mirror of https://github.com/ansible/ansible.git
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
# Usage: ansible-playbook setup-iam.yml -e iam_group=ansible_test -vv
|
|
#
|
|
# Creates IAM policies and associates them with iam_group. This group
|
|
# can then be associated with an appropriate user
|
|
#
|
|
# You can pass -e profile=boto_profile_name if you have a profile that
|
|
# you can use, otherwise use normal AWS methods (env variables, instance
|
|
# profile, etc)
|
|
#
|
|
# If you want to use a region other than us-east-1 (and only us-east-2
|
|
# works with ansible-test), pass -e region=us-east-2
|
|
#
|
|
# Requires 2.4 for iam_managed_policy and iam_group
|
|
|
|
- hosts: localhost
|
|
connection: local
|
|
gather_facts: no
|
|
vars:
|
|
aws_region: "{{ region|default('us-east-1') }}"
|
|
|
|
tasks:
|
|
- name: Check that required variables are set
|
|
fail:
|
|
msg: "You must set the iam_group variable"
|
|
when: iam_group is not defined
|
|
|
|
- name: Get aws account ID
|
|
aws_caller_info:
|
|
profile: "{{ profile|default(omit) }}"
|
|
register: aws_caller_info
|
|
|
|
- name: Set aws_account_fact
|
|
set_fact:
|
|
aws_account: "{{ aws_caller_info.account }}"
|
|
|
|
|
|
- name: Ensure Managed IAM policies exist
|
|
iam_managed_policy:
|
|
policy_name: "AnsibleTest{{ item|basename|regex_replace('-.*', '')|capitalize }}Policy"
|
|
policy: "{{ lookup('template', item) }}"
|
|
state: present
|
|
profile: "{{ profile|default(omit) }}"
|
|
with_fileglob: "testing_policies/*.json"
|
|
register: iam_managed_policies
|
|
|
|
- debug:
|
|
msg: "{{ iam_managed_policies | json_query('results[].policy.policy_name') }}"
|
|
|
|
- name: Ensure IAM group exists and attach managed policies
|
|
iam_group:
|
|
name: "{{ iam_group }}"
|
|
state: present
|
|
managed_policy: "{{ iam_managed_policies | json_query('results[].policy.policy_name') }}"
|
|
profile: "{{ profile|default(omit) }}"
|
|
purge_policy: yes
|