Update `iam_group` to add check mode support (#27589)

lib/ansible/modules/cloud/amazon/iam_group.py

@@ -192,7 +192,6 @@ def compare_group_members(current_group_members, new_group_members):
     # If new_attached_policies is None it means we want to remove all policies
     if len(current_group_members) > 0 and new_group_members is None:
         return False
-
     if set(current_group_members) == set(new_group_members):
         return True
     else:
@@ -200,6 +199,7 @@ def compare_group_members(current_group_members, new_group_members):
 
 
 def convert_friendly_names_to_arns(connection, module, policy_names):
+
     if not any([not policy.startswith('arn:') for policy in policy_names if policy is not None]):
         return policy_names
     allpolicies = {}
@@ -220,12 +220,12 @@ def create_or_update_group(connection, module):
     params = dict()
     params['GroupName'] = module.params.get('name')
     managed_policies = module.params.get('managed_policy')
-    if managed_policies:
-        managed_policies = convert_friendly_names_to_arns(connection, module, managed_policies)
     users = module.params.get('users')
     purge_users = module.params.get('purge_users')
     purge_policy = module.params.get('purge_policy')
     changed = False
+    if managed_policies:
+        managed_policies = convert_friendly_names_to_arns(connection, module, managed_policies)
 
     # Get group
     try:
@@ -236,6 +236,10 @@ def create_or_update_group(connection, module):
 
     # If group is None, create it
     if group is None:
+        # Check mode means we would create the group
+        if module.check_mode:
+            module.exit_json(changed=True)
+
         try:
             group = connection.create_group(**params)
             changed = True
@@ -248,14 +252,16 @@ def create_or_update_group(connection, module):
     # Manage managed policies
     current_attached_policies = get_attached_policy_list(connection, module, params['GroupName'])
     if not compare_attached_group_policies(current_attached_policies, managed_policies):
-        # If managed_policies has a single empty element we want to remove all attached policies
-        if purge_policy:
-            # Detach policies not present
         current_attached_policies_arn_list = []
         for policy in current_attached_policies:
             current_attached_policies_arn_list.append(policy['PolicyArn'])
 
+        # If managed_policies has a single empty element we want to remove all attached policies
+        if purge_policy:
+            # Detach policies not present
             for policy_arn in list(set(current_attached_policies_arn_list) - set(managed_policies)):
+                changed = True
+                if not module.check_mode:
                     try:
                         connection.detach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn)
                     except ClientError as e:
@@ -263,9 +269,12 @@ def create_or_update_group(connection, module):
                                          **camel_dict_to_snake_dict(e.response))
                     except ParamValidationError as e:
                         module.fail_json(msg=e.message, exception=traceback.format_exc())
-
+        # If there are policies to adjust that aren't in the current list, then things have changed
+        # Otherwise the only changes were in purging above
+        if set(managed_policies) - set(current_attached_policies_arn_list):
+            changed = True
             # If there are policies in managed_policies attach each policy
-        if managed_policies != [None]:
+            if managed_policies != [None] and not module.check_mode:
                 for policy_arn in managed_policies:
                     try:
                         connection.attach_group_policy(GroupName=params['GroupName'], PolicyArn=policy_arn)
@@ -275,8 +284,6 @@ def create_or_update_group(connection, module):
                     except ParamValidationError as e:
                         module.fail_json(msg=e.message, exception=traceback.format_exc())
 
-        changed = True
-
     # Manage group memberships
     try:
         current_group_members = get_group(connection, module, params['GroupName'])['Users']
@@ -292,6 +299,10 @@ def create_or_update_group(connection, module):
 
         if purge_users:
             for user in list(set(current_group_members_list) - set(users)):
+                # Ensure we mark things have changed if any user gets purged
+                changed = True
+                # Skip actions for check mode
+                if not module.check_mode:
                     try:
                         connection.remove_user_from_group(GroupName=params['GroupName'], UserName=user)
                     except ClientError as e:
@@ -299,8 +310,12 @@ def create_or_update_group(connection, module):
                                          **camel_dict_to_snake_dict(e.response))
                     except ParamValidationError as e:
                         module.fail_json(msg=e.message, exception=traceback.format_exc())
-
+        # If there are users to adjust that aren't in the current list, then things have changed
-        if users != [None]:
+        # Otherwise the only changes were in purging above
+        if set(users) - set(current_group_members_list):
+            changed = True
+            # Skip actions for check mode
+            if users != [None] and not module.check_mode:
                 for user in users:
                     try:
                         connection.add_user_to_group(GroupName=params['GroupName'], UserName=user)
@@ -309,8 +324,8 @@ def create_or_update_group(connection, module):
                                          **camel_dict_to_snake_dict(e.response))
                     except ParamValidationError as e:
                         module.fail_json(msg=e.message, exception=traceback.format_exc())
-
+    if module.check_mode:
-        changed = True
+        module.exit_json(changed=changed)
 
     # Get the group again
     try:
@@ -333,6 +348,9 @@ def destroy_group(connection, module):
         module.fail_json(msg=e.message, exception=traceback.format_exc(),
                          **camel_dict_to_snake_dict(e.response))
     if group:
+        # Check mode means we would remove this group
+        if module.check_mode:
+            module.exit_json(changed=True)
 
         # Remove any attached policies otherwise deletion fails
         try:
@@ -417,6 +435,7 @@ def main():
 
     module = AnsibleModule(
         argument_spec=argument_spec,
+        supports_check_mode=True
     )
 
     if not HAS_BOTO3: