diff --git a/lib/ansible/modules/cloud/amazon/iam_group.py b/lib/ansible/modules/cloud/amazon/iam_group.py index c1307c492c9..70eaa45edb2 100644 --- a/lib/ansible/modules/cloud/amazon/iam_group.py +++ b/lib/ansible/modules/cloud/amazon/iam_group.py @@ -192,7 +192,6 @@ def compare_group_members(current_group_members, new_group_members): # If new_attached_policies is None it means we want to remove all policies if len(current_group_members) > 0 and new_group_members is None: return False - if set(current_group_members) == set(new_group_members): return True else: @@ -200,6 +199,7 @@ def compare_group_members(current_group_members, new_group_members): def convert_friendly_names_to_arns(connection, module, policy_names): + if not any([not policy.startswith('arn:') for policy in policy_names if policy is not None]): return policy_names allpolicies = {} @@ -220,12 +220,12 @@ def create_or_update_group(connection, module): params = dict() params['GroupName'] = module.params.get('name') managed_policies = module.params.get('managed_policy') - if managed_policies: - managed_policies = convert_friendly_names_to_arns(connection, module, managed_policies) users = module.params.get('users') purge_users = module.params.get('purge_users') purge_policy = module.params.get('purge_policy') changed = False + if managed_policies: + managed_policies = convert_friendly_names_to_arns(connection, module, managed_policies) # Get group try: @@ -236,6 +236,10 @@ def create_or_update_group(connection, module): # If group is None, create it if group is None: + # Check mode means we would create the group + if module.check_mode: + module.exit_json(changed=True) + try: group = connection.create_group(**params) changed = True @@ -248,34 +252,37 @@ def create_or_update_group(connection, module): # Manage managed policies current_attached_policies = get_attached_policy_list(connection, module, params['GroupName']) if not compare_attached_group_policies(current_attached_policies, managed_policies): + current_attached_policies_arn_list = [] + for policy in current_attached_policies: + current_attached_policies_arn_list.append(policy['PolicyArn']) + # If managed_policies has a single empty element we want to remove all attached policies if purge_policy: # Detach policies not present - current_attached_policies_arn_list = [] - for policy in current_attached_policies: - current_attached_policies_arn_list.append(policy['PolicyArn']) - for policy_arn in list(set(current_attached_policies_arn_list) - set(managed_policies)): - try: - connection.detach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn) - except ClientError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc(), - **camel_dict_to_snake_dict(e.response)) - except ParamValidationError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc()) - - # If there are policies in managed_policies attach each policy - if managed_policies != [None]: - for policy_arn in managed_policies: - try: - connection.attach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn) - except ClientError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc(), - **camel_dict_to_snake_dict(e.response)) - except ParamValidationError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc()) - - changed = True + changed = True + if not module.check_mode: + try: + connection.detach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn) + except ClientError as e: + module.fail_json(msg=e.message, exception=traceback.format_exc(), + **camel_dict_to_snake_dict(e.response)) + except ParamValidationError as e: + module.fail_json(msg=e.message, exception=traceback.format_exc()) + # If there are policies to adjust that aren't in the current list, then things have changed + # Otherwise the only changes were in purging above + if set(managed_policies) - set(current_attached_policies_arn_list): + changed = True + # If there are policies in managed_policies attach each policy + if managed_policies != [None] and not module.check_mode: + for policy_arn in managed_policies: + try: + connection.attach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn) + except ClientError as e: + module.fail_json(msg=e.message, exception=traceback.format_exc(), + **camel_dict_to_snake_dict(e.response)) + except ParamValidationError as e: + module.fail_json(msg=e.message, exception=traceback.format_exc()) # Manage group memberships try: @@ -292,25 +299,33 @@ def create_or_update_group(connection, module): if purge_users: for user in list(set(current_group_members_list) - set(users)): - try: - connection.remove_user_from_group(GroupName=params['GroupName'], UserName=user) - except ClientError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc(), - **camel_dict_to_snake_dict(e.response)) - except ParamValidationError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc()) - - if users != [None]: - for user in users: - try: - connection.add_user_to_group(GroupName=params['GroupName'], UserName=user) - except ClientError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc(), - **camel_dict_to_snake_dict(e.response)) - except ParamValidationError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc()) - - changed = True + # Ensure we mark things have changed if any user gets purged + changed = True + # Skip actions for check mode + if not module.check_mode: + try: + connection.remove_user_from_group(GroupName=params['GroupName'], UserName=user) + except ClientError as e: + module.fail_json(msg=e.message, exception=traceback.format_exc(), + **camel_dict_to_snake_dict(e.response)) + except ParamValidationError as e: + module.fail_json(msg=e.message, exception=traceback.format_exc()) + # If there are users to adjust that aren't in the current list, then things have changed + # Otherwise the only changes were in purging above + if set(users) - set(current_group_members_list): + changed = True + # Skip actions for check mode + if users != [None] and not module.check_mode: + for user in users: + try: + connection.add_user_to_group(GroupName=params['GroupName'], UserName=user) + except ClientError as e: + module.fail_json(msg=e.message, exception=traceback.format_exc(), + **camel_dict_to_snake_dict(e.response)) + except ParamValidationError as e: + module.fail_json(msg=e.message, exception=traceback.format_exc()) + if module.check_mode: + module.exit_json(changed=changed) # Get the group again try: @@ -333,6 +348,9 @@ def destroy_group(connection, module): module.fail_json(msg=e.message, exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response)) if group: + # Check mode means we would remove this group + if module.check_mode: + module.exit_json(changed=True) # Remove any attached policies otherwise deletion fails try: @@ -417,6 +435,7 @@ def main(): module = AnsibleModule( argument_spec=argument_spec, + supports_check_mode=True ) if not HAS_BOTO3: