Remove code we no longer use.

playbooks/edx-east/edx_service.yml

-# Usage: ansible-playbook -i localhost, edx_service.yml -e@<PATH TO>/edx-secure/cloud_migrations/edx_service.yml -e@<PATH TO>/<DEPLOYMENT>-secure/cloud_migrations/vpcs/<ENVIRONMENT>-<DEPLOYMENT>.yml -e@<PATH TO>/edx-secure/cloud_migrations/idas/<CLUSTER>.yml
----
-
-- name: Build application artifacts
-  hosts: all
-  connection: local
-  gather_facts: False
-  vars:
-    state: "present"
-  tasks:
-    - name: Manage IAM Role and Profile
-      ec2_iam_role:
-        profile: "{{ profile }}"
-        state: "{{ state }}"
-        instance_profile_name: "{{ instance_profile_name }}"
-        role_name: "{{ role_name }}"
-        policies: "{{ role_policies }}"
-      tags:
-      - iam
-
-    - name: Manage ELB security group
-      ec2_group_local:
-        profile: "{{ profile }}"
-        description: "{{ elb_security_group.description }}"
-        name: "{{ elb_security_group.name }}"
-        vpc_id: "{{ vpc_id }}"
-        region: "{{ aws_region }}"
-        rules: "{{ elb_security_group.rules }}"
-        tags: "{{ elb_security_group.tags }}"
-      register: elb_sec_group
-      when: elbs is defined
-      tags:
-        - elb
-
-    - name: Set Base Security Rules
-      set_fact: 
-        service_security_group_rules: "{{ service_security_group.rules }}"
-      when: service_port is not defined
-
-    - name: Merge Base and Service Port Security Rules
-      set_fact: 
-        service_security_group_rules: "{{ service_security_group.rules + service_port_rules }}"
-      when: service_port is defined
-
-    - name: Manage service security group
-      ec2_group_local:
-        profile: "{{ profile }}"
-        description: "{{ service_security_group.description }}"
-        name: "{{ service_security_group.name }}"
-        vpc_id: "{{ vpc_id }}"
-        region: "{{ aws_region }}"
-        rules: "{{ service_security_group_rules }}"
-        tags: "{{ service_security_group.tags }}"
-      register: service_sec_group
-
-    - name: Set public Base ACLs
-      set_fact: 
-        service_public_acl_rules: "{{ public_acls.rules }}"
-      when: service_port is not defined
-
-    - name: Merge public Base and Service Port ACLs
-      set_fact: 
-        service_public_acl_rules: "{{ public_acls.rules + service_port_public_acls }}"
-      when: service_port is defined
-
-    - name: Manage Public ACLs
-      ec2_acl:
-        profile: "{{ profile }}"
-        name: "{{ public_acls.name }}"
-        vpc_id: "{{ vpc_id }}"
-        state: "{{ state }}"
-        region: "{{ aws_region }}"
-        rules: "{{ service_public_acl_rules }}"
-      register: created_public_acls
-
-    - name: Set private Base ACLs
-      set_fact: 
-        service_private_acl_rules: "{{ private_acls.rules }}"
-      when: service_port is not defined
-
-    - name: Merge private Base and Service Port ACLs
-      set_fact: 
-        service_private_acl_rules: "{{ private_acls.rules + service_port_private_acls }}"
-      when: service_port is defined
-
-    - name: Manage Private ACLs
-      ec2_acl:
-        profile: "{{ profile }}"
-        name: "{{ private_acls.name }}"
-        vpc_id: "{{ vpc_id }}"
-        state: "{{ state }}"
-        region: "{{ aws_region }}"
-        rules: "{{ service_private_acl_rules }}"
-      register: created_private_acls
-
-    - name: Merge created ACLs
-      set_fact: 
-        created_acls: "{{ created_public_acls.results | default([]) + created_private_acls.results | default([]) }}"
-
-    - name: Apply function to acl_data
-      util_map:
-        function: 'zip_to_dict'
-        input: "{{ created_acls }}"
-        args:
-          - "name"
-          - "id"
-      register: acl_data
-         
-    - name: Manage Service Subnets
-      ec2_subnet:
-        profile: "{{ profile }}"
-        state: "{{ state }}"
-        region: "{{ aws_region }}"
-        name: "{{ item.name }}"
-        vpc_id: "{{ vpc_id }}"
-        cidr_block: "{{ item.cidr }}"
-        az: "{{ item.az }}"
-        route_table_id: "{{ item.route_table_id }}"
-        tags: "{{ item.tags }}"
-      register: created_service_subnets
-      with_items: service_subnets
-
-    #
-    # Stubbed out
-    # For now we'll be using an existing route table
-    #
-    # - name: Manage Route Table
-    #   ec2_rt:
-    #     state: "{{ state }}"
-    #     region: "{{ aws_region }}"
-    #     name: "{{ rt.name }}"
-    #     vpc_id: "{{ vpc_id }}"
-    #     destination_cidr: "{{ rt.destination_cidr }}"
-    #     target: "local" # simplifying generalization of instnace-id, gateway-id or local
-    #
-    - name: Manage Private ELB Subnets
-      ec2_subnet:
-        profile: "{{ profile }}"
-        state: "{{ state }}"
-        region: "{{ aws_region }}"
-        name: "{{ item.name }}"
-        vpc_id: "{{ vpc_id }}"
-        cidr_block: "{{ item.cidr }}"
-        az: "{{ item.az }}"
-        route_table_id: "{{ item.route_table_id }}"
-        tags: "{{ item.tags }}"
-      register: created_elb_private_subnets
-      with_items: elb_private_subnets
-      when: private_elb_subnet_1 is defined and private_elb_subnet_2 is defined
-      tags:
-        - elb
-
-    - name: Check that internal ELBs have subnets
