如何在 Ansible Tower 中运行 AWS CLI 命令任务

Question

The AWS CLI command tasks in Ansible playbooks work fine form command line if AWS credentials are specified as environment variables as per boto requirements. More info can be found here Environment Variables . But they fail to run in Tower because it exports another set of env. vars:

AWS_ACCESS_KEY
AWS_SECRET_KEY

In order to make them work in Tower just add the below in task definition:

environment:
  AWS_ACCESS_KEY_ID: "{{ lookup('env','AWS_ACCESS_KEY') }}"
  AWS_SECRET_ACCESS_KEY: "{{ lookup('env','AWS_SECRET_KEY') }}"

eg this task:

- name: Describe instances
  command: aws ec2 describe-instances --region us-east-1

will transform to:

- name: Describe instances
  command: aws ec2 describe-instances --region us-east-1
  environment:
    AWS_ACCESS_KEY_ID: "{{ lookup('env','AWS_ACCESS_KEY') }}"
    AWS_SECRET_ACCESS_KEY: "{{ lookup('env','AWS_SECRET_KEY') }}"

NOTE: This only injects env.var. for the specific task - not the whole playbook! So you have to amend this way every AWS CLI task.

Answer 1

Put your environment variable in a file:

export AWS_ACCESS_KEY=
export AWS_SECRET_KEY=

save the file in ~/.vars in the remote host and then in your playbook.

- name: Describe instances
  command: source ~/.vars && aws ec2 describe-instances --region us-east-2

for security you could delete the file after run and copy again in the next play.

Answer 2

While this may not be applicable to tower we use the opensource version. Setup your .aws and/or .boto files.