ec2_group: error returned does not return AWS insufficient permissions error when adding tags

[aplummerunsw]

SUMMARY

When using AWS IAM credentials that are granted insufficient AWS IAM permissions to add tags to an EC2 Security Group, ie, the CreateTags permission, you should received an error that the credentials were not authorised to perform the CreateTags operation.

Instead, the error returned is:
TypeError: fail_json() takes exactly 1 argument (3 given)

I searched for open issues for "ec2_group" and "fail_json", found nothing open.

Looked at devel branch of "amazon.aws/plugins/modules/ec2_group.py" and the 'update_tags' function still has the same line as tested version..

I am still using the latest version of ansible 2.9

ISSUE TYPE

• Bug Report

COMPONENT NAME

"amazon.aws/plugins/modules/ec2_group.py"

ANSIBLE VERSION

ansible 2.9.15
  config file = /home/z3266423/.ansible.cfg
  configured module search path = ['/home/z3266423/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/z3266423/.virtualenvs/ansible_playbooks_survey_editor/lib64/python3.7/site-packages/ansible
  executable location = /home/z3266423/.virtualenvs/ansible_playbooks_survey_editor/bin/ansible
  python version = 3.7.7 (default, Mar 13 2020, 21:39:43) [GCC 9.2.1 20190827 (Red Hat 9.2.1-1)]

CONFIGURATION

ANSIBLE_PIPELINING(/home/z3266423/.ansible.cfg) = True
DEFAULT_ROLES_PATH(env: ANSIBLE_ROLES_PATH) = ['/home/z3266423/Documents/ansible/roles/ces_survey_editor']
HOST_KEY_CHECKING(/home/z3266423/.ansible.cfg) = False

OS / ENVIRONMENT

]$ lsb_release -a
LSB Version:    :core-4.1-amd64:core-4.1-noarch
Distributor ID: Fedora
Description:    Fedora release 30 (Thirty)
Release:        30
Codename:       Thirty

STEPS TO REPRODUCE

Deploy an EC2 Security Group using the 'ec2_group' module using AWS credentials that do not have the "CreateTags" permission

- ec2_group:
    state: 'present'
    aws_access_key: "{{ lookup('ENV', 'AWS_ACCESS_KEY_ID') }}"
    aws_secret_key: "{{ lookup('ENV', 'AWS_SECRET_ACCESS_KEY_ID') }}"
    security_token: "{{ lookup('ENV', 'AWS_SESSION_TOKEN') }}"
    region: 'ap-southeast-2'
    name: 'test-group'
    description: 'this is a test group'
    tags:
      name: test-group

AWS_ACCESS_KEY_ID used is missing the AWS IAM EC2 permission CreateTags

EXPECTED RESULTS

The return error should contain a message similar to:

ClientError: An error occurred (UnauthorizedOperation) when calling the CreateTags operation: You are not authorized to perform this operation. Encoded authorization failure message:

Followed by the encoded error message.

This correct error message was generated by manually editing:

ansible/modules/cloud/amazon/ec2_group.py

and changing the code for the update_tags function where the call to fail_json() is changed to fail_json_aws().
Original line:

module.fail_json(e, msg="Unable to add tags {0}".format(tags_need_modify))

Changed line:

module.fail_json_aws(e, msg="Unable to add tags {0}".format(tags_need_modify))

Full function of update_tags before edit:

def update_tags(client, module, group_id, current_tags, tags, purge_tags):
    tags_need_modify, tags_to_delete = compare_aws_tags(current_tags, tags, purge_tags)

    if not module.check_mode:
        if tags_to_delete:
            try:
                client.delete_tags(Resources=[group_id], Tags=[{'Key': tag} for tag in tags_to_delete])
            except (BotoCoreError, ClientError) as e:
                module.fail_json_aws(e, msg="Unable to delete tags {0}".format(tags_to_delete))

        # Add/update tags
        if tags_need_modify:
            try:
                client.create_tags(Resources=[group_id], Tags=ansible_dict_to_boto3_tag_list(tags_need_modify))
            except (BotoCoreError, ClientError) as e:
                module.fail_json(e, msg="Unable to add tags {0}".format(tags_need_modify))

    return bool(tags_need_modify or tags_to_delete)

Full function of update_tags after edit:

def update_tags(client, module, group_id, current_tags, tags, purge_tags):
    tags_need_modify, tags_to_delete = compare_aws_tags(current_tags, tags, purge_tags)

    if not module.check_mode:
        if tags_to_delete:
            try:
                client.delete_tags(Resources=[group_id], Tags=[{'Key': tag} for tag in tags_to_delete])
            except (BotoCoreError, ClientError) as e:
                module.fail_json_aws(e, msg="Unable to delete tags {0}".format(tags_to_delete))

        # Add/update tags
        if tags_need_modify:
            try:
                client.create_tags(Resources=[group_id], Tags=ansible_dict_to_boto3_tag_list(tags_need_modify))
            except (BotoCoreError, ClientError) as e:
                module.fail_json_aws(e, msg="Unable to add tags {0}".format(tags_need_modify))

    return bool(tags_need_modify or tags_to_delete)

I humbly suggest that this change be added to this file.

ACTUAL RESULTS

An error indicating that the fail_json() function was given too many arguments is returned, similar to:

: FAILED! => {                                                                                                                                                        "changed": false,
    "module_stderr": "Traceback (most recent call last):\n  File \"<stdin>\", line 102, in <module>\n  File \"<stdin>\", line 94, in _ansiballz_main\n  File \"<stdin>\", line 40, in invoke_
module\n  File \"/usr/lib64/python2.7/runpy.py\", line 188, in run_module\n    fname, loader, pkg_name)\n  File \"/usr/lib64/python2.7/runpy.py\", line 82, in _run_module_code\n    mod_name
, mod_fname, mod_loader, pkg_name)\n  File \"/usr/lib64/python2.7/runpy.py\", line 72, in _run_code\n    exec code in run_globals\n  File \"/tmp/ansible_ec2_group_payload_5r2MgW/ansible_ec2
_group_payload.zip/ansible/modules/cloud/amazon/ec2_group.py\", line 1265, in <module>\n  File \"/tmp/ansible_ec2_group_payload_5r2MgW/ansible_ec2_group_payload.zip/ansible/modules/cloud/amazon/ec2_group.py\", line 1142, in main\n  File \"/tmp/ansible_ec2_group_payload_5r2MgW/ansible_ec2_group_payload.zip/ansible/modules/cloud/amazon/ec2_group.py\", line 796, in update_tags\n
  File \"/tmp/ansible_ec2_group_payload_5r2MgW/ansible_ec2_group_payload.zip/ansible/module_utils/aws/core.py\", line 163, in fail_json\nTypeError: fail_json() takes exactly 1 argument (3 g
iven)\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error",

is returned

[tremble]

#211 merged, closing.