From 71510aa67a518df27d7d0ac350b71939ed20e440 Mon Sep 17 00:00:00 2001 From: Christopher Bradley Date: Wed, 6 Dec 2017 13:46:35 +1100 Subject: [PATCH] iam_role - Add option to supress the creation of instance profiles (fixes #26023) (#32527) * Defaults to creating the instance profile to preserve current behaviour --- lib/ansible/modules/cloud/amazon/iam_role.py | 39 ++++++++++++-------- 1 file changed, 24 insertions(+), 15 deletions(-) diff --git a/lib/ansible/modules/cloud/amazon/iam_role.py b/lib/ansible/modules/cloud/amazon/iam_role.py index d7c989ecf00..3659dcf49c8 100644 --- a/lib/ansible/modules/cloud/amazon/iam_role.py +++ b/lib/ansible/modules/cloud/amazon/iam_role.py @@ -57,6 +57,12 @@ options: - Create or remove the IAM role required: true choices: [ 'present', 'absent' ] + create_instance_profile: + description: + - Creates an IAM instance profile along with the role + type: bool + default: true + version_added: 2.5 requirements: [ botocore, boto3 ] extends_documentation_fragment: - aws @@ -217,6 +223,7 @@ def create_or_update_role(connection, module): if module.params.get('description') is not None: params['Description'] = module.params.get('description') managed_policies = module.params.get('managed_policy') + create_instance_profile = module.params.get('create_instance_profile') if managed_policies: managed_policies = convert_friendly_names_to_arns(connection, module, managed_policies) changed = False @@ -275,22 +282,23 @@ def create_or_update_role(connection, module): changed = True # Instance profile - try: - instance_profiles = connection.list_instance_profiles_for_role(RoleName=params['RoleName'])['InstanceProfiles'] - except ClientError as e: - module.fail_json(msg=e.message, exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response)) - if not any(p['InstanceProfileName'] == params['RoleName'] for p in instance_profiles): - # Make sure an instance profile is attached + if create_instance_profile: try: - connection.create_instance_profile(InstanceProfileName=params['RoleName'], Path=params['Path']) - changed = True + instance_profiles = connection.list_instance_profiles_for_role(RoleName=params['RoleName'])['InstanceProfiles'] except ClientError as e: - # If the profile already exists, no problem, move on - if e.response['Error']['Code'] == 'EntityAlreadyExists': - pass - else: - module.fail_json(msg=e.message, exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response)) - connection.add_role_to_instance_profile(InstanceProfileName=params['RoleName'], RoleName=params['RoleName']) + module.fail_json(msg=e.message, exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response)) + if not any(p['InstanceProfileName'] == params['RoleName'] for p in instance_profiles): + # Make sure an instance profile is attached + try: + connection.create_instance_profile(InstanceProfileName=params['RoleName'], Path=params['Path']) + changed = True + except ClientError as e: + # If the profile already exists, no problem, move on + if e.response['Error']['Code'] == 'EntityAlreadyExists': + pass + else: + module.fail_json(msg=e.message, exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response)) + connection.add_role_to_instance_profile(InstanceProfileName=params['RoleName'], RoleName=params['RoleName']) # Get the role again role = get_role(connection, module, params['RoleName']) @@ -369,7 +377,8 @@ def main(): assume_role_policy_document=dict(type='json'), managed_policy=dict(type='list', aliases=['managed_policies']), state=dict(choices=['present', 'absent'], required=True), - description=dict(required=False, type='str') + description=dict(required=False, type='str'), + create_instance_profile=dict(type='bool', default=True) ) )