Tags not included when creating request causes IAM to reject call with IAM tag conditions enabled #1843
Comments
|
Via Ansible VS with the CLI Note that the CLI does it in one API call, while Ansible uses two. In this case, the second fails since |
|
Thanks for taking the time to open this issue. This is actually a side effect of the fact that when the module was originally written the AWS EC2 APIs didn't support setting tags on creation, it had to be done as a separate API call. (Support for tagging during creation was only added to botocore in mid 2020, general tagging support for this module module was originally written in 2017). The main change that needs to be made is setting the "ResourceTags" parameter as part of the |
Tag security groups on create SUMMARY Apply tags to security groups on create ISSUE TYPE Bugfix Pull Request COMPONENT NAME ec2_security_group ADDITIONAL INFORMATION This fixes the issues mentioned in #1843 for security groups bu combining the resource creation and tagging into one command. This does not (at the moment) fix the same issue for other modules. Reviewed-by: Mark Chappell Reviewed-by: Helen Bailey <[email protected]>
Tag security groups on create SUMMARY Apply tags to security groups on create ISSUE TYPE Bugfix Pull Request COMPONENT NAME ec2_security_group ADDITIONAL INFORMATION This fixes the issues mentioned in #1843 for security groups bu combining the resource creation and tagging into one command. This does not (at the moment) fix the same issue for other modules. Reviewed-by: Mark Chappell Reviewed-by: Helen Bailey <[email protected]> (cherry picked from commit b82c269)
[PR #1844/b82c269b backport][stable-7] Tag security groups on create This is a backport of PR #1844 as merged into main (b82c269). SUMMARY Apply tags to security groups on create ISSUE TYPE Bugfix Pull Request COMPONENT NAME ec2_security_group ADDITIONAL INFORMATION This fixes the issues mentioned in #1843 for security groups bu combining the resource creation and tagging into one command. This does not (at the moment) fix the same issue for other modules. Reviewed-by: Mark Chappell
Use TagSpecifications parameter when creating EC2 resources SUMMARY For the last couple of years Amazon's supported tagging EC2 resources as part of the creation actions. Switch the last amazon.aws EC2 modules over to using TagSpecifications during creation to support folks using Tagging requirements as part of their IAM/SCP policies ISSUE TYPE Feature Pull Request COMPONENT NAME ec2_vpc_route_table ec2_vpc_igw ec2_vpc_subnet ec2_eip ADDITIONAL INFORMATION fixes: #1843 Reviewed-by: Alina Buzachis
Use TagSpecifications parameter when creating EC2 resources SUMMARY For the last couple of years Amazon's supported tagging EC2 resources as part of the creation actions. Switch the last amazon.aws EC2 modules over to using TagSpecifications during creation to support folks using Tagging requirements as part of their IAM/SCP policies ISSUE TYPE Feature Pull Request COMPONENT NAME ec2_vpc_route_table ec2_vpc_igw ec2_vpc_subnet ec2_eip ADDITIONAL INFORMATION fixes: #1843 Reviewed-by: Alina Buzachis (cherry picked from commit 1b55a66)
…1885) Use TagSpecifications parameter when creating EC2 resources SUMMARY For the last couple of years Amazon's supported tagging EC2 resources as part of the creation actions. Switch the last amazon.aws EC2 modules over to using TagSpecifications during creation to support folks using Tagging requirements as part of their IAM/SCP policies ISSUE TYPE Feature Pull Request COMPONENT NAME ec2_vpc_route_table ec2_vpc_igw ec2_vpc_subnet ec2_eip ADDITIONAL INFORMATION fixes: #1843 Reviewed-by: Alina Buzachis (cherry picked from commit 1b55a66) Co-authored-by: Mark Chappell <[email protected]>
Summary
When passed tags for a new resource, these are not passed with the
CreateSecurityGroupAPI call. This causes a number of issues with tag based IAM policies.This also introduces a potential race condition, where the resource exists in an untagged state, causing other tag based automation to trigger (for example, to remove the policy-violating resource) before the tags can be applied.
Issue Type
Bug Report
Component Name
ec2_security_group
Ansible Version
Collection Versions
AWS SDK versions
Configuration
OS / Environment
Linux kali 6.4.0-kali3-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.4.11-1kali1 (2023-08-21) x86_64 GNU/Linux
Steps to Reproduce
Playbook:
Relevant IAM policy snippet
{ "Sid": "AllowCreateSGInAttackVPC", "Effect": "Allow", "Action": [ "ec2:CreateSecurityGroup" ], "Resource": [ "arn:aws:ec2:us-west-2:XXXXXXXX:vpc/vpc-XXXXXXXXX", "arn:aws:ec2:*:XXXXXXXXXXXXX:security-group/*" ], "Condition": { "StringEquals": { "aws:RequestTag/CreatedBy": "Controller" } } }, { "Effect": "Allow", "Action": [ "ec2:CreateTags" ], "Resource": "*", "Condition": { "StringEquals": { "ec2:CreateAction": [ "RunInstances", "CreateSecurityGroup" ] } } }Expected Results
Security group should be created with valid tags
Actual Results
"msg": "Unable to add tags {'CreatedBy': 'Controller', 'CODENAME': 'test-with-new-keys'} to sg-XXXXXXX: An error occurred (UnauthorizedOperation) when calling the CreateTags operation: You are not authorized to perform this operation. User: arn:aws:iam::XXXXXXX:user/test-controller is not authorized to perform: ec2:CreateTags on resource: arn:aws:ec2:us-west-2:XXXXXXXX:security-group/sg-XXXXXXX because no identity-based policy allows the ec2:CreateTags action.Code of Conduct
The text was updated successfully, but these errors were encountered: