Mixing Ansible static and dynamic groups in inventory - amazon-ec2

Question

I'm trying to combine static & dynamic (EC2) inventory. have two ec2 instances:
ansible control machine
ami based host
Trying to ping 'ami' host from control machine. Here's my host file:
[local]
localhost ansible_connection=local
[tag_Name_ami]
[tag_Name_redhat]
[amazon:children]
tag_Name_ami
tag_Name_redhat
To successfully ping 'ami' host, I need to use two specific variables:
ansible_ssh_user: ec2-user (my control machine is ubuntu)
ansible_ssh_private_key_file: /home/ubuntu/.ssh/klucze.pem
Trying to achieve it by creating files in group_vars directory:
.
├── demo_setup.yml
├── ec2.ini
├── ec2.py
├── group_vars
│   ├── amazon.yml
│   ├── aws-redhats
│   ├── tag_Name_ami.yml
│   └── tag_Name_redhat.yml
├── hosts
├── hosts.bckp
└── host_vars
$ cat group_vars/tag_Name_ami.yml
ansible_ssh_user: ec2-user
$ cat group_vars/amazon.yml
ansible_ssh_private_key_file: /home/ubuntu/.ssh/klucze.pem
Problem is that ansible seems to "see" only tag_Name_ami.yml with ansible_ssh_user, ignoring my amazon.yml with ansible_ssh_private_key_file value. Some output below:
$ ansible tag_Name_ami -i ec2.py -m ping -vvv
<52.59.246.244> ESTABLISH CONNECTION FOR USER: ec2-user
<52.59.246.244> REMOTE_MODULE ping
<52.59.246.244> EXEC ssh -C -tt -v -o ControlMaster=auto -o ControlPersist=60s -o ControlPath="/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r" -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 52.59.246.244 /bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1452256637.43-34398544897068 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1452256637.43-34398544897068 && echo $HOME/.ansible/tmp/ansible-tmp-1452256637.43-34398544897068'
52.59.246.244 | FAILED => SSH Error: Permission denied (publickey).
while connecting to 52.59.246.244:22
It is sometimes useful to re-run the command using -vvvv, which prints SSH debug output to help diagnose the issue.
$ ansible amazon -i ec2.py -m ping
No hosts matched
$
When I add ansible_ssh_private_key_file to my tag_Name_ami, the ping is Successfull:
$ ansible tag_Name_ami -i ec2.py -m ping -vvv
<52.59.246.244> ESTABLISH CONNECTION FOR USER: ec2-user
<52.59.246.244> REMOTE_MODULE ping
<52.59.246.244> EXEC ssh -C -tt -v -o ControlMaster=auto -o ControlPersist=60s -o ControlPath="/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r" -o IdentityFile="/home/ubuntu/.ssh/klucze.pem" -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 52.59.246.244 /bin/sh -c 'mkdir -p $HOME/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436 && chmod a+rx $HOME/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436 && echo $HOME/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436'
<52.59.246.244> PUT /tmp/tmpbFP5sH TO /home/ec2-user/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436/ping
<52.59.246.244> EXEC ssh -C -tt -v -o ControlMaster=auto -o ControlPersist=60s -o ControlPath="/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r" -o IdentityFile="/home/ubuntu/.ssh/klucze.pem" -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o User=ec2-user -o ConnectTimeout=10 52.59.246.244 /bin/sh -c 'LANG=en_US.UTF-8 LC_CTYPE=en_US.UTF-8 /usr/bin/python /home/ec2-user/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436/ping; rm -rf /home/ec2-user/.ansible/tmp/ansible-tmp-1452256765.34-42269843852436/ >/dev/null 2>&1'
52.59.246.244 | success >> {
"changed": false,
"ping": "pong"
}
$
ubuntu#ip-172-31-20-41:/etc/ansible$ cat group_vars/tag_Name_ami.yml
ansible_ssh_user: ec2-user
ansible_ssh_private_key_file: /home/ubuntu/.ssh/klucze.pem
But it's not what I want, I want every new EC2 instance have this ansible_ssh_private_key_file variable defined (it'll be part of 'amazon' static group), and ami/redhat instances additionally have ansible_ssh_user defined.
Thanks in advance for any help provided!
*********** UPDATE ****************
All I've been able to achive is doing it this way:
$ ansible-playbook demo_ping.yml --private-key=/home/ubuntu/.ssh/klucze.pem -u ec2-user
PLAY [webserver] **************************************************************
GATHERING FACTS ***************************************************************
ok: [ec2-54-93-114-191.eu-central-1.compute.amazonaws.com]
TASK: [Execute ping] **********************************************************
ok: [ec2-54-93-114-191.eu-central-1.compute.amazonaws.com]
PLAY RECAP ********************************************************************
ec2-54-93-114-191.eu-central-1.compute.amazonaws.com : ok=2 changed=0 unreachable=0 failed=0
Using my static hosts file with webserver group. The playbook looks like:
---
- hosts: amazon
remote_user: ec2-user
tasks:
- name: Execute ping
ping:
...
Putting 'amazon' as hosts value in playbook returns error:
PLAY [amazon] *****************************************************************
skipping: no hosts matched
Also tried executing playbook with '-i ec2.py', same error

Answer 1

You could loop over the ec2 hosts and set the variable ansible_ssh_private_key_file in the playbook.
- hosts: amazon
gather_facts: false
tasks:
- set_fact:
ansible_ssh_private_key_file: '/home/ubuntu/.ssh/klucze.pem'
...