Try SpotterManage inline IAM policies for users, groups, and roles
| "added in version" 1.0.0 of community.aws"
Authors: Jonathan I. Davila (@defionscode), Dennis Podkovyrin (@sbj-ss)
Install with ansible-galaxy collection install community.aws:==4.3.0
collections:
- name: community.aws
version: 4.3.0Allows uploading or removing inline IAM policies for IAM users, groups or roles.
To administer managed policies please see M(community.aws.iam_user), M(community.aws.iam_role), M(community.aws.iam_group) and M(community.aws.iam_managed_policy)
# Create a policy with the name of 'Admin' to the group 'administrators'
- name: Assign a policy called Admin to the administrators group
community.aws.iam_policy:
iam_type: group
iam_name: administrators
policy_name: Admin
state: present
policy_document: admin_policy.json
# Advanced example, create two new groups and add a READ-ONLY policy to both
# groups.
- name: Create Two Groups, Mario and Luigi
community.aws.iam_group:
name: "{{ item }}"
state: present
loop:
- Mario
- Luigi
register: new_groups
- name: Apply READ-ONLY policy to new groups that have been recently created
community.aws.iam_policy:
iam_type: group
iam_name: "{{ item.iam_group.group.group_name }}"
policy_name: "READ-ONLY"
policy_json: "{{ lookup('template', 'readonly.json.j2') }}"
state: present
loop: "{{ new_groups.results }}"
# Create a new S3 policy with prefix per user
- name: Create S3 policy from template
community.aws.iam_policy:
iam_type: user
iam_name: "{{ item.user }}"
policy_name: "s3_limited_access_{{ item.prefix }}"
state: present
policy_json: "{{ lookup('template', 's3_policy.json.j2') }}"
loop:
- user: s3_user
prefix: s3_user_prefix
state:
choices:
- present
- absent
default: present
description:
- Whether to create or delete the IAM policy.
type: str
region:
aliases:
- aws_region
- ec2_region
description:
- The AWS region to use. If not specified then the value of the AWS_REGION or EC2_REGION
environment variable, if any, is used. See U(http://docs.aws.amazon.com/general/latest/gr/rande.html#ec2_region)
type: str
ec2_url:
aliases:
- aws_endpoint_url
- endpoint_url
description:
- Url to use to connect to EC2 or your Eucalyptus cloud (by default the module will
use EC2 endpoints). Ignored for modules where region is required. Must be specified
for all other modules if region is not used. If not set then the value of the EC2_URL
environment variable, if any, is used.
type: str
profile:
aliases:
- aws_profile
description:
- Uses a boto profile. Only works with boto >= 2.24.0.
- Using I(profile) will override I(aws_access_key), I(aws_secret_key) and I(security_token)
and support for passing them at the same time as I(profile) has been deprecated.
- I(aws_access_key), I(aws_secret_key) and I(security_token) will be made mutually
exclusive with I(profile) after 2022-06-01.
type: str
iam_name:
description:
- Name of IAM resource you wish to target for policy actions. In other words, the
user name, group name or role name.
required: true
type: str
iam_type:
choices:
- user
- group
- role
description:
- Type of IAM resource.
required: true
type: str
aws_config:
description:
- A dictionary to modify the botocore configuration.
- Parameters can be found at U(https://botocore.amazonaws.com/v1/documentation/api/latest/reference/config.html#botocore.config.Config).
- Only the 'user_agent' key is used for boto modules. See U(http://boto.cloudhackers.com/en/latest/boto_config_tut.html#boto)
for more boto configuration.
type: dict
policy_json:
description:
- A properly json formatted policy as string.
- Mutually exclusive with I(policy_document).
type: json
policy_name:
description:
- The name label for the policy to create or remove.
required: true
type: str
aws_ca_bundle:
description:
- The location of a CA Bundle to use when validating SSL certificates.
- Only used for boto3 based modules.
- 'Note: The CA Bundle is read ''module'' side and may need to be explicitly copied
from the controller if not run locally.'
type: path
aws_access_key:
aliases:
- ec2_access_key
- access_key
description:
- AWS access key. If not set then the value of the AWS_ACCESS_KEY_ID, AWS_ACCESS_KEY
or EC2_ACCESS_KEY environment variable is used.
- If I(profile) is set this parameter is ignored.
- Passing the I(aws_access_key) and I(profile) options at the same time has been deprecated
and the options will be made mutually exclusive after 2022-06-01.
type: str
aws_secret_key:
aliases:
- ec2_secret_key
- secret_key
description:
- AWS secret key. If not set then the value of the AWS_SECRET_ACCESS_KEY, AWS_SECRET_KEY,
or EC2_SECRET_KEY environment variable is used.
- If I(profile) is set this parameter is ignored.
- Passing the I(aws_secret_key) and I(profile) options at the same time has been deprecated
and the options will be made mutually exclusive after 2022-06-01.
type: str
security_token:
aliases:
- aws_security_token
- access_token
description:
- AWS STS security token. If not set then the value of the AWS_SECURITY_TOKEN or EC2_SECURITY_TOKEN
environment variable is used.
- If I(profile) is set this parameter is ignored.
- Passing the I(security_token) and I(profile) options at the same time has been deprecated
and the options will be made mutually exclusive after 2022-06-01.
type: str
validate_certs:
default: true
description:
- When set to "no", SSL certificates will not be validated for boto versions >= 2.6.0.
type: bool
policy_document:
description:
- The path to the properly json formatted policy file.
- Mutually exclusive with I(policy_json).
- This option has been deprecated and will be removed in a release after 2022-06-01. The
existing behavior can be reproduced by using the I(policy_json) option and reading
the file using the lookup plugin.
type: str
skip_duplicates:
description:
- When I(skip_duplicates=true) the module looks for any policies that match the document
you pass in. If there is a match it will not make a new policy object with the same
rules.
- The current default is C(true). However, this behavior can be confusing and as
such the default will change to C(false) in a release after 2022-06-01. To maintain
the existing behavior explicitly set I(skip_duplicates=true).
type: bool
debug_botocore_endpoint_logs:
default: 'no'
description:
- Use a botocore.endpoint logger to parse the unique (rather than total) "resource:action"
API calls made during a task, outputing the set to the resource_actions key in the
task results. Use the aws_resource_action callback to output to total list made
during a playbook. The ANSIBLE_DEBUG_BOTOCORE_LOGS environment variable may also
be used.
type: bool
policy_names:
description: A list of names of the inline policies embedded in the specified IAM
resource (user, group, or role).
elements: str
returned: always
type: list