-      fail: msg="If you set an elb scheme to 'internal' you must also define private_elb_subnet_1 and private_elb_subnet_2"
-      when: private_elb_subnet_1 is not defined and private_elb_subnet_2 is not defined and elbs is defined and 'internal' in elbs|map(attribute='scheme')|list
-
-    - name: Manage ELB
-      ec2_elb_lb:
-        profile: "{{ profile }}"
-        region: "{{ aws_region }}"
-        scheme: "{{ item.scheme }}"
-        name: "{{ item.name}}"
-        state: "{{ state }}"
-        security_group_ids: "{{ elb_sec_group.group_id }}"
-        subnets: "{{ created_elb_private_subnets.results|map(attribute='subnet_id')| list if ( item.scheme == 'internal' ) else elb_subnets}}"
-        health_check: "{{ elb_healthcheck }}"
-        listeners: "{{ elb_listeners }}"
-        cross_az_load_balancing: "{{ elb_enable_cross_zone_loadbalancing }}"
-        connection_draining_timeout: "{{ elb_draining_timeout }}"
-      register: created_elbs
-      with_items: elbs
-      when: elbs is defined
-      tags:
-        - elb
-
-    - name: Setup ELB DNS
-      route53:
-        profile: "{{ profile }}"
-        command: "create"
-        zone: "{{ dns_zone_name }}"
-        record: "{{ item.elb.name }}.{{ dns_zone_name }}"
-        type: "A"
-        value: "{{ item.elb.dns_name }}"
-        alias: true
-        alias_hosted_zone_id: "{{ item.elb.hosted_zone_id }}"
-        overwrite: true
-      with_items: created_elbs.results
-      when: elbs is defined
-      tags:
-        - elb
-
-#
-# Service related components
-#
-    - name: Manage the launch configuration
-      ec2_lc:
-        profile: "{{ profile }}"
-        region: "{{ aws_region }}"
-        name: "{{ service_config.name }}"
-        image_id: "{{ service_config.ami }}"
-        key_name: "{{ service_config.key_name }}"
-        security_groups: "{{ service_sec_group.group_id }}"
-        instance_type: "{{ service_config.instance_type }}"
-        instance_profile_name: "{{ instance_profile_name }}"
-        volumes: "{{ service_config.volumes }}"
-        instance_monitoring: "{{ service_config.detailed_monitoring }}"
-      when: auto_scaling_service
-
-      #
-      # Hack alert, this registers a string in the global namespace
-      # of just the subnet ids for the service that were created above
-      #
-    - debug: msg="{{ created_service_subnets.results|map(attribute='subnet_id')| list | join(',') }}"
-      register: service_vpc_zone_identifier_string
-
-    - name: Transform tags into list dict format for the modules that expect it
-      util_map:
-        function: zip_to_listdict
-        input: "{{ asg_instance_tags }}"
-        args: ['key', 'value']
-      register: listdict_asg_instance_tags
-
-    - debug: msg="Instance Tags:{{ listdict_asg_instance_tags }}"
-
-    - name: Manage ASG
-      ec2_asg:
-        profile: "{{ profile }}"
-        region: "{{ aws_region }}"
-        name: "{{ asg_name }}"
-        launch_config_name: "{{ service_config.name }}"
-        availability_zones: "{{ aws_availability_zones }}"
-        min_size: "{{ asg_min_size }}"
-        max_size: "{{ asg_max_size }}"
-        desired_capacity: "{{ asg_desired_capacity }}"
-        vpc_zone_identifier: "{{ service_vpc_zone_identifier_string.msg }}"
-        tags: "{{ listdict_asg_instance_tags.function_output }}"
-        load_balancers: "{% if elb is defined %}{{ created_elbs.results|map(attribute='elb.name')|list }}{% else %}[]{% endif %}"
-      register: asg
-      when: auto_scaling_service
-
-    - name: Manage scaling policies
-      ec2_scaling_policy:
-        state: "{{ item.state }}"
-        profile: "{{ item.profile }}"
-        region: "{{ item.region }}"
-        name: "{{ item.name }}"
-        adjustment_type: "{{ item.adjustment_type }}"
-        asg_name: "{{ item.asg_name }}"
-        scaling_adjustment: "{{ item.scaling_adjustment }}"
-        min_adjustment_step: "{{ item.min_adjustment_step }}"
-        cooldown: "{{ item.cooldown }}"
-      with_items: scaling_policies
-      register: created_policies
-      when: auto_scaling_service
-
-    - name: Apply function to policy data
-      util_map:
-        function: 'zip_to_dict'
-        input: "{{ created_policies.results }}"
-        args:
-          - "name"
-          - "arn"
-      register: policy_data
-      when: auto_scaling_service
-
-    - name: Manage metric alarms
-      ec2_metric_alarm:
-        profile: "{{ profile }}"
-        state: "{{ item.state }}"
-        region: "{{ aws_region }}"
-        name: "{{ item.name }}"
-        metric: "{{ item.metric }}"
-        namespace: "{{ item.namespace }}"
-        statistic: "{{ item.statistic }}"
-        comparison: "{{ item.comparison }}"
-        threshold: "{{ item.threshold }}"
-        period: "{{ item.period }}"
-        evaluation_periods: "{{ item.evaluation_periods }}"
-        unit: "{{ item.unit }}"
-        description: "{{ item.description }}"
-        dimensions: "{{ item.dimensions }}"
-        alarm_actions: "{{ policy_data.function_output[item.target_policy] }}"
-      with_items: metric_alarms 
-      when: auto_scaling_service
-
-    - name: Transform tags into dict format for the modules that expect it
-      util_map:
