[aws] Add aws_iam_role check mode support (#39002)
* Check mode when adding * Check mode when deleting * Add check mode
This commit is contained in:
cahlchang
Ryan Brown
parent
910bc892c6
commit
e2908ae8df
1 changed files with 27 additions and 13 deletions
|
|
@ -206,7 +206,8 @@ def convert_friendly_names_to_arns(connection, module, policy_names):
|
|||
def remove_policies(connection, module, policies_to_remove, params):
|
||||
for policy in policies_to_remove:
|
||||
try:
|
||||
connection.detach_role_policy(RoleName=params['RoleName'], PolicyArn=policy)
|
||||
if not module.check_mode:
|
||||
connection.detach_role_policy(RoleName=params['RoleName'], PolicyArn=policy)
|
||||
except ClientError as e:
|
||||
module.fail_json(msg="Unable to detach policy {0} from {1}: {2}".format(policy, params['RoleName'], to_native(e)),
|
||||
exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response))
|
||||
|
|
@ -236,7 +237,11 @@ def create_or_update_role(connection, module):
|
|||
# If role is None, create it
|
||||
if role is None:
|
||||
try:
|
||||
role = connection.create_role(**params)
|
||||
if not module.check_mode:
|
||||
role = connection.create_role(**params)
|
||||
else:
|
||||
role = {'MadeInCheckMode': True}
|
||||
role['AssumeRolePolicyDocument'] = json.loads(params['AssumeRolePolicyDocument'])
|
||||
changed = True
|
||||
except ClientError as e:
|
||||
module.fail_json(msg="Unable to create role: {0}".format(to_native(e)),
|
||||
|
|
@ -248,7 +253,8 @@ def create_or_update_role(connection, module):
|
|||
# Check Assumed Policy document
|
||||
if not compare_assume_role_policy_doc(role['AssumeRolePolicyDocument'], params['AssumeRolePolicyDocument']):
|
||||
try:
|
||||
connection.update_assume_role_policy(RoleName=params['RoleName'], PolicyDocument=json.dumps(json.loads(params['AssumeRolePolicyDocument'])))
|
||||
if not module.check_mode:
|
||||
connection.update_assume_role_policy(RoleName=params['RoleName'], PolicyDocument=json.dumps(json.loads(params['AssumeRolePolicyDocument'])))
|
||||
changed = True
|
||||
except ClientError as e:
|
||||
module.fail_json(msg="Unable to update assume role policy for role {0}: {1}".format(params['RoleName'], to_native(e)),
|
||||
|
|
@ -279,7 +285,8 @@ def create_or_update_role(connection, module):
|
|||
# Attach roles not already attached
|
||||
for policy_arn in set(managed_policies) - set(current_attached_policies_arn_list):
|
||||
try:
|
||||
connection.attach_role_policy(RoleName=params['RoleName'], PolicyArn=policy_arn)
|
||||
if not module.check_mode:
|
||||
connection.attach_role_policy(RoleName=params['RoleName'], PolicyArn=policy_arn)
|
||||
except ClientError as e:
|
||||
module.fail_json(msg="Unable to attach policy {0} to role {1}: {2}".format(policy_arn, params['RoleName'], to_native(e)),
|
||||
exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response))
|
||||
|
|
@ -289,7 +296,7 @@ def create_or_update_role(connection, module):
|
|||
changed = True
|
||||
|
||||
# Instance profile
|
||||
if create_instance_profile:
|
||||
if create_instance_profile and not role.get('MadeInCheckMode', False):
|
||||
try:
|
||||
instance_profiles = connection.list_instance_profiles_for_role(RoleName=params['RoleName'])['InstanceProfiles']
|
||||
except ClientError as e:
|
||||
|
|
@ -301,7 +308,8 @@ def create_or_update_role(connection, module):
|
|||
if not any(p['InstanceProfileName'] == params['RoleName'] for p in instance_profiles):
|
||||
# Make sure an instance profile is attached
|
||||
try:
|
||||
connection.create_instance_profile(InstanceProfileName=params['RoleName'], Path=params['Path'])
