Ansible无法从〜/ .aws / credentials中读取凭证

Question

I am running ansible with dynamic inventory . When the aws cli was setup with aws configure command than the ansible commands with dynamic invetory was running properly. But I want to have multiple profiles to be used by dynamic inventory so I have added profile in ~/.aws/credentials

[personal]
aws_access_key_id = XXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXX

[default]
aws_access_key_id = XXXXXXXXXXXXXXX
aws_secret_access_key = XXXXXXXXXXXXXXXXX

ansible not picking up these credentials and on running ./ec2.py --list it is giving the error:

Looks like AWS is down again:
EC2ResponseError: 401 Unauthorized
<?xml version="1.0" encoding="UTF-8"?>
<Response><Errors><Error><Code>AuthFailure</Code><Message>Authorization header or parameters are not formatted correctly.</Message></Error></Errors><RequestID>349d5311-54db-4e79-9bbc-2d60b9f15da5</RequestID></Response>

Answer 1

您是否尝试过将--profile PROFILE开关添加到ec2.py，如下所示。

./ec2.py --list --profile personal

Answer 2

After @uptime365's answer, this is most likely not an Ansible/ec2.py problem. Here's my troubleshooting steps:

Can you use the awscli with those credentials?

aws ec2 describe-instances --page-size 5
aws ec2 describe-instances --page-size 5 --profile personal

Can you use awscli with the credentials manually included?

Note there's no need to use profile since you are specifying the keys.

AWS_ACCESS_KEY_ID="AKIA.." AWS_SECRET_ACCESS_KEY=".."  aws ec2 describe-instances --page-size 5

If it complains about the region, add AWS_DEFAULT_REGION="us-east-1" or the region of your choice.

Neither of these work

You have a problem with your access key or secret. How many characters are in each? The key should be 20 characters, all uppercase letters and numbers. The secret is 40 characters, upper/lower/numbers/punctuation.

Answer 3

I ran into this issue too, and eventually solved it; the problem was that the clock on my machine had drifted by a couple of minutes. Setting the time correctly fixed the issue.

Along the way I learned that aws cli uses boto3, whereas ec2.py uses boto. It seems that boto3 works slightly differently for authentication, because like @drishti the CLI was working for me even when ec2.py was not.