-        function: zip_to_dict
-        input: "{{ asg_instance_tags }}"
-        args: ['key', 'value']
-      register: reformatted_asg_instance_tags
-
-    - name: See if instances already exist
-      ec2_lookup:
-        region: "{{ aws_region }}"
-        tags: "{{ reformatted_asg_instance_tags.function_output }}"
-      register: potential_existing_instances
-
-    - name: Compare requested instances vs. current instances
-      when: not auto_scaling_service and (potential_existing_instances.instances|length > create_instances | int)
-      fail: msg="This playbook will not shrink the number of instances. {{create_instances }} requested. There are currently {{ potential_existing_instances.instances|length }} instances that match this tag." 
-
-    #This task will create the number of instances requested (create_instances parameter). 
-    # By default, it will create instances equaling the number of subnets specified.
-    #Modulo logic explained: The subnet specified will be the instance number modulo the number of subnets, 
-    # so that instances are balanced across subnets.
-    - name: Manage instances
-      ec2:
-        profile: "{{ profile }}"
-        region: "{{ aws_region }}"
-        wait: "yes"
-        group_id:
-          - "{{ service_sec_group.group_id }}"
-        key_name: "{{ service_config.key_name }}"
-        vpc_subnet_id: "{{ created_service_subnets.results[item | int % created_service_subnets.results | length].subnet_id }}"
-        instance_type: "{{ service_config.instance_type }}"
-        instance_tags: "{{ reformatted_asg_instance_tags.function_output }}"
-        image: "{{ service_config.ami }}"
-        instance_profile_name: "{{ instance_profile_name }}"
-        volumes: "{{ service_config.volumes }}"
-        ebs_optimized: "{{ service_config.ebs_optimized }}"
-        monitoring: "{{ detailed_monitoring }}"
-      with_sequence: count={% if not auto_scaling_service %}{{ (create_instances | int - potential_existing_instances.instances|length) | default(created_service_subnets.results | length) }}{% else %}0{% endif %}
-      when: not auto_scaling_service and (potential_existing_instances.instances|length < create_instances | int)
-      register: created_instances
-
-
-    - name: Add new instances to host group
-      add_host:
-        hostname: "{{ item.1.private_ip }}"
-        instance_id: "{{ item.1.id }}"
-        groups: created_instances_group
-        #might need ansible_ssh_private_key_file and/or ansible_ssh_user
-        ansible_ssh_user: ubuntu
-        volumes: "{{ service_config.volumes }}"
-      with_subelements:
-        - created_instances.results | default({})
-        - instances
-
-
-- name: Configure launched instances
-  hosts: created_instances_group
-  gather_facts: False
-  become: True
-  tasks:
-    #Wait in this play so it can multiplex across all launched hosts
-    - name: Wait for hosts to be ready
-      become: False
-      local_action:
-        module: wait_for
-        host: "{{ inventory_hostname }}"
-        port: 22
-
-    #Must wait for the instance to be ready before gathering facts
-    - name: Gather facts
-      setup:
-
-    - name: Unmount all specified disks that are currently mounted
-      mount:
-        name: "{{ item[0].mount }}"
-        src: "{{ item[0].device }}"
-        fstype: "{{ item[0].fstype }}"
-        state: absent
-      when: item[1].device_name == item[0].device
-      with_nested:
-        - ansible_mounts
-        - volumes
-
-    #Must use force=yes because AWS gives some ephemeral disks the wrong fstype and mounts them by default.
-    #Since we don't do this task if any prior instances were found in the ec2_lookup task, it's safe to force.
-    - name: Create filesystems
-      filesystem:
-        dev: "{{ item.device_name }}"
-        fstype: ext4
-        force: yes
-      with_items: volumes
-
-    - name: Mount disks
-      mount:
-        fstype: ext4
-        name: "{{ item.mount }}"
-        src: "{{ item.device_name }}"
-        state: mounted
-        fstype: "{{ item.fstype | default('ext4') }}"
-        opts: "{{ item.options | default('defaults') }}"
-      with_items: volumes
-
-
-#Currently only supported in non-asg mode, when auto_scaling_service==false
-#<http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking.html#enable-enhanced-networking>
-#Done with local actions to avoid blocking on iteration
-- name: Enable enhanced networking
-  hosts: created_instances_group
-  gather_facts: False
-  tasks:
-    - name: Shut down instances
-      local_action:
-        module: ec2
-        instance_ids: "{{ instance_id }}"
-        state: stopped
-        region: "{{ aws_region }}"
-        wait: yes
-      when: enhanced_networking == true
-
-    - name: Set enhanced networking instance attribute
-      local_action:
-        module: shell aws --profile {{ profile }} ec2 modify-instance-attribute --instance-id {{ instance_id }} --sriov-net-support simple
-      when: enhanced_networking == true
-
-    - name: Start instances
-      local_action:
-        module: ec2
-        instance_ids: "{{ instance_id }}"
-        state: running
-        region: "{{ aws_region }}"
-        wait: yes
-      when: enhanced_networking == true

