Support STS token in aws_ssm connection plugin.

[flavioelawi]

SUMMARY

The current implementation of the aws_ssm connection plugin relies on the exported environment variables, or on a default connection profile being configured on the controller.
An ideal implementation would allow the task caller to pass an STS token, for example in cases where there is a cross-account trust policy and the node is able to retrieve such session token and execute tasks in the target account.
This would also allow a more versatile usage from the API, by dynamically assume the target role STS session and pass it to each invocation.

ISSUE TYPE

• Feature Idea

COMPONENT NAME

aws_ssm.py connection plugin

ADDITIONAL INFORMATION

This is how a task can be called with all the sts parameters:

---
- hosts: all
  vars:
    ansible_aws_ssm_region: us-east-1
    bucket_name: helper-bucket-flavioelawi
    ansible_aws_ssm_access_key_id: <THE_ACCESS_KEY_ID>
    ansible_aws_ssm_secret_access_key: <THE_SECRET_KEY>
    ansible_aws_ssm_session_token: <THE_SESSION_TOKEN>
  tasks:
  - name: test stat
    stat:
      path: /etc/foo.conf
    register: file_details
  - debug:
      msg: "file or dir exists"
    when: file_details.stat.exists

[ansibullbot]

Files identified in the description:

• plugins/modules/aws_kms.py
• plugins/modules/aws_ssm_parameter_store.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibullbot]

cc @jillr @mikedlr @nathanwebsterdotme @ozbillwang @s-hertel @tremble @willthames @wimnat
click here for bot help