Simplify logic around "present" state and skip dupes. If the policy doesn't exist or the policy document doesn't match or if we're not skipping dupes, then we go ahead and update the respective user/group/role policy.

cloud/amazon/iam_policy.py

@@ -149,11 +149,11 @@ def user_action(module, iam, name, policy_name, skip, pdoc, state):
         if policy_match:
           msg=("The policy document you specified already exists "
                "under the name %s." % pol)
-    if state == 'present' and skip:
-      if policy_name not in current_policies and not policy_match:
-        changed = True
-        iam.put_user_policy(name, policy_name, pdoc)
-    elif state == 'present' and not skip:
+    if state == 'present':
+      # If policy document does not already exist (either it's changed
+      # or the policy is not present) or if we're not skipping dupes then
+      # make the put call.  Note that the put call does a create or update.
+      if not policy_match or not skip:
         changed = True
         iam.put_user_policy(name, policy_name, pdoc)
     elif state == 'absent':
@@ -190,11 +190,11 @@ def role_action(module, iam, name, policy_name, skip, pdoc, state):
         if policy_match:
           msg=("The policy document you specified already exists "
                "under the name %s." % pol)
-    if state == 'present' and skip:
-      if policy_name not in current_policies and not policy_match:
-        changed = True
-        iam.put_role_policy(name, policy_name, pdoc)
-    elif state == 'present' and not skip:
+    if state == 'present':
+      # If policy document does not already exist (either it's changed
+      # or the policy is not present) or if we're not skipping dupes then
+      # make the put call.  Note that the put call does a create or update.
+      if not policy_match or not skip:
         changed = True
         iam.put_role_policy(name, policy_name, pdoc)
     elif state == 'absent':
@@ -233,11 +233,11 @@ def group_action(module, iam, name, policy_name, skip, pdoc, state):
         if policy_match:
           msg=("The policy document you specified already exists "
                "under the name %s." % pol)
-    if state == 'present' and skip:
-      if policy_name not in current_policies and not policy_match:
-        changed = True
-        iam.put_group_policy(name, policy_name, pdoc)
-    elif state == 'present' and not skip:
+    if state == 'present':
+      # If policy document does not already exist (either it's changed
+      # or the policy is not present) or if we're not skipping dupes then
+      # make the put call.  Note that the put call does a create or update.
+      if not policy_match or not skip:
         changed = True
         iam.put_group_policy(name, policy_name, pdoc)
     elif state == 'absent':