playbooks/edx-east/edx_service_rds.yml

----
-
-- name: Build service RDS instances
-  hosts: all
-  connection: local
-  # Needed for timestamps
-  gather_facts: True
-  roles:
-    - edx_service_rds  

playbooks/edx-east/edx_vpc.yml

----
-# Sample command: ansible-playbook -c local -i localhost, edx_vpc.yml -e@/Users/feanil/src/edx-secure/cloud_migrations/vpcs/test.yml -vvv
-- name: Create a simple empty vpc
-  hosts: all
-  connection: local
-  gather_facts: False
-  vars:
-    vpc_state: present
-  roles:
-    - edx_vpc

playbooks/roles/asqatasun/defaults/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-##
-# Defaults for role asqatasun
-#
-ASQATASUN_LOCALE: 'en_US.UTF-8'
-ASQATASUN_DATABASE_NAME: 'asqatasun'
-ASQATASUN_DATABASE_USER: 'asqatasun'
-ASQATASUN_DATABASE_PASSWORD: 'changeme'
-ASQATASUN_DATABASE_HOST: 'localhost'
-ASQATASUN_DATABASE_ENCODING: 'utf8'
-ASQATASUN_DATABASE_COLLATION: 'utf8_general_ci'
-ASQATASUN_URL: 'http://localhost:8080/asqatasun/'
-ASQATASUN_ADMIN_EMAIL: 'admin@example.com'
-ASQATASUN_ADMIN_PASSWORD: 'changeme'
-
-asqatasun_debian_pkgs:
-  - wget
-  - bzip2
-  - openjdk-7-jre
-  - unzip
-  - mysql-server
-  - libmysql-java
-  - python-mysqldb
-  - libtomcat7-java
-  - tomcat7 
-  - libspring-instrument-java
-  - xvfb
-  - libdbus-glib-1-2
-  - mailutils
-  - postfix
-
-locale: "{{ ASQATASUN_LOCALE }}"
-
-asqatasun_download_link: "http://download.asqatasun.org/asqatasun-latest.tar.gz"
-# Asqatasun version that you want to install, get the full list of releases 
-#by clicking in the release tab of the github main interface.
-asqatasun_version: "asqatasun-4.0.0-rc.1"
-
-# Go this link to find your desired ESR Firefox
-# For 32-bit architecture
-# http://download-origin.cdn.mozilla.net/pub/firefox/releases/31.4.0esr/linux-i686/
-# For 64-bit architecture
-# http://download-origin.cdn.mozilla.net/pub/firefox/releases/31.4.0esr/linux-x86_64/
-# Default is en-US in our example
-fixfox_esr_link: "http://download-origin.cdn.mozilla.net/pub/firefox/releases/31.4.0esr/linux-x86_64/en-US/firefox-31.4.0esr.tar.bz2"
-
-# MySQL variables for Asqatasun
-default_character_set: "utf8"
-collation_server: "utf8_general_ci"
-init_connect: "SET NAMES utf8"
-character_set_server: "utf8"
-mysql_max_allowed_packet: "64M"
-
-asqatasun_parameters:
-  db_name: "{{ ASQATASUN_DATABASE_NAME }}"
-  db_user: "{{ ASQATASUN_DATABASE_USER }}"
-  db_password: "{{ ASQATASUN_DATABASE_PASSWORD }}"
-  db_host: "{{ ASQATASUN_DATABASE_HOST }}"
-  db_encoding: "{{ ASQATASUN_DATABASE_ENCODING }}"
-  db_collation: "{{ ASQATASUN_DATABASE_COLLATION }}"
-  url: "{{ ASQATASUN_URL }}"
-  admin_email: "{{ ASQATASUN_ADMIN_EMAIL }}"
-  admin_passwd: "{{ ASQATASUN_ADMIN_PASSWORD }}"

playbooks/roles/asqatasun/tasks/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-# Tasks for role asqatasun
-#
-# Overview:
-#
-# Install the Asqatasun, an opensource web site analyzer, 
-# used for web accessibility (a11y) and Search Engine Optimization (SEO)
-#
-# ansible-playbook -i 'asqatasun.example.com,' ./asqatasun.yml  -e@/ansible/vars/deployment.yml -e@/ansible/vars/env-deployment.yml
-#
-- name: Set Postfix options
-  debconf: 
-    name: postifx 
-    question: "{{ item.question }}" 
-    value: "{{ item.value }} " 
-    vtype: "string"
-  with_items:
-    - { question: "postfix/mailname", value: " " }
-    - { question: "postfix/main_mailer_type", value: "Satellite system" }
-  tags:
-    - install
-    - install:configuration
-
-- name: Update locale Setting
-  locale_gen:
-    name: "{{ locale }}"
-    state: present
-  register: set_locale
-  tags:
-    - install
-    - install:base
-
-- name: Reconfigure locale
-  command: dpkg-reconfigure locales
-  when: set_locale.changed
-
-- name: Install the Asqatasun Prerequisites
-  apt: 
-    name: "{{ item }}" 
-    update_cache: yes 
-    state: installed
-  with_items: asqatasun_debian_pkgs
-  tags:
-    - install
-    - install:base
-
-- name: Copy the asqatasun.cnf template to /etc/mysql/conf.d
-  template:
-    dest: /etc/mysql/conf.d/asqatasun.cnf
-    src: etc/mysql/conf.d/asqatasun.cnf.j2
-    owner: root
-    group: root
-  when: "'{{ asqatasun_parameters.db_host }}' == 'localhost'"
-  register: my_cnf
-  tags:
-    - install
-    - install:configuration
-
-- name: Restart MySQL
-  service: 
-    name: mysql 
-    state: restarted
-  when: my_cnf.changed
-
-- name: Create a soft link for tomcat jar and mysql connector
-  file:
-    dest: "{{ item.dest }}"
-    src: "{{ item.src }}"
-    state: link
-  with_items:
-    - { src: '/usr/share/java/spring3-instrument-tomcat.jar', dest: '/usr/share/tomcat7/lib/spring3-instrument-tomcat.jar' }
-    - { src: '/usr/share/java/mysql-connector-java.jar', dest: '/usr/share/tomcat7/lib/mysql-connector-java.jar'}
-  tags:
-    - install
-    - install:configuration
-
-- name: Copy the xvfb template to /etc/init.d
-  template:
-    dest: /etc/init.d/xvfb
-    src: etc/init.d/xvfb.j2
-    owner: root
-    group: root
-    mode: 755
-  register: xvfb
-  tags:
-    - install
-    - install:config
-
-- name: Restart xvfb
-  service: 
-    name: xvfb 
-    pattern: /etc/init.d/xvfb 
-    state: restarted
-    enabled: yes
-  when: xvfb.changed
-  tags:
-    - install
-    - install:config
-
-- name: Download the latest ESR Firfox
-  get_url: 
-    url: "{{ fixfox_esr_link }}" 
-    dest: "/tmp/{{ fixfox_esr_link | basename }}"
-  tags:
-    - install
-    - install:base
-
-- name: Unzip the downloaded Firfox zipped file
-  unarchive: 
-    src: "/tmp/{{ fixfox_esr_link | basename }}" 
-    dest: /opt 
-    copy: no
-  tags:
-    - install
-    - install:base
-
-- name: Download the latest Asqatasun tarball
-  get_url: 
-    url: "{{ asqatasun_download_link }}" 
-    dest: "/tmp/{{ asqatasun_download_link | basename }}"
-  tags:
-    - install
-    - install:base
-
-- name: Unzip the downloaded Asqatasun tarball
-  unarchive: 
-    src: "/tmp/{{ asqatasun_download_link | basename }}" 
-    dest: "/tmp/" 
-    copy: no
-  tags:
-    - install
-    - install:base
-
-- name: Create MySQL database for Asqatasun
-  mysql_db: 
-    name: "{{ asqatasun_parameters.db_name }}"
-    state: present 
-    encoding: "{{ asqatasun_parameters.db_encoding }}"
-    collation: "{{ asqatasun_parameters.db_collation }}"
-  tags:
-    - migrate
-    - migrate:db
-
-- name: Create MySQL user for Asqatasun
-  mysql_user: 
-    name: "{{ asqatasun_parameters.db_user }}"
-    password: "{{ asqatasun_parameters.db_password }}"
-    host: "{{ asqatasun_parameters.db_host }}"  
-    priv: "{{ asqatasun_parameters.db_name }}.*:ALL"
-    state: present
-  tags:
-    - migrate
-    - migrate:db
-
-- name: Check that asqatasun app is running
-  shell: >
-    /bin/ps aux | grep -i asqatasun
-  register: asqatasun_app
-  changed_when: no
-  tags:
-    - install
-    - install:base
-
-- name: Install the Asqatasun
-  shell: >
-    /bin/echo "yes" | ./install.sh --database-user "{{ asqatasun_parameters.db_user }}" \
-    --database-passwd "{{ asqatasun_parameters.db_password }}" \
-    --database-db "{{ asqatasun_parameters.db_name }}" \ 
-    --database-host "{{ asqatasun_parameters.db_host }}" \ 
-    --asqatasun-url http://localhost:8080/asqatasun/ \
-    --tomcat-webapps /var/lib/tomcat7/webapps/ \
-    --tomcat-user tomcat7 \
-    --asqa-admin-email "{{ asqatasun_parameters.admin_email }}" \
-    --asqa-admin-passwd "{{ asqatasun_parameters.admin_passwd }}" \ 
-    --firefox-esr-binary-path /opt/firefox-esr/firefox 
-    --display-port ":99"
-  args:
-    chdir: "/tmp/{{ asqatasun_version }}.i386"
-  when: "asqatasun_app.stdout.find('/etc/asqatasun') == -1"
-  register: asqatasun_install
-  tags:
-    - install
-    - install:base
-
-- name: Restart tomcat7
-  service: 
-    name: tomcat7
-    state: restarted
-  when: asqatasun_install.changed
-

playbooks/roles/asqatasun/templates/etc/init.d/xvfb.j2

-#!/bin/sh
-### BEGIN INIT INFO
-# Provides:          xvfb
-# Required-Start:    $remote_fs $syslog
-# Required-Stop:     $remote_fs $syslog
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: XVFB - Virtual X server display
-# Description:       XVFB - Virtual X server display
-### END INIT INFO
-
-# Author: Matthieu Faure <mfaure@asqatasun.org>
-
-# Do NOT "set -e"
-# TODO: improve with help from /etc/init.d/skeleton
-
-RUN_AS_USER=tomcat7
-OPTS=":99 -screen 1 1024x768x24 -nolisten tcp"
-XVFB_DIR=/usr/bin
-PIDFILE=/var/run/xvfb
-
-case $1 in
-
-start)
-	start-stop-daemon --chuid $RUN_AS_USER -b --start --exec $XVFB_DIR/Xvfb --make-pidfile --pidfile $PIDFILE -- $OPTS &
-;;
-
-stop)
-	start-stop-daemon --stop --user $RUN_AS_USER --pidfile $PIDFILE
-	rm -f $PIDFILE
-;;
-
-restart)
-	if start-stop-daemon --test --stop --user $RUN_AS_USER --pidfile $PIDFILE >/dev/null; then
-		$0 stop
-	fi;
-	$0 start
-;;
-
-*)
-	echo "Usage: $0 (start|restart|stop)"
-	exit 1
-;;
-
-esac
-
-exit 0

playbooks/roles/asqatasun/templates/etc/mysql/conf.d/asqatasun.cnf.j2

-[client]
-default-character-set={{ default_character_set }}
-
-[mysql]
-default-character-set={{ default_character_set }}
-
-[mysqld]
-collation-server = {{ collation_server }}
-init-connect={{ "\'" + init_connect + "\'" }}
-character-set-server = {{ character_set_server }}
-max_allowed_packet = {{ mysql_max_allowed_packet }}

