ansible/hacking/aws_config/setup-iam.yml
Will Thames a1d3cf488d [cloud][test]Add missing IAM policy for cloudfront (#38248)
Cloudfront needs CreateOriginAccessIdentity

Add profile parameter to setup-iam.yml. Could arguably just use
AWS_PROFILE but given that other tasks are using profile, should
be consistent.
2018-04-05 14:06:04 -04:00

54 lines
1.8 KiB
YAML

# Usage: ansible-playbook setup-iam.yml -e iam_group=ansible_test -vv
#
# Creates IAM policies and associates them with iam_group. This group
# can then be associated with an appropriate user
#
# You can pass -e profile=boto_profile_name if you have a profile that
# you can use, otherwise use normal AWS methods (env variables, instance
# profile, etc)
#
# If you want to use a region other than us-east-1 (and only us-east-2
# works with ansible-test), pass -e region=us-east-2
#
# Requires 2.4 for iam_managed_policy and iam_group
- hosts: localhost
connection: local
gather_facts: no
vars:
aws_region: "{{ region|default('us-east-1') }}"
tasks:
- name: Check that required variables are set
fail:
msg: "You must set the iam_group variable"
when: iam_group is not defined
- name: Get aws account ID
aws_caller_facts:
profile: "{{ profile|default(omit) }}"
register: aws_caller_facts
- name: Set aws_account_fact
set_fact:
aws_account: "{{ aws_caller_facts.account }}"
- name: Ensure Managed IAM policies exist
iam_managed_policy:
policy_name: "AnsibleTest{{ item|basename|regex_replace('-.*', '')|capitalize }}Policy"
policy: "{{ lookup('template', item) }}"
state: present
profile: "{{ profile|default(omit) }}"
with_fileglob: "testing_policies/*.json"
register: iam_managed_policies
- debug:
msg: "{{ iam_managed_policies | json_query('results[].policy.policy_name') }}"
- name: Ensure IAM group exists and attach managed policies
iam_group:
name: "{{ iam_group }}"
state: present
managed_policy: "{{ iam_managed_policies | json_query('results[].policy.policy_name') }}"
profile: "{{ profile|default(omit) }}"