aws_ssm lookup module throws an exception on missing fail_json

[shaul75]

Summary

Try to run the lookup on a parameter with no permission or if it doesn't exist.
Result is an exception due to a missing method in the module instead of an error message with the relevant details.

An unhandled exception occurred while templating '{{ lookup('aws_ssm', 'some_param', decrypt=True) }}'. Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while running the lookup plugin 'aws_ssm'. Error was a <class 'AttributeError'>, original message: 'LookupModule' object has no attribute 'fail_json'. 'LookupModule' object has no attribute 'fail_json'

Issue Type

Bug Report

Component Name

aws_ssm lookup

Ansible Version

ansible-core~=2.14.5->ansible==7.5.0

Collection Versions

5.4.0

AWS SDK versions

botocore==1.20.32
boto3==1.17.32
boto==2.49.0

Configuration

No response

OS / Environment

No response

Steps to Reproduce

- name: Example
  hosts: all
  vars:
    awesome_param: "{{ lookup('aws_ssm', 'some_param', decrypt=True) }}"

Expected Results

Error message from AWS.

Actual Results

Exception from amazon.aws#aws_ssm module.

An unhandled exception occurred while templating '{{ lookup('aws_ssm', 'some_param', decrypt=True) }}'. Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while running the lookup plugin 'aws_ssm'. Error was a <class 'AttributeError'>, original message: 'LookupModule' object has no attribute 'fail_json'. 'LookupModule' object has no attribute 'fail_json'

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[tremble]

@shaul75,

Thanks for opening this issue.

Please note that an error/exception is the expected behaviour when encountering a missing attribute or a permissions issue. Please see the documentation for information: https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html#parameter-on_missing

That said, the error you've encountered is significantly more spammy that it should be. This is caused by us raising the "wrong" type of error. That issue has been fixed in the "main" branch which we hope to release as 6.0.0 within the next week. Additionally I've opened #1534 which will clean up the error messages in the next 5.x release.

[shaul75]

@shaul75,

Thanks for opening this issue.

Please note that an error/exception is the expected behaviour when encountering a missing attribute or a permissions issue. Please see the documentation for information: https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_ssm_lookup.html#parameter-on_missing

Yeah that's what I meant in the expected result that in this case the code trying to catch-raise the AWS exception has by itself produced/raised an uncaught exception.

Thanks for the quick fix :)

BTW, looking at the commit code made me wonder what's the benefit of catching the exceptions from botocore?

[tremble]

BTW, looking at the commit code made me wonder what's the benefit of catching the exceptions from botocore?

It's mostly to do with "failing cleanly". These are to an extent "expected" errors (things like 404/403), and in some cases we even drop them on the floor (on_missing: ignore) or simply issue a warning (on_missing: warn) rather than actually failing.

In the default case of on_missing: error, if we catch them, and re-raise them as AnsibleLookupError you always get a very simple error such as Failed to find SSM parameter /ansible-test-32065799-mchappel/Simple (ResourceNotFound) without a large stack trace, where as letting them fall through will generally result in an ugly splodge of a message with a stacktrace that no-one cares about, because it wasn't a code issue, it's just not there.

[tremble]

6.0.0 has been released and fixes this issue. The next 5.x release will also include a fix, which would be expected in early June.