Help with Amazon STS Module [sts_assume_role]

75 views
Skip to first unread message

Brian O Mahony

unread,
May 22, 2017, 11:40:50 AM5/22/17
to Ansible Project
I am starting to use ansible for my AWS environment and have run into a few snags with the STS Module. I am relatively new to ansible, so it may just be user error :) Apologies if these are

Issue #1:
I have set thefollowing variables:
sts_role_arn: "arn:aws:iam::1234567890:role/My_AccountAccessRole"
sts_role_session_name: "ansible"
aws_access_key: ###key####
aws_secret_key: ###key###

However it seems to be trying to run the sts_assume_role as the instance, rather than the user, as the error shows:
<Message>User: arn:aws:sts::9876543210:assumed-role/My_EC2InstanceRole/i-00000000000000 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::1234567890:role/My_AccountAccessRole</Message>

If I run any commands using the aws cli, they work correctly. IE if I run: aws ec2 describe-instances --profile MyProfile | egrep "SubnetId|AvailabilityZone|test", it returns the details. The profile contains a line of "role_arn = arn:aws:iam::1234567890:role/My_AccountAccessRole, but these are running as the user, rather than the instance.

Issue #2:
It doesnt seem to read the ~/.aws/config file for a profile. If I set 'profile: MyProfile' and this profile exists in ~/.aws/config, it till returns a 'nboto.provider.ProfileNotFoundError: Profile \"MyProfile\" not found!\n' error. As stated above, if i use the cli with the --profile flag, it works fine....


Ansible was installed using git clone, make rpm, rpm -e.
Details:
[briano@ip-XXX-xx-XXX-xx tasks]$ ansible --version
ansible 2.3.0.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.12 (default, Sep  1 2016, 22:14:00) [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)]
[briano@ip-XXX-xx-XXX-xx tasks]$ cat /etc/os-release
NAME="Amazon Linux AMI"
VERSION="2017.03"
ID="amzn"
ID_LIKE="rhel fedora"
VERSION_ID="2017.03"
PRETTY_NAME="Amazon Linux AMI 2017.03"
ANSI_COLOR="0;33"
CPE_NAME="cpe:/o:amazon:linux:2017.03:ga"
HOME_URL="http://aws.amazon.com/amazon-linux-ami/"

Thanks for any help, and if i am in the wrong place, please let me know!

B
Reply all
Reply to author
Forward
0 new messages