playbooks/roles/edx_service_rds/defaults/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-##
-# Defaults for role edx_service_rds
-# 
-
-#
-# vars are namespaced with the module name.
-#
-edx_service_rds_role_name: edx_service_rds
-
-E_D_C: "prod-sample-app"
-EDX_SERVICE_RDS_INSTANCE_SIZE: 10
-EDX_SERVICE_RDS_INSTANCE_TYPE: "db.m1.small"
-EDX_SERVICE_RDS_ROOT_USER: "root"
-# no unicode, c cedilla , passwords
-EDX_SERVICE_RDS_ROOT_PASSWORD: "plus_ca_change"
-EDX_SERVICE_RDS_ENGINE: "MySQL"
-EDX_SERVICE_RDS_ENGINE_VERSION: "5.6.22"
-EDX_SERVICE_RDS_PARAM_GROUP_ENGINE: "mysql5.6"
-# will vary depending upon engine, examples assume
-# MySQL 56
-EDX_SERVICE_RDS_PARAM_GROUP_PARAMS:
-  character_set_client: "utf8"
-  character_set_connection: "utf8"
-  character_set_database: "utf8"
-  character_set_filesystem: "utf8"
-  character_set_results: "utf8"
-  character_set_server: "utf8"
-  collation_connection: "utf8_unicode_ci"
-  collation_server: "utf8_unicode_ci"
-EDX_SERVICE_RDS_MULTI_AZ: No
-EDX_SERVICE_RDS_MAINT_WINDOW: "Mon:00:00-Mon:01:15"
-EDX_SERVICE_RDS_BACKUP_DAYS: 30
-EDX_SERVICE_RDS_BACKUP_WINDOW: "02:00-03:00"
-
-EDX_SERVICE_RDS_SUBNET_1_AZ: "us-east-1c"
-EDX_SERVICE_RDS_SUBNET_1_CIDR: "{{ vpc_class_b }}.50.0/24"
-EDX_SERVICE_RDS_SUBNET_2_AZ: "us-east-1d"
-EDX_SERVICE_RDS_SUBNET_2_CIDR: "{{ vpc_class_b }}.51.0/24"
-
-# The defaults are permissive, override
-EDX_SERVICE_RDS_SECURITY_GROUP:
-  name: "{{ e_d_c }}-rds-sg"
-  description: "RDS ingress and egress."
-  rules:
-    - proto: "tcp"
-      from_port: "3306"
-      to_port: "3306"
-      cidr_ip: "0.0.0.0/0"
-  rules_egress:
-    - proto: "tcp"
-      from_port: "3306"
-      to_port: "3306"
-      cidr_ip: "0.0.0.0/0"
-
-# The defaults are permissive, override
-EDX_SERVICE_RDS_VPC_DB_ACL:
-  name: "{{ e_d_c }}-db"
-  rules:
-    - number: "100"
-      type: "ingress"
-      protocol: "tcp"
-      from_port: 3306
-      to_port: 3306
-      cidr_block: "0.0.0.0/0"
-      rule_action: "allow"
-    - number: "100"
-      type: "egress"
-      protocol: "all"
-      from_port: 0
-      to_port: 65535
-      cidr_block: "0.0.0.0/0"
-      rule_action: "allow"
-
-EDX_SERVICE_RDS_VPC_DB_ROUTE_TABLE:
-  - cidr: "{{ vpc_class_b }}.0.0/16"
-    gateway: 'local'
-      
-# typically override the all caps vars, but may
-# be convenient to override the entire structure
-# if you spanning more than two subnets
-edx_service_rds_vpc_db_subnets:
-  - name: "{{ E_D_C }}-db-{{ EDX_SERVICE_RDS_SUBNET_1_AZ }}"
-    cidr: "{{ EDX_SERVICE_RDS_SUBNET_1_CIDR }}"
-    az: "{{ EDX_SERVICE_RDS_SUBNET_1_AZ }}"
-  - name: "{{ E_D_C }}-db-{{ EDX_SERVICE_RDS_SUBNET_2_AZ }}"
-    cidr: "{{ EDX_SERVICE_RDS_SUBNET_2_CIDR }}"
-    az: "{{ EDX_SERVICE_RDS_SUBNET_2_AZ }}"
-      
-edx_service_rds_state: "present"
-
-edx_service_rds_db:
-  state: "{{ edx_service_rds_state }}"
-  name: "{{ E_D_C }}-primary"
-  size: "{{ EDX_SERVICE_RDS_INSTANCE_SIZE }}"
-  instance_type: "{{ EDX_SERVICE_RDS_INSTANCE_TYPE }}"
-  root_user: "{{ EDX_SERVICE_RDS_ROOT_USER }}"
-  root_password: "{{ EDX_SERVICE_RDS_ROOT_PASSWORD }}"
-  engine: "{{ EDX_SERVICE_RDS_ENGINE }}"
-  engine_version: "{{ EDX_SERVICE_RDS_ENGINE_VERSION }}"
-  multi_az: "{{ EDX_SERVICE_RDS_MULTI_AZ }}"
-  maint_window: "{{ EDX_SERVICE_RDS_MAINT_WINDOW }}"
-  backup_days: "{{ EDX_SERVICE_RDS_BACKUP_DAYS }}"
-  backup_window: "{{ EDX_SERVICE_RDS_BACKUP_WINDOW }}"
-  param_group:
-    name: "{{ E_D_C}}"
-    engine: "{{ EDX_SERVICE_RDS_PARAM_GROUP_ENGINE }}"
-    params: "{{ EDX_SERVICE_RDS_PARAM_GROUP_PARAMS }}"
-      
-
-#
-# OS packages
-#
-
-edx_service_rds_debian_pkgs: []
-
-edx_service_rds_redhat_pkgs: []

