Open bedge opened 3 years ago
ansibullbot
commented
3 years ago Files identified in the description: None
If these files are inaccurate, please update the component name section of the description or use the !component bot command.
bedge
commented
3 years ago This is the config that works:
This does not:
bedge
commented
3 years ago Still fails after updating to latest boto components:
[I] ➜ pip show boto boto3 botocore
Name: boto
Version: 2.49.0
Summary: Amazon Web Services Library
Home-page: https://github.com/boto/boto/
Author: Mitch Garnaat
Author-email: mitch@garnaat.com
License: MIT
Location: /Users/edgeb1/.pyenv/versions/3.9.0/lib/python3.9/site-packages
Requires:
Required-by:
---
Name: boto3
Version: 1.18.18
Summary: The AWS SDK for Python
Home-page: https://github.com/boto/boto3
Author: Amazon Web Services
Author-email:
License: Apache License 2.0
Location: /Users/edgeb1/.pyenv/versions/3.9.0/lib/python3.9/site-packages
Requires: botocore, s3transfer, jmespath
Required-by: navify-aws-sso-login, aws-ssm-copy
---
Name: botocore
Version: 1.21.18
Summary: Low-level, data-driven core of boto 3.
Home-page: https://github.com/boto/botocore
Author: Amazon Web Services
Author-email:
License: Apache License 2.0
Location: /Users/edgeb1/.pyenv/versions/3.9.0/lib/python3.9/site-packages
Requires: urllib3, python-dateutil, jmespath
Required-by: s3transfer, boto3Just confirmed while replicating that the default shell needed to NOT be dash as well
Also I don't understand why the s3 bucket config needs to exist. If the instance doesn't have R/W permissions to the defined bucket it also fails, even though nothing has been written to the bucket:
---
- name: Test command
gather_facts: false
hosts: all
vars:
ansible_connection: aws_ssm
ansible_aws_ssm_region: eu-central-1
ansible_aws_ssm_bucket_name: nghc-sbox2-s3 <-------- Why is this needed ?
ansible_python_interpreter: /opt/venv/root/bin/python
tasks:
- name: test
command:
cmd: hostname
markuman
commented
3 years ago ansible_aws_ssm_bucket_name: nghc-sbox2-s3 <-------- Why is this needed ?
I guess because ansible transfer it's plays to the bucket from where the aws ssm agent can download it.
bedge
commented
3 years ago Found this doc that could explain the KMS issue
https://aws.amazon.com/premiumsupport/knowledge-center/ssm-session-manager-failures/
If I get time I'll try this setup.
Still trying to sort out exactly what s3 permissions are needed.
simon97k
commented
1 year ago Got the same/simular Issue but my setup is a bit different:
I run the Ansible Playbook with credentials for a "login-account" and then Ansible itself assigns a role in the desired AWS target account by executing a assume role task on localhost and storing access, secret access key and session token at runtime in the reserved variables of the plugin (access_key_id, ...).
This works fine without KMS encrypted Session Manager, but when activated then this error occurs when running Ansible with -vvvvv:
Failed to process action KMSEncryption: Error calling KMS GenerateDataKey API: NotFoundException: Key 'arn:aws:kms:eu-central-1:[ACCOUNT-ID]:key/[KMS-Key-ID]' does not exist
The interesting part is that [ACCOUNT-ID] is the Account ID of the "login-account" while the [KMS-Key-ID] is from the correct target Account, but this combination is obviously not working.
Summary
With the
AWS systems managerpreferences set with KMS encryption disabled, the:works
With KMS encryption enabled, it fails
Issue Type
Bug Report
Component Name
ec2_ssm
Ansible Version
Collection Versions
AWS SDK versions
Configuration
OS / Environment
osx cataina: 10.15.7 (19H1323)
Steps to Reproduce
Expected Results
[I] ➜ ansible-playbook -i inventory_aws_ec2.yml --limit nghc-sbox2-bastion test.yml -v Using /Users/edgeb1/git/xxx/operations.edgeb1/ansible/playbooks-test/ansible.cfg as config file
PLAY [Test command] **
TASK [test] ** changed: [nghc-sbox2-bastion] => {"changed": true, "cmd": ["hostname"], "delta": "0:00:00.002350", "end": "2021-08-11 16:29:45.231283", "rc": 0, "start": "2021-08-11 16:29:45.228 933", "stderr": "", "stderr_lines": [], "stdout": "nghc-sbox2-bastion", "stdout_lines": ["nghc-sbox2-bastion"]}
PLAY RECAP *** nghc-sbox2-bastion : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
Actual Results
ssm log, /var/log/amazon/ssm/amazon-ssm-agent.log:
Both the ansible runner user and the instance role being connected to have full access to the KMS key:
Code of Conduct