Add _get_boto_client and STS token management.

[flavioelawi]

SUMMARY

Fixes #24

Add the following parameters to aws_ssm.py connection plugin:

• ansible_aws_ssm_access_key_id
• ansible_aws_ssm_secret_access_key
• ansible_aws_ssm_session_token

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

This implements some basic STS token management, that can be passed as parameters to the task when the aws_ssm connection plugin is involved, the parameters are scoped to the plugin namespace.

ADDITIONAL INFORMATION

If you have a role that you allowed to assume in a target account, you would need to assume such role in the target account before invoking the task; this example comes from an invocation by using ansible APIs, where even assuming the role in the target account, the connection plugin was still executing under the controller-node account session.

flavioel/.virtualenvs/ansible_ssm/lib/python3.6/site-packages/botocore/client.py\", line 626, in _make_api_call\n    raise error_class(parsed_response, operation_name)\nbotocore.errorfactor
y.TargetNotConnected: An error occurred (TargetNotConnected) when calling the StartSession operation: i-01234567890123456 is not connected.\n",

By implementing the changes in this PR I am able to pass an STS token as a parameter to the task, letting it execute under the target account context.

This change also allows for backward compatibility as if nothing is specified (no OS environment variables, no parameters) the boto3 client will automatically select the default profile configured on the controller.

[flavioelawi]

Pinging the the plugin authors: @psharkey @hanumantharaomvl @gau1991 :)

[tremble]

Thanks for taking the time to submit this patch.

I think that we should be able to reuse some of the existing helpers rather than building something custom. Untortunately I'm not at all familiar with connection plugins. Hopefully @jillr will be able to add their 2-cents.

[MrBones757]

Is there any update on when we might expect this change to be merged into stable?
It was originally discussed here: ansible/ansible#49652 (comment)
but it was never included in the final release.

Thanks for the PR though - saved me some time as i've just come across this issue myself!

If you need any assistance verifying please let me know!

I have made a copy of this code and have been testing it in AWX - everything works as expected and the session token can be consumed from an external assumerole

[tremble]

Change looks sound, after a little digging my previous comments don't really hold true. @gau1991 (one of the authors) has +1ed so I think we're good to merge this.

[tremble]

Actually, two minor documentation things:

1. Please add a changelog fragment https://docs.ansible.com/ansible/latest/community/development_process.html#changelogs-how-to
2. We need a version_added entry on the new options.

Sorry things stalled out here for a while

[flavioelawi]

Cool, i'll squash the commits, add the changelog fragment and update the pr, thanks.

[flavioelawi]

I made a mess with the pull requests, the correct one is #218

sorry about that.