645952c139
* Add aws_caller_facts module and use it in setup-iam.yml This removes the dependency on having the command line AWS tools installed.
53 lines
1.7 KiB
YAML
53 lines
1.7 KiB
YAML
# Usage: ansible-playbook setup-iam.yml -e iam_group=ansible_test -vv
|
|
#
|
|
# Creates IAM policies and associates them with iam_group. This group
|
|
# can then be associated with an appropriate user
|
|
#
|
|
# You can pass -e profile=boto_profile_name if you have a profile that
|
|
# you can use, otherwise use normal AWS methods (env variables, instance
|
|
# profile, etc)
|
|
#
|
|
# If you want to use a region other than us-east-1 (and only us-east-2
|
|
# works with ansible-test), pass -e region=us-east-2
|
|
#
|
|
# Requires 2.4 for iam_managed_policy and iam_group
|
|
|
|
- hosts: localhost
|
|
connection: local
|
|
gather_facts: no
|
|
vars:
|
|
aws_region: "{{ region|default('us-east-1') }}"
|
|
|
|
tasks:
|
|
- name: Check that required variables are set
|
|
fail:
|
|
msg: "You must set the iam_group variable"
|
|
when: iam_group is not defined
|
|
|
|
- name: Get aws account ID
|
|
aws_caller_facts:
|
|
register: aws_caller_facts
|
|
|
|
- name: Set aws_account_fact
|
|
set_fact:
|
|
aws_account: "{{ aws_caller_facts.account }}"
|
|
|
|
|
|
- name: Ensure Managed IAM policies exist
|
|
iam_managed_policy:
|
|
policy_name: "AnsibleTest{{ item|basename|regex_replace('-.*', '')|capitalize }}Policy"
|
|
policy: "{{ lookup('template', item) }}"
|
|
state: present
|
|
profile: "{{ profile|default(omit) }}"
|
|
with_fileglob: "testing_policies/*.json"
|
|
register: iam_managed_policies
|
|
|
|
- debug:
|
|
msg: "{{ iam_managed_policies | json_query('results[].policy.policy_name') }}"
|
|
|
|
- name: Ensure IAM group exists and attach managed policies
|
|
iam_group:
|
|
name: "{{ iam_group }}"
|
|
state: present
|
|
managed_policy: "{{ iam_managed_policies | json_query('results[].policy.policy_name') }}"
|
|
profile: "{{ profile|default(omit) }}"
|