Problem with the ec2_tag module

[Stephen Gargan]

I'm having trouble with boto and the ec2_tags module I'm hoping someone will know what is up.

I'm spinning up an ec2 instance and then immediately calling the ec2_facts and ec2_tags to grab data to 

configure the instance. The creation and ec2_facts work without a problem, but the ec2_tags fails with 

msg: No handler was ready to authenticate. 1 handlers were checked. ['QuerySignatureV2AuthHandler'] Check your credentials

which is the typical error when the the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are not set; clearly

they are as the previous 2 calls (and the ec2 inventory plugin) are using them. 

the tags command boils down to the following

ec2_tag resource='arn:aws:ec2:us-west-2:7XXXXXXXXX:instance/i-abcabcab' region=us-west-2 state=list tags=[]

I'm using boto 2.27

Anyone know what is up here or what I can do to fix it?

thanks 

Steve.

[C. S.]

Try having the module run locally on an instance that is in an IAM role that has perms to update the tags on other instances. Boto should then get the credentials automatically from the metadata.

That’s been working well for us.

--
You received this message because you are subscribed to the Google Groups "Ansible Project" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ansible-proje...@googlegroups.com.
To post to this group, send email to ansible...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/30f4e27d-fb78-4537-89f5-c888889d1a9d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Stephen Gargan]

Thanks for the reply, the instance is created with an iam profile with very open permissions and its on this instance that the ec2_tag module is running. If I look at the metadata on the host i do see credentials for the profile

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/tagging/

{

  "Code" : "Success",

  "LastUpdated" : "2014-04-02T22:13:03Z",

  "Type" : "AWS-HMAC",

  "AccessKeyId" : "ASIAIJZA6QAITICEXXXX",

  "SecretAccessKey" : "fdXki1+UXXXgQNt89G3Impl5vnU1IlRMkXXXX",

  "Token" : "AQoDYXdz.....",

  "Expiration" : "2014-04-03T04:43:59Z"

} 

Though I'm not too sure if this enough as its still complaining. I've tried a number of combinations of permissions but no joy this far. If its not too sensitive, would you mind sharing what your tagging profile looks like? Cheers for your help I really appreciate it.

Thanks,

Steve.