ansible_connection: aws_ssm fails when KMS encryption is enabled for SSM transport general prefs. #684
Comments
|
Files identified in the description: If these files are inaccurate, please update the |
|
This is the config that works:
This does not:
|
|
Still fails after updating to latest boto components: |
|
Just confirmed while replicating that the default shell needed to NOT be dash as well Also I don't understand why the s3 bucket config needs to exist. ---
- name: Test command
gather_facts: false
hosts: all
vars:
ansible_connection: aws_ssm
ansible_aws_ssm_region: eu-central-1
ansible_aws_ssm_bucket_name: nghc-sbox2-s3 <-------- Why is this needed ?
ansible_python_interpreter: /opt/venv/root/bin/python
tasks:
- name: test
command:
cmd: hostname |
I guess because ansible transfer it's plays to the bucket from where the aws ssm agent can download it. |
|
Found this doc that could explain the KMS issue https://aws.amazon.com/premiumsupport/knowledge-center/ssm-session-manager-failures/ If I get time I'll try this setup. Still trying to sort out exactly what s3 permissions are needed. |
|
Got the same/simular Issue but my setup is a bit different: I run the Ansible Playbook with credentials for a "login-account" and then Ansible itself assigns a role in the desired AWS target account by executing a assume role task on localhost and storing access, secret access key and session token at runtime in the reserved variables of the plugin (access_key_id, ...). This works fine without KMS encrypted Session Manager, but when activated then this error occurs when running Ansible with -vvvvv:
The interesting part is that [ACCOUNT-ID] is the Account ID of the "login-account" while the [KMS-Key-ID] is from the correct target Account, but this combination is obviously not working. |
…nsible-collections#1186) ec2_metadata_facts: Add support to query instance tags in metadata SUMMARY Fixes ansible-collections#684 Added support to be able to query instance tags using ec2_metadata_facts. This PR adds a field in returned ansible_facts named ansible_ec2_instance_tags_keys. Sample "ansible_ec2_instance_tags_keys": [ "Name", "snake_case_key" ], ISSUE TYPE Feature Pull Request COMPONENT NAME ec2_metadata_facts ADDITIONAL INFORMATION Support to enable instance metadata tags already exists in amazon.aws.ec2_instance Reviewed-by: Mike Graves <[email protected]> Reviewed-by: Mandar Kulkarni <[email protected]> Reviewed-by: Gonéri Le Bouder <[email protected]> Reviewed-by: Alina Buzachis <None>
GomathiselviS
added
the
jira
Summary
With the
AWS systems managerpreferences set with KMS encryption disabled, the:works
With KMS encryption enabled, it fails
Issue Type
Bug Report
Component Name
ec2_ssm
Ansible Version
Collection Versions
AWS SDK versions
Configuration
OS / Environment
osx cataina: 10.15.7 (19H1323)
Steps to Reproduce
Expected Results
[I] ➜ ansible-playbook -i inventory_aws_ec2.yml --limit nghc-sbox2-bastion test.yml -v
Using /Users/edgeb1/git/xxx/operations.edgeb1/ansible/playbooks-test/ansible.cfg as config file
PLAY [Test command] **************************************************************************************************************************************************************
TASK [test] **********************************************************************************************************************************************************************
changed: [nghc-sbox2-bastion] => {"changed": true, "cmd": ["hostname"], "delta": "0:00:00.002350", "end": "2021-08-11 16:29:45.231283", "rc": 0, "start": "2021-08-11 16:29:45.228
933", "stderr": "", "stderr_lines": [], "stdout": "nghc-sbox2-bastion", "stdout_lines": ["nghc-sbox2-bastion"]}
PLAY RECAP ***********************************************************************************************************************************************************************
nghc-sbox2-bastion : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Actual Results
ssm log, /var/log/amazon/ssm/amazon-ssm-agent.log:
Both the ansible runner user and the instance role being connected to have full access to the KMS key:
Code of Conduct
The text was updated successfully, but these errors were encountered: