Enhance aws_kms_info to support ignoring denied keys

[jokajak]

SUMMARY

Enhance aws_kms_info to allow searching for keys KMS even if one or more keys cannot be accessed due to an explicit deny.

ISSUE TYPE

• Feature Idea

COMPONENT NAME

aws_kms_info.py

ADDITIONAL INFORMATION

This feature would allow obtaining facts for all available keys even if one key is inaccessible. A key could be inaccessible because there is an explicit deny for accessing the key.

One method to accomplish this would be to add a parameter to the module that allows ignoring these errors.

- name: Get all accessible KMS keys
  aws_kms_info:
    ignore_deny: yes

[jokajak]

Leaving this here. I plan on writing test cases and trying to get this incorporated but it will take a bit of effort for me to write the test cases due to needing to set up appropriate permissions.

--- plugins/modules/aws_kms_info.py     2020-08-27 13:00:07.545602595 +0000
+++ ansible_collections/community/aws/plugins/modules/aws_kms_info.py   2020-08-27 12:56:05.108964305 +0000
@@ -27,10 +27,6 @@
     description: Whether to get full details (tags, grants etc.) of keys pending deletion
     default: False
     type: bool
-  ignore_deny:
-    description: Whether to continue if a key cannot be accessed.
-    default: False
-    type: bool
 extends_documentation_fragment:
 - amazon.aws.aws
 - amazon.aws.ec2
@@ -362,9 +358,6 @@
     try:
         result = get_kms_metadata_with_backoff(connection, key_id)['KeyMetadata']
     except botocore.exceptions.ClientError as e:
-        if e.response['Error']['Code'] == "AccessDeniedException" and module.params.get('ignore_deny'):
-            module.warn("Failed to obtain key metadata for key-id {key_id}, ignoring.".format(key_id=key_id))
-            return None
         module.fail_json(msg="Failed to obtain key metadata",
                          exception=traceback.format_exc(),
                          **camel_dict_to_snake_dict(e.response))
@@ -404,17 +397,13 @@
                          exception=traceback.format_exc(),
                          **camel_dict_to_snake_dict(e.response))
 
-    key_details = [get_key_details(connection, module, key['KeyId']) for key in keys]
-    # Remove any None entries from key details
-    # None is returned if access to a key is deniied
-    return [key for key in key_details if key]
+    return [get_key_details(connection, module, key['KeyId']) for key in keys]
 
 
 def main():
     argument_spec = dict(
         filters=dict(type='dict'),
         pending_deletion=dict(type='bool', default=False),
-        ignore_deny=dict(type='bool', default=False),
     )
 
     module = AnsibleAWSModule(argument_spec=argument_spec,

[tremble]

FYI There is #200 (and mattclay/aws-terminator#106) which would enable running the current integration tests in the CI account and includes a minor bugfix in the tests

[ansibullbot]

cc @jillr @s-hertel @willthames @wimnat
click here for bot help

[phene]

I just ran into this issue -- This would be an excellent enhancement.

[ansibullbot]

cc @markuman
click here for bot help