playbooks/roles/edx_service_rds/tasks/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-#
-#
-# Tasks for role edx_service_rds
-# 
-# Overview:
-#
-# Creates a VPC RDS instance and related network infrastructure, e.g.,
-# subnets, subnet groups, acls, as well as an instance specific
-# parameter group.
-#
-# NB: When using a boto profile other than the default, you will need
-# to export AWS_PROFILE because some tasks do not properly process
-# the profile argument.
-#
-# NB: You should currently not use this play for deleting databases as
-# the final snapshot functionality doesn't work properly in the ansible
-# module.  First it default to not taking a final snapshot and
-# when you specify one, it throw a key error.
-#
-# Dependencies:
-#
-# Assumes a working VPC, ideally created via the edx_vpc role as this
-# role will produce configuration output that this role requires
-# like the VPC, route table and subnet IDs.
-# 
-# Example play:
-#
-# export AWS_PROFILE=sandbox
-# ansible-playbook -i 'localhost,' edx_service_rds.yml -e@/path/to/secure-repo/cloud_migrations/vpcs/vpc-file.yml -e@/path/to/secure-repo/cloud_migrations/dbs/e-d-c-rds.yml
-#
-# TODO:
-# - handle db deletes and updates
-# - handle DNS updates, consider that a different profile may be required for this.
-#
-
-- name: create database route table
-  ec2_rt:
-    profile: "{{ profile }}"
-    vpc_id: "{{ vpc_id }}"
-    region: "{{ aws_region }}"
-    state: "{{ edx_service_rds_state }}"
-    name: "{{ e_d_c }}-db"
-    routes: "{{ EDX_SERVICE_RDS_VPC_DB_ROUTE_TABLE }}"
-  register: created_db_rt
-
-- name: create db network acl
-  ec2_acl:
-    profile: "{{ profile }}"
-    name: "{{ EDX_SERVICE_RDS_VPC_DB_ACL.name }}"
-    vpc_id: "{{ vpc_id }}"
-    state: "{{ edx_service_rds_state }}"
-    region: "{{ aws_region }}"
-    rules: "{{ EDX_SERVICE_RDS_VPC_DB_ACL.rules }}"
-  register: created_db_acl
-
-- name: create db subnets
-  ec2_subnet:
-    profile: "{{ profile }}"
-    vpc_id: "{{ vpc_id }}"
-    region: "{{ aws_region }}"
-    state: "{{ edx_service_rds_state }}"
-    name: "{{ item.name }}"
-    cidr: "{{ item.cidr }}"
-    az: "{{ item.az }}"
-    route_table_id: "{{ created_db_rt.id }}"
-    network_acl_id: "{{ created_db_acl.id }}"
-  with_items: edx_service_rds_vpc_db_subnets
-  register: created_db_subnets
-
-- name: Apply function to subnet data
-  util_map:
-    function: 'zip_to_list'
-    input: "{{ created_db_subnets.results }}"
-    args:
-      - "subnet_id"
-  register: subnet_data
-
-- name:
-  rds_subnet_group:
-    state: "{{ edx_service_rds_state }}"
-    profile: "{{ profile }}"
-    region: "{{ aws_region }}"
-    name: "{{ e_d_c }}"
-    description: "{{ e_d_c }}"
-    subnets: "{{ subnet_data.function_output }}"
-
-- name: create RDS security group
-  ec2_group:
-    profile: "{{ profile }}"
-    vpc_id: "{{ vpc_id }}"
-    state: "{{ edx_service_rds_state }}"
-    region: "{{ aws_region }}"
-    name: "{{ EDX_SERVICE_RDS_SECURITY_GROUP.name }}"
-    rules: "{{ EDX_SERVICE_RDS_SECURITY_GROUP.rules }}"
-    description: "{{ EDX_SERVICE_RDS_SECURITY_GROUP.description }}"
-    rules_egress: "{{ EDX_SERVICE_RDS_SECURITY_GROUP.rules_egress }}"
-  register: created_rds_security_group
-
-- name: create instance parameter group
-  rds_param_group:
-    state: "{{ edx_service_rds_state }}"
-    region: "{{ aws_region }}"
-    name: "{{ edx_service_rds_db.param_group.name }}"
-    description: "{{ edx_service_rds_db.param_group.name }}"
-    engine: "{{ edx_service_rds_db.param_group.engine }}"
-    params: "{{ edx_service_rds_db.param_group.params }}"
-  register: created_param_group
-
-  #  
-  # Create the database
-  #
-- name: Create service database
-  rds:
-    command: "create"
-    region: "{{ aws_region }}"
-    instance_name: "{{ edx_service_rds_db.name }}"
-    db_engine: "{{ edx_service_rds_db.engine }}"
-    engine_version: "{{ edx_service_rds_db.engine_version }}"
-    size: "{{ edx_service_rds_db.size }}"
-    instance_type: "{{ edx_service_rds_db.instance_type }}"
-    username: "{{ edx_service_rds_db.root_user }}"
-    password: "{{ edx_service_rds_db.root_password }}"
-    subnet: "{{ e_d_c }}"
-    vpc_security_groups: "{{ created_rds_security_group.group_id }}"
-    multi_zone: "{{ edx_service_rds_db.multi_az }}"
-    maint_window: "{{ edx_service_rds_db.maint_window }}"
-    backup_window: "{{ edx_service_rds_db.backup_window }}"
-    backup_retention: "{{ edx_service_rds_db.backup_days }}"
-    parameter_group: "{{ edx_service_rds_db.param_group.name }}"
-    tags:
-      Environment: "{{ env }}"
-      Application: "{{ deployment }}"
-  when: edx_service_rds_db.state == 'present'
-  register: created_db
-
-  # 
-  # Delete the database, need to debug module for this to
-  # full work.
-  #
-- name: Delete service database
-  rds:
-    command: "delete"
-    region: "{{ aws_region }}"
-    instance_name: "{{ edx_service_rds_db.name }}"
-    # bug inthe module related to final snapshots
-    #snapshot: "{{ edx_service_rds_db.name }}-final-{{ ansible_date_time.epoch }}"
-    snapshot: "red-blue"
-  when: edx_service_rds_db.state == 'absent'

playbooks/roles/edx_vpc/defaults/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-##
-# Defaults for role edx_vpc
-# 
-
-#
-# vars are namespace with the module name.
-#
-vpc_role_name: vpc
-
-#
-# OS packages
-#
-
-vpc_debian_pkgs: []
-
-vpc_redhat_pkgs: []

