ec2_key: include KeyPairId in result

[andytson]

Summary

I want to limit the ec2:RunInstances to specific EC2 keys which are created by ansible, but only the fingerprint and name are returned as a result of ec2_key.

DescribeKeyPairs and ImportKeyPair return a KeyPairId, which is what's required for generating the ARN of the IAM policy

Please can the KeyPairId be included in the e2c_key result?

Issue Type

Feature Idea

Component Name

ec2_key

Additional Information

- amazon.aws.ec2_key:
    name: myapp
    key_material: ".."
  register: aws_ec2_key

- community.aws.iam_policy:
    iam_type: user
    iam_name: myapp
    policy_name: ec2
    policy_json:
      Version: "2012-10-17"
      Statement:
        - Effect: allow
          Action: ec2:RunInstances
          Resource:
            - "arn:aws:ec2:us-east-1:1234567:instance/*"
            - "arn:aws:ec2:us-east-1:1234567:key-pair/{{ aws_ec2_key.key.id }}"
            - "arn:aws:ec2:us-east-1:1234567:security-group/*"
            - "arn:aws:ec2:us-east-1:1234567:volume/*"
            - "arn:aws:ec2:us-east-1:1234567:network-interface/*"
            - "arn:aws:ec2:us-east-1:1234567:subnet/*"
            - "arn:aws:ec2:us-east-1::image/*"

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibullbot]

Files identified in the description:

• [plugins/modules/ec2.py](https://github.com/['ansible-collections/amazon.aws', 'ansible-collections/community.aws', 'ansible-collections/community.vmware']/blob/main/plugins/modules/ec2.py)
• [plugins/modules/ec2_key.py](https://github.com/['ansible-collections/amazon.aws', 'ansible-collections/community.aws', 'ansible-collections/community.vmware']/blob/main/plugins/modules/ec2_key.py)

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibullbot]

cc @jillr @lwade @prasadkatti @s-hertel @tgerla @tremble @wimnat @zbal
click here for bot help

[tremble]

Thanks for taking the time to make this suggestion, I agree it's potentially very helpful.

I've opened PR #548 is you are able to test this it would be much appreciated.

[andytson]

Ah, I was mistaken in my example, turns out RunInstance resource for keypair uses the keypair name rather than key id, e.g. arn:aws:ec2:us-east-1:1234567:key-pair/myapp. I'm not sure of other uses of the key id, but I guess its still harmless to include