archive
/
ansible
mirror of https://github.com/ansible/ansible.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Added changes requested by reviewers

Browse Source 
Copied @wimnat incorporating changes requested in feedback comments
pull/18777/head
Boris Ekelchik 9 years ago committed by Matt Clay
parent 7d562272a4
commit 1b56c446b8
1 changed files with 70 additions and 82 deletions
Show Stats Download Patch File Download Diff File

152
lib/ansible/modules/extras/cloud/amazon/sts_assume_role.py
Unescape Escape View File

@ -17,75 +17,69 @@
DOCUMENTATION = '''
---
module: sts_assume_role
short_description: assume a role in AWS account and obtain temporary credentials.
short_description: Assume a role using AWS Security Token Service and obtain temporary credentials
description:
- call AWS STS (Security Token Service) to assume a role in AWS account and obtain temporary credentials. This module has a dependency on python-boto.
For details on base AWS API reference http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
version_added: "1.7"
- Assume a role using AWS Security Token Service and obtain temporary credentials
version_added: "2.0"
author: Boris Ekelchik (@bekelchik)
options:
role_arn:
description:
- The Amazon Resource Name (ARN) of the role that the caller is assuming (http://docs.aws.amazon.com/IAM/latest/UserGuide/Using_Identifiers.html#Identifiers_ARNs)
required: true
aliases: []
role_session_name:
description:
- Name of the role's session - will be used by CloudTrail
required: true
aliases: []
policy:
description:
- Supplemental policy to use in addition to assumed role's policies.
required: false
default: null
aliases: []
duration_seconds:
description:
- The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) to 3600 seconds (1 hour). By default, the value is set to 3600 seconds.
required: false
default: null
aliases: []
external_id:
description:
- A unique identifier that is used by third parties to assume a role in their customers' accounts.
required: false
default: null
aliases: []
mfa_serial_number:
description:
- he identification number of the MFA device that is associated with the user who is making the AssumeRole call.
required: false
default: null
aliases: []
mfa_token:
description:
- The value provided by the MFA device, if the trust policy of the role being assumed requires MFA.
required: false
default: null
aliases: []
author: Boris Ekelchik
notes:
- In order to use the assumed role in a following playbook task you must pass the access_key, access_secret and access_token
extends_documentation_fragment: aws
'''
EXAMPLES = '''
# Basic example of assuming a role
tasks:
- name: assume a role in account 123456789012
sts_assume_role: role_arn="arn:aws:iam::123456789012:role/someRole" session_name="someRoleSession"
# Note: These examples do not set authentication details, see the AWS Guide for details.
# Assume an existing role (more details: http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html)
sts_assume_role:
role_arn: "arn:aws:iam::123456789012:role/someRole"
session_name: "someRoleSession"
register: assumed_role
# Use the assumed role above to tag an instance in account 123456789012
ec2_tag:
aws_access_key: "{{ assumed_role.sts_creds.access_key }}"
aws_secret_key: "{{ assumed_role.sts_creds.secret_key }}"
security_token: "{{ assumed_role.sts_creds.session_token }}"
resource: i-xyzxyz01
state: present
tags:
MyNewTag: value
- name: display temporary credentials
debug: "temporary credentials for the assumed role are {{ ansible_temp_credentials }}"
- name: use temporary credentials for tagging an instance in account 123456789012
ec2_tag: resource=i-xyzxyz01 region=us-west-1 state=present
args:
aws_access_key: "{{ ansible_temp_credentials.access_key }}"
aws_secret_key: "{{ ansible_temp_credentials.secret_key }}"
security_token: "{{ ansible_temp_credentials.session_token }}"
tags:
Test: value
'''
import sys
@ -93,71 +87,65 @@ import time
try:
import boto.sts
from boto.exception import BotoServerError
HAS_BOTO = True
except ImportError:
print "failed=True msg='boto required for this module'"
sys.exit(1)
def sts_connect(module):
""" Return an STS connection"""
region, ec2_url, boto_params = get_aws_connection_info(module)
# If we have a region specified, connect to its endpoint.
if region:
try:
sts = connect_to_aws(boto.sts, region, **boto_params)
except boto.exception.NoAuthHandlerFound, e:
module.fail_json(msg=str(e))
# Otherwise, no region so we fallback to connect_sts method
else:
try:
sts = boto.connect_sts(**boto_params)
except boto.exception.NoAuthHandlerFound, e:
module.fail_json(msg=str(e))
return sts
HAS_BOTO = False
def assumeRole():
data = sts.assume_role()
return data
def assume_role_policy(connection, module):
role_arn = module.params.get('role_arn')
role_session_name = module.params.get('role_session_name')
policy = module.params.get('policy')
duration_seconds = module.params.get('duration_seconds')
external_id = module.params.get('external_id')
mfa_serial_number = module.params.get('mfa_serial_number')
mfa_token = module.params.get('mfa_token')
changed = False
try:
assumed_role = connection.assume_role(role_arn, role_session_name, policy, duration_seconds, external_id, mfa_serial_number, mfa_token)
changed = True
except BotoServerError, e:
module.fail_json(msg=e)
module.exit_json(changed=changed, sts_creds=assumed_role.credentials.__dict__, sts_user=assumed_role.user.__dict__)
def main():
argument_spec = ec2_argument_spec()
argument_spec.update(dict(
role_arn = dict(required=True),
role_session_name = dict(required=True),
duraction_seconds = dict(),
external_id = dict(),
policy = dict(),
mfa_serial_number = dict(),
mfa_token = dict(),
argument_spec.update(
dict(
role_arn = dict(required=True, default=None),
role_session_name = dict(required=True, default=None),
duration_seconds = dict(required=False, default=None, type='int'),
external_id = dict(required=False, default=None),
policy = dict(required=False, default=None),
mfa_serial_number = dict(required=False, default=None),
mfa_token = dict(required=False, default=None)
)
)
module = AnsibleModule(argument_spec=argument_spec)
role_arn = module.params.get('role_arn')
role_session_name = module.params.get('role_session_name')
policy = module.params.get('policy')
duraction_seconds = module.params.get('duraction_seconds')
external_id = module.params.get('external_id')
mfa_serial_number = module.params.get('mfa_serial_number')
mfa_token = module.params.get('mfa_token')
sts = sts_connect(module)
if not HAS_BOTO:
module.fail_json(msg='boto required for this module')
temp_credentials = {}
region, ec2_url, aws_connect_params = get_aws_connection_info(module)
try:
temp_credentials = sts.assume_role(role_arn, role_session_name, policy, duraction_seconds,
external_id, mfa_serial_number, mfa_token).credentials.__dict__
except boto.exception.BotoServerError, e:
module.fail_json(msg='Unable to assume role {0}, error: {1}'.format(role_arn, e))
result = dict(changed=False, ansible_facts=dict(ansible_temp_credentials=temp_credentials))
if region:
try:
connection = connect_to_aws(boto.sts, region, **aws_connect_params)
except (boto.exception.NoAuthHandlerFound, StandardError), e:
module.fail_json(msg=str(e))
else:
module.fail_json(msg="region must be specified")
module.exit_json(**result)
try:
assume_role_policy(connection, module)
except BotoServerError, e:
module.fail_json(msg=e)
# import module snippets
from ansible.module_utils.basic import *

Write Preview
Loading…
Cancel
Save