playbooks/roles/edx_vpc/tasks/main.yml

----
-#
-# edX Configuration
-#
-# github:     https://github.com/edx/configuration
-# wiki:       https://openedx.atlassian.net/wiki/display/OpenOPS
-# code style: https://openedx.atlassian.net/wiki/display/OpenOPS/Ansible+Code+Conventions
-# license:    https://github.com/edx/configuration/blob/master/LICENSE.TXT
-#
-#
-#
-# Tasks for role edx_vpc
-# 
-# Overview:
-# This role creates an opinionated vpc for containing cluster of edx services.
-# 
-# It currently assumes that we will be multi-az, with a single NAT, and all
-# traffic going over that NAT.  A public subnet, and both public and private
-# route tables are created by default that can be used by new services in this
-# vpc.  The public subnet should house ELBs and any newly created private subnets
-# can use the existing private route table to be able to reach the internet from
-# private machines.
-# 
-#
-# Example play:
-#
-# ansible-playbook -c local -i localhost, edx_vpc.yml -e@/Users/feanil/src/edx-secure/cloud_migrations/vpcs/test.yml
-
-# DO NOT use the subnet or route table sections of this command.
-# They will delete any subnets or rts not defined here which is
-# probably not what you want, since other services were added
-# to the vpc whose subnets and rts are not enumerated here.
-- name: create a vpc
-  local_action:
-    profile: "{{ vpc_aws_profile }}"
-    module: "ec2_vpc_local"
-    resource_tags: "{{ vpc_tags }}"
-    cidr_block: "{{ vpc_cidr }}"
-    region: "{{ vpc_aws_region }}"
-    state: "{{ vpc_state }}"
-    internet_gateway: yes
-    wait: yes
-  register: created_vpc
-
-# A default network acl is created when a vpc is created so each VPC
-# should have one but we create one here that allows access to the
-# outside world using the internet gateway.
-- name: create public network acl
-  ec2_acl:
-    profile: "{{ vpc_aws_profile }}"
-    name: "{{ vpc_public_acl.name }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    state: "present"
-    region: "{{ vpc_aws_region }}"
-    rules: "{{ vpc_public_acl.rules }}"
-  register: created_public_acl
-
-- name: create public route table
-  ec2_rt:
-    profile: "{{ vpc_aws_profile }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    region: "{{ vpc_aws_region }}"
-    state: "present"
-    name: "{{ vpc_name }}-public"
-    routes: "{{ vpc_public_route_table }}"
-  register: created_public_rt
-
-- name: create public subnets
-  ec2_subnet:
-    profile: "{{ vpc_aws_profile }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    region: "{{ vpc_aws_region }}"
-    state: "present"
-    name: "{{ item.name }}"
-    cidr: "{{ item.cidr }}"
-    az: "{{ item.az }}"
-    route_table_id: "{{ created_public_rt.id }}"
-    network_acl_id: "{{ created_public_acl.id }}"
-  with_items: vpc_public_subnets
-  register: created_public_subnets
-
-- name: create NAT security group
-  ec2_group:
-    profile: "{{ vpc_aws_profile }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    state: "present"
-    region: "{{ vpc_aws_region }}"
-    name: "{{ nat_security_group.name }}"
-    rules: "{{ nat_security_group.rules }}"
-    description: "{{ nat_security_group.description }}"
-    rules_egress: "{{ nat_security_group.rules_egress }}"
-  register: created_nat_security_group
-
-- name: check to see if we already have a nat instance
-  local_action:
-    module: "ec2_lookup"
-    region: "{{ vpc_aws_region }}"
-    tags:
-      - Name: "{{ vpc_name }}-nat-instance"
-  register: nat_instance
-
-- name: create nat instance
-  local_action:
-    module: "ec2"
-    state: "present"
-    wait: yes
-    source_dest_check: false
-    region: "{{ vpc_aws_region }}"
-    profile: "{{ vpc_aws_profile }}"
-    group_id: "{{ created_nat_security_group.group_id }}"
-    key_name: "{{ vpc_keypair }}"
-    vpc_subnet_id: "{{ created_public_subnets.results[0].subnet_id }}"
-    instance_type: "{{ vpc_nat_instance_type }}"
-    instance_tags:
-      Name: "{{ vpc_name }}-nat-instance"
-    image: "{{ vpc_nat_ami_id }}"
-  register: new_nat_instance
-  when: nat_instance.instances|length == 0
-
-# We need to do this instead of registering the output of the above
-# command because if the above command get skipped, the output does
-# not contain information about the instance.
-- name: lookup the created nat_instance
-  local_action:
-    module: "ec2_lookup"
-    region: "{{ vpc_aws_region }}"
-    tags:
-      - Name: "{{ vpc_name }}-nat-instance"
-  register: nat_instance
-
-- name: assign eip to nat
-  ec2_eip:
-    profile: "{{ vpc_aws_profile }}"
-    region: "{{ vpc_aws_region }}"
-    instance_id: "{{ nat_instance.instances[0].id }}"
-    in_vpc: true
-    reuse_existing_ip_allowed: true
-  when: new_nat_instance.changed
-
-- name: create private route table
-  ec2_rt:
-    profile: "{{ vpc_aws_profile }}"
-    vpc_id: "{{ created_vpc.vpc_id }}"
-    region: "{{ vpc_aws_region }}"
-    state: "present"
-    name: "{{ vpc_name }}-private"
-    routes: "{{ vpc_private_route_table }}"
-  register: created_private_rt
-
-- name: output a vpc_config for using to build services
-  local_action:
-    module: template
-    src: "vpc_config.yml.j2"
-    dest: "~/{{ e_d }}.yml"

playbooks/roles/edx_vpc/templates/vpc_config.yml.j2

-#
-# Configuration for the environment-deployment
-#
-profile: "{{ vpc_aws_profile }}"
-vpc_id: "{{ created_vpc.vpc_id }}"
-vpc_cidr: "{{ vpc_cidr }}"
-vpc_class_b: "{{ vpc_class_b }}"
-
-env: "{{ vpc_environment }}"
-deployment: "{{ vpc_deployment }}"
-e_d_c: "{{ vpc_environment }}-{{ vpc_deployment }}-{{ '{{' }} cluster {{ '}}' }}"
-aws_region: "{{ vpc_aws_region }}"
-
-
-aws_availability_zones:
-{% for subnet in vpc_public_subnets %}
-  - {{ subnet.az }}
-{% endfor %}
-
-# Should this be service specific
-ssl_cert: "{{ vpc_ssl_cert }}"
-
-# used for ELB
-public_route_table: "{{ created_public_rt.id }}"
-# used for service subnet
-private_route_table: "{{ created_private_rt.id }}"
-instance_key_name: "{{ vpc_keypair }}"
-
-# subject to change #TODO: provide the correct var for the eni
-nat_device: "{{ nat_instance.instances[0].id }}"
-
-public_subnet_1: "{{ vpc_public_subnets[0].cidr }}"
-public_subnet_2: "{{ vpc_public_subnets[1].cidr }}"
-
-# /28 per AZ NEEDE?
-# private_subnet_1: "{{ vpc_class_b }}.110.16/28"
-# private_subnet_2: "{{ vpc_class_b }}.120.16/28"
-
-elb_subnets:
-{% for subnet in created_public_subnets.results %}
-  - "{{ subnet.subnet_id }}"
-{% endfor %}
-
-#
-# Do not use vars in policies :(
-# Should be specific to the service right?
-role_policies: []
-#   - name: "{{ '{{ ' + 'e_d_c' + '}}' }}-s3-policy"
-#     document: |
-#       {
-#         "Statement":[
-#           {
-#             "Effect":"Allow",
-#             "Action":["s3:*"],
-#             "Resource":["arn:aws:s3:::edx-stage-edx"]
-#           }
-#         ]
-#         }  
-#   - name: "{{ '{{ ' + 'e_d_c' + '}}' }}-create-instance-tags"
-#     document: |
-#       {
-#         "Statement": [
-#           {
-#             "Effect": "Allow",
-#             "Action": ["ec2:CreateTags"],
-#             "Resource": ["arn:aws:ec2:us-east-1:xxxxxxxxxxxx:instance/*"]
-#           }
-#         ]
-#         }        
-#   - name: "{{ '{{ ' + 'e_d_c' + '}}' }}-describe-ec2"
-#     document: |
-#         {"Statement":[
-#         {"Resource":"*",
-#         "Action":["ec2:DescribeInstances","ec2:DescribeTags","ec2:DescribeVolumes"],
-#         "Effect":"Allow"}]}