|
||||
if not module.check_mode:
|
||||
connection.create_instance_profile(InstanceProfileName=params['RoleName'], Path=params['Path'])
|
||||
changed = True
|
||||
except ClientError as e:
|
||||
# If the profile already exists, no problem, move on
|
||||
|
|
@ -313,12 +321,14 @@ def create_or_update_role(connection, module):
|
|||
except BotoCoreError as e:
|
||||
module.fail_json(msg="Unable to create instance profile for role {0}: {1}".format(params['RoleName'], to_native(e)),
|
||||
exception=traceback.format_exc())
|
||||
connection.add_role_to_instance_profile(InstanceProfileName=params['RoleName'], RoleName=params['RoleName'])
|
||||
if not module.check_mode:
|
||||
connection.add_role_to_instance_profile(InstanceProfileName=params['RoleName'], RoleName=params['RoleName'])
|
||||
|
||||
# Get the role again
|
||||
role = get_role(connection, module, params['RoleName'])
|
||||
if not role.get('MadeInCheckMode', False):
|
||||
role = get_role(connection, module, params['RoleName'])
|
||||
role['attached_policies'] = get_attached_policy_list(connection, module, params['RoleName'])
|
||||
|
||||
role['attached_policies'] = get_attached_policy_list(connection, module, params['RoleName'])
|
||||
module.exit_json(changed=changed, iam_role=camel_dict_to_snake_dict(role), **camel_dict_to_snake_dict(role))
|
||||
|
||||
|
||||
|
|
@ -342,7 +352,8 @@ def destroy_role(connection, module):
|
|||
# Now remove the role from the instance profile(s)
|
||||
for profile in instance_profiles:
|
||||
try:
|
||||
connection.remove_role_from_instance_profile(InstanceProfileName=profile['InstanceProfileName'], RoleName=params['RoleName'])
|
||||
if not module.check_mode:
|
||||
connection.remove_role_from_instance_profile(InstanceProfileName=profile['InstanceProfileName'], RoleName=params['RoleName'])
|
||||
except ClientError as e:
|
||||
module.fail_json(msg="Unable to remove role {0} from instance profile {1}: {2}".format(
|
||||
params['RoleName'], profile['InstanceProfileName'], to_native(e)),
|
||||
|
|
@ -355,7 +366,8 @@ def destroy_role(connection, module):
|
|||
# Now remove any attached policies otherwise deletion fails
|
||||
try:
|
||||
for policy in get_attached_policy_list(connection, module, params['RoleName']):
|
||||
connection.detach_role_policy(RoleName=params['RoleName'], PolicyArn=policy['PolicyArn'])
|
||||
if not module.check_mode:
|
||||
connection.detach_role_policy(RoleName=params['RoleName'], PolicyArn=policy['PolicyArn'])
|
||||
except ClientError as e:
|
||||
module.fail_json(msg="Unable to detach policy {0} from role {1}: {2}".format(policy['PolicyArn'], params['RoleName'], to_native(e)),
|
||||
exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response))
|
||||
|
|
@ -364,7 +376,8 @@ def destroy_role(connection, module):
|
|||
exception=traceback.format_exc())
|
||||
|
||||
try:
|
||||
connection.delete_role(**params)
|
||||
if not module.check_mode:
|
||||
connection.delete_role(**params)
|
||||
except ClientError as e:
|
||||
module.fail_json(msg="Unable to delete role: {0}".format(to_native(e)),
|
||||
exception=traceback.format_exc(), **camel_dict_to_snake_dict(e.response))
|
||||
|
|
@ -421,7 +434,8 @@ def main():
|
|||
)
|
||||
|
||||
module = AnsibleModule(argument_spec=argument_spec,
|
||||
required_if=[('state', 'present', ['assume_role_policy_document'])])
|
||||
required_if=[('state', 'present', ['assume_role_policy_document'])],
|
||||
supports_check_mode=True)
|
||||
|
||||
if not HAS_BOTO3:
|
||||
module.fail_json(msg='boto3 required for this module')
|
||||
|
|
|
|||
Loading…
Reference in a new issue