msg: The following modules failed to execute: ansible.legacy.setup #1421
Comments
|
Files identified in the description: If these files are inaccurate, please update the |
|
the component names has been updated |
|
I also came across the same problem. Normally S3 is responding with an XML style when there is an error, which might be the case here. |
|
@jon-rei I have the IAM role attached to the instance has the below policy for the S3 bucket. Is there anything specific missing ? |
|
curl 'https://.s3.amazonaws.com' to the presigned always uses non-regional URL and also tried to do a curl from the instance which is showing HTTP/1.1 403 Forbidden with different set of results with non-regional & regional endpoints. I have the ENV variable added ['ansible_aws_ssm_region'] = 'us-east-1' which doesn't make any change as its still taking only non-regional endpoint. |
|
My policy looks like this: {
"Action": [
"s3:PutObject",
"s3:GetObject",
"s3:GetBucketLocation",
"s3:DeleteObject"
],
"Effect": "Allow",
"Resource": [
"arn:aws:s3:::my-bucket/*",
"arn:aws:s3:::my-bucket"
],
}
Do you have Server Side Encryption enabled on your S3 bucket with a custom KMS key? |
|
@jon-rei yes SSE is enabled on the S3 with AWS Key Management Service key (SSE-KMS). |
|
Disabled the SSE on the bucket and still seeing Access Denied. I don't know what is blocking this. |
|
@jon-rei It appears that the pre-signed URL is using the credentials on my local which does works only locally and per IAM profile blocking which is not coming from allowed set of subnets when the curl is ran from the server. Is there a way to use this S3 to just copy the file and then run from sensible playbook or if there is any alternate way of setting this up ? I ran out of ideas now. |
|
Yes, I also came across exactly this issue. In my case, the permission boundary of the IAM user caused this issue. |
|
@jon-rei We do have windows instances to manage the ansible over SSM. |
|
I'm not using windows on my end. The only option for you would be to change the local IAM user you are using. Probably the GetObject is restricted by a permission boundary to only work from a specific IP range. |
|
I'm facing the same issue, where I'm getting this error If I choose an existing old bucket, ansible-playbook runs successfully, but with new created bucket it fails with that error, although I choose the same configuration.. |
|
All my cases where I had errors which resulted in having a .py file with XML content in it where because of missing permissions to get the files from the S3 bucket. |
|
Can we create new IAM user to use for creating pre-signed url to run the ansible playbooks ? The organization SSO has restrictions for source IP address with my current SSO to run this locally using the profile. Any alternative to override or copy the playbooks to successfully run ? I was never able to get this working . |
|
Sorry it's taken a while to get back to you on this. This is a known issue and should be fixed by #1669 and explicitly setting The problem is usually caused by the AWS SDK returning a presigned URL which uses the global S3 endpoint, unfortunately, when you're using a new S3 bucket, the propagation of that bucket to the 'global' endpoints can take up to 24 hours. This results in the 'redirect' you're seeing. However, telling curl to follow that redirect results in an error message. An alternative work around is just to keep an S3 bucket about that's used for this process. Once its existence has propagated the presigned URL works. |
|
Note: #1669 will be available with release 5.2.0 of the community.aws collection |
Summary
Hello,
First time set to aws_ssm for both linux and windows using the community.aws.aws_ssm plugin to connect to the ec2 instances. The connection looks ok, but failing with the weird syntax error which im not able to figure it out.
I have created a S3 with SSE enabled for temp copy to execute the ansible playbooks.
Issue Type
Bug Report
Component Name
community.aws.aws_ssm, ansible.legacy.setup
Ansible Version
The text was updated successfully, but these errors were encountered: