2:DescribeTags, ec2:DescribeRegions. An inventory has no reason to hold write permissions.

The cloud API call is slow and rate-limited — with thousands of instances DescribeInstances paginates and adds seconds to every ad-hoc command, not just playbook runs.

The cost is staleness: a newly launched instance does not appear until the cache expires. So --flush-cache belongs in any run that must catch new hosts, and the timeout should reflect how fast your estate actually changes.

Note this is separate from fact caching — inventory caching stores which hosts exist, fact caching stores what they are.

Group names are sanitised — hyphens, dots and spaces become underscores. A tag value of web-tier produces the group role_web_tier, and ap-southeast-1a becomes ap_southeast_1a.

Always read the real names from ansible-inventory --graph rather than assuming what the sanitiser produced.

First run, no cached facts:

@all:
  |--@aws_ec2:
  |  |--web01
  |  |--web02
  |  |--i-0f9e8d7c6b5a4
  |--@role_web:
  |  |--web01
  |  |--web02
  |--@role_untagged:
  |  |--i-0f9e8d7c6b5a4
  |--@needs_attention:
  |  |--i-0f9e8d7c6b5a4
  |--@ungrouped:

Note there are no os_* groups — constructed needed ansible_facts and none were cached. Enable fact caching, run a playbook once, then re-run --graph and os_Ubuntu appears.

Two genuinely useful things happened here.

default_value: untagged caught an instance with no Role tag and put it in role_untagged. Without it, that instance would be in no role group at all and would silently miss every hosts: role_* play — invisible drift.

The needs_attention group turns that into a report. ansible -i inventory/ needs_attention --list-hosts is now a one-command audit of "which instances are not tagged properly", which you can run in CI and fail the build on.

Notice also the untagged instance is named i-0f9e8d7c6b5a4 — the hostnames fallback to instance ID, because it had no Name tag either. Untagged infrastructure is visible and ugly by design, which is the point.

It creates groups and variables from facts and existing variables, rather than from cloud API data — so you can group by OS, memory size, service manager, or any computed expression.

Its prerequisite is fact caching, because inventory is built before facts are gathered. Without a cache the constructed groups are empty on a first run, which is ordering rather than a bug.

Parse order matters too: name the file so it is read after the sources whose hosts it groups.

Multiple inventory sources — repeat -i, or point -i at a directory where every file is parsed. A dynamic aws_ec2.yml alongside a static onprem.yml, optionally with a constructed.yml unifying them into common groups.

Use numeric filename prefixes to control parse order, and keep group_vars/host_vars adjacent so the Module 06 layout still applies.

Terraform owns resource lifecycle and holds state; Ansible owns configuration and holds none.

Keep them decoupled: Terraform applies tags, and Ansible discovers hosts by tag through dynamic inventory. Either can then run independently — reconfiguring does not touch infrastructure and vice versa.

Avoid local-exec provisioners calling ansible-playbook: Terraform then owns a step it cannot observe, retry or roll back, and a failed provisioner taints the resource.

It catches instances missing that tag and puts them in a named group instead of leaving them in none.

Without it, an untagged instance belongs to no role_* group and silently misses every play targeting one — invisible drift. With it, you can build a needs_attention group and turn "which instances are tagged wrongly?" into a single command you run in CI.

# inventory/01-production.aws_ec2.yml     -- requirement 1
---
plugin: amazon.aws.aws_ec2
regions:
  - ap-southeast-1
  - ap-southeast-2
filters:
  instance-state-name: running
  tag:Environment: production

hostnames:                                # requirement 2 - the LABEL
  - tag:Name
  - private-ip-address

compose:                                  # requirement 2 - the ADDRESS
  ansible_host: private_ip_address
  ec2_id: instance_id

keyed_groups:                             # requirement 3
  - key: tags.Role
    prefix: role
    default_value: untagged               # requirement 4
  - key: tags.Environment
    prefix: env
  - key: placement.availability_zone
    prefix: az

strict: false
cache: true
cache_plugin: jsonfile
cache_connection: /tmp/aws_inv_cache
cache_timeout: 900

# inventory/02-onprem.yml                 -- requirement 5
---
all:
  children:
    onprem:
      hosts:
        legacy01:
          ansible_host: 192.168.10.11
        legacy02:
          ansible_host: 192.168.10.12
      vars:
        ansible_user: sysadmin

# inventory/03-constructed.yml            -- requirements 4, 6
---
plugin: constructed
strict: false

keyed_groups:
  - key: ansible_facts['distribution']    # requirement 6
    prefix: os

groups:
  needs_attention: "'role_untagged' in group_names"   # requirement 4

# ansible.cfg
[inventory]
enable_plugins = auto, yaml, ini, amazon.aws.aws_ec2, constructed
cache = True
cache_plugin = jsonfile
cache_connection = /tmp/ansible_inventory_cache
cache_timeout = 900

[defaults]
inventory        = ./inventory
gathering        = smart                  # requirement 6 - constructed needs cached facts
fact_caching     = jsonfile
fact_caching_connection = /tmp/ansible_facts
fact_caching_timeout    = 7200

# Requirement 7 - the CI audit
ansible -i inventory/ needs_attention --list-hosts

The seven decisions:

1. filters: instance-state-name: running — requirement 1. Without it, terminated and stopped instances appear and every run reports unreachable errors, which trains people to ignore red output.
2. hostnames and compose: ansible_host are separate — requirement 2. Label versus address. Omit the compose line and Ansible tries to DNS-resolve web01.
3. default_value: untagged — requirement 4, and the pivot of the whole answer. It converts an invisible gap into a named group.
4. needs_attention in constructed, not in the AWS plugin — because it is derived from group membership, which only exists after the cloud source has been parsed. Hence the 03- prefix.
5. Numeric filename prefixes — parse order. constructed must come last.
6. gathering = smart plus fact caching — requirement 6. os_* groups need facts, and inventory is built before facts are gathered, so they come from the cache. On a genuinely first run they will be absent, and that is correct behaviour rather than a bug.
7. inventory = ./inventory as a directory — every file parsed, plus adjacent group_vars/host_vars.

Verify:

ansible-inventory --graph
ansible-inventory --graph --vars | head -40
ansible-inventory --host web01
ansible role_web --list-hosts
ansible needs_attention --list-hosts          # empty output = well-tagged estate
ansible-inventory --graph --flush-cache       # bypass the cache

And the CI gate:

if [ "$(ansible -i inventory/ needs_attention --list-hosts | tail -n +2 | tr -d ' ')" ]; then
  echo "FAIL: untagged instances found"; exit 1
fi

It is a hand-maintained cache of reality that nothing invalidates.

Missing hosts go silently unpatched and unmonitored. Stale entries produce unreachable errors on every run until people learn to ignore red output — which is how a genuinely down host gets missed. Both are bad; the first is silent, the second corrodes trust in your output.

The filename — must end aws_ec2.yml/aws_ec2.yaml, or the plugin declines it silently. Then -vvvv | grep declined to see which plugin refused it and why. Then credentials with aws sts get-caller-identity, region, and whether the filters match anything.

An empty inventory is a successful run, which in CI is a green pipeline that configured nothing.

It turns instance attributes and tags into Ansible groups — tags.Role=web becomes role_web — so hosts: role_web stays correct as an autoscaling group changes size, with nobody editing a file.

The consequence: your tagging discipline becomes your inventory. An untagged instance is an unmanaged one, and the tag becomes the contract between whoever provisions and whoever automates.

hostnames sets the inventory label shown in output and returned by inventory_hostname. ansible_host, set via compose, is the address Ansible connects to.

Readable output naming web01 while connecting to 10.0.1.15. Without the compose line, Ansible tries to DNS-resolve web01.

Group names are sanitised — dots, hyphens and spaces become underscores. t3.medium produces type_t3_medium, and ap-southeast-1a produces az_ap_southeast_1a.

Read the real names from ansible-inventory --graph rather than assuming.

Instances missing that tag land in a named group instead of none at all. Without it they belong to no role_* group and silently miss every play targeting one — invisible drift.

With it, you can build a needs_attention group and turn tagging compliance into a single command that fails a CI build.

It builds groups and variables from facts and existing variables rather than cloud API data.

Its groups are empty when there are no cached facts, because inventory is built before facts are gathered. It therefore requires fact caching, and on a genuinely first run against new hosts the groups will be absent — ordering, not a bug.

Repeat -i, or point -i at a directory where every file is parsed. Numeric prefixes control parse order, which matters because constructed must run after the sources whose hosts it groups.

Pointing at the directory also loads the adjacent group_vars and host_vars.

Inventory caching stores which hosts exist; fact caching stores what those hosts are. They are configured separately.

Inventory caching matters because DescribeInstances is slow and rate-limited on every ad-hoc command. Both trade freshness for speed, and both need --flush-cache when correctness matters more.

Terraform owns resource lifecycle and holds state; Ansible owns configuration and holds none. Keep them decoupled: Terraform applies tags, Ansible discovers by tag through dynamic inventory, so either can run independently.

Avoid local-exec calling ansible-playbook — Terraform then owns a step it cannot observe, retry or roll back, and a failed provisioner taints the resource.

The standard boto3 chain — ideally an IAM role on the control node, or OIDC federation in CI, or a named profile locally. Never keys in the inventory file.

Read-only permissions: ec2:DescribeInstances, ec2:DescribeTags, ec2:DescribeRegions. An inventory has no reason to hold write access.

Behaviour verified against the current dynamic inventory guide and the amazon.aws.aws_ec2 inventory plugin documentation.

Question selection cross-referenced against publicly published 2026 Ansible interview question sets:

• Spacelift — 50+ Top Ansible Interview Questions & Answers for 2026
• GeeksforGeeks — Top 50+ Ansible Interview Questions and Answers
• Vinsys — Top 30 Ansible Interview Questions and Answers 2026
• K21 Academy — Ansible Interview Questions & Answers 2026
• Hirist — Top 25+ Ansible Interview Questions and Answers 2026

Answers were rewritten and deepened rather than reproduced — published versions are usually correct but shallow, and the added operational detail is what differentiates a candidate in the room.