Thanks Dick, what do you mean in one play and another ? yes I d like to reuse the environment in different plays(roles) which will also make sts to be used in all subsequent tasks/roles yes.
*Nicolas Houillon - [email protected] <[email protected]>**514 224 9930* Le mer. 22 juil. 2020 à 21:28, Dick Visser <[email protected]> a écrit : > Your setting it in one play and then try to use it in another. That won't > work. > > Other question. You run this sts task for all hosts, but is that needed > for all of them? > > > On Thu, 23 Jul 2020 at 04:59, Nico H <[email protected]> wrote: > >> Thank you for the proposition, I ve been trying for days to put this in >> every direction I could but unfortunately 'environment ' >> was never passed to 'import_role' . >> I am not sure how to investigate about import_role module and why >> environment is not supported , seems impossible to reuse sts.creds then . >> Any idea is welcome >> >> >> Hi all, >>> >>> I'm looking for any suggestions on how to work around the following >>> issue: >>> >>> I am trying to use a lookup plugin but it is ignoring my environment >>> variables. >>> >>> The lookup plugin I am trying to use is credstash and the environment >>> variables are being set because I am using AWS STS to assume a role. >>> >>> It looks a little like this: >>> >>> --- >>> - name: Get STS token >>> hosts: "{{ hosts }}" >>> connection: local >>> tasks: >>> - name: Assume role for passed account >>> sts_assume_role: >>> region: "{{ aws_region }}" >>> role_arn: "arn:aws:iam::{{ aws_account_id >>> }}:role/ansible-is_assumed" >>> role_session_name: ansible_assumed_role >>> register: assumed_role >>> when: use_sts >>> >>> - name: Set environment with AWS creds when available >>> set_fact: >>> my_environment: >>> AWS_ACCESS_KEY_ID: "{{ assumed_role.sts_creds.access_key }}" >>> AWS_SECRET_ACCESS_KEY: "{{ assumed_role.sts_creds.secret_key }}" >>> AWS_SECURITY_TOKEN: "{{ assumed_role.sts_creds.session_token }}" >>> when: assumed_role.skipped is not defined >>> >>> - name: Set environment blank when no AWS creds >>> set_fact: >>> my_environment: {} >>> when: assumed_role.skipped is defined >>> >>> - name: Deploy infrastructure role >>> hosts: "{{ hosts }}" >>> connection: local >>> roles: >>> - "{{ role_to_deploy }}" >>> environment: "{{ my_environment }}" >>> >>> >>> >>> Now in the role_to_deploy i have lots of tasks that work brilliantly >>> calling out to AWS using the STS credentials supplied as intended. >>> >>> Unfortunately, any lookup plugins do not work properly because they do >>> not use the environment variables I have set. They end up calling out to >>> AWS using the default credentials rather than being overridden by the STS >>> creds. >>> >>> I don't think this is a bug but it is never the less annoying. >>> >>> I'm hoping maybe one of the core team can think of a way I can get the >>> lookup plugin to 'see' my STS environment variables I have set. >>> >> -- >> You received this message because you are subscribed to the Google Groups >> "Ansible Project" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion on the web visit >> https://groups.google.com/d/msgid/ansible-project/b52315eb-366c-48b6-b377-d2f745bb5452o%40googlegroups.com >> <https://groups.google.com/d/msgid/ansible-project/b52315eb-366c-48b6-b377-d2f745bb5452o%40googlegroups.com?utm_medium=email&utm_source=footer> >> . >> > -- > Sent from a mobile device - please excuse the brevity, spelling and > punctuation. > > -- > You received this message because you are subscribed to a topic in the > Google Groups "Ansible Project" group. > To unsubscribe from this topic, visit > https://groups.google.com/d/topic/ansible-project/nOpZe1JZv_w/unsubscribe. > To unsubscribe from this group and all its topics, send an email to > [email protected]. > To view this discussion on the web visit > https://groups.google.com/d/msgid/ansible-project/CAL8fbwMYhNwaN07Sscbyq%2BYkh5fvAYOUfmTzrCWnRZG34on3gQ%40mail.gmail.com > <https://groups.google.com/d/msgid/ansible-project/CAL8fbwMYhNwaN07Sscbyq%2BYkh5fvAYOUfmTzrCWnRZG34on3gQ%40mail.gmail.com?utm_medium=email&utm_source=footer> > . > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/CAO%3DG0E7gg9o8o5cza9RygTq9X1G%3DS%2BzxfDrNxyXZXhyvLEEyxA%40mail.gmail.com.
