# Ansible ec2 to assume or not.

**URL:** <https://forum.ansible.com/t/ansible-ec2-to-assume-or-not/22314>\
**Category:** Ansible Project\
**Created:** [August 18, 2016, 4:53am UTC](https://forum.ansible.com/t/ansible-ec2-to-assume-or-not/22314 "2016-08-18T04:53:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_Blackburn](https://avatars.discourse-cdn.com/v4/letter/d/85f322/32.png) [@David\_Blackburn](https://forum.ansible.com/u/David_Blackburn)\
**Post date:** [August 18, 2016, 4:53am UTC](https://forum.ansible.com/t/ansible-ec2-to-assume-or-not/22314/1 "2016-08-18T04:53:14Z")

</div>

I am writing play’s using the ec2 cloud modules and would like to have the option to run the play using an assumed role or just standard IAM keys. I can use logic to let the play know if I will use IAM or a assumed role but when I skip the “Assume” task the play errors out on the unused variables in the ec2 module. Is there a way I can tell a task to ignore the variables in this task ec2\_key when they are not needed, or do I have to write two play books?

Thanks  
Dave

- name: Test Assume Variables.  
hosts: localhost  
connection: local  
vars:  
arn: true  
tasks:

- name: Assume  
sts\_assume\_role:  
region: us-west-2  
role\_arn: “{{ arn }}”  
role\_session\_name: “admin”  
register: assumed\_role  
**when: arn != true**

- name: ec2 key  
ec2\_key:  
**aws\_access\_key: “{{ assumed\_role.sts\_creds.access\_key }}”**  
**aws\_secret\_key: “{{ assumed\_role.sts\_creds.secret\_key }}”**  
**security\_token: “{{ assumed\_role.sts\_creds.session\_token }}”**  
region: us-west-2  
name: exampleKEYABC

---

<div class="post-metadata">

**Author:** ![Kai\_Stian\_Olstad](https://avatars.discourse-cdn.com/v4/letter/k/e19adc/32.png) [@Kai\_Stian\_Olstad](https://forum.ansible.com/u/Kai_Stian_Olstad)\
**Post date:** [August 18, 2016, 7:35am UTC](https://forum.ansible.com/t/ansible-ec2-to-assume-or-not/22314/2 "2016-08-18T07:35:08Z")

</div>

Check out the filter default(omit)

[https://docs.ansible.com/ansible/playbooks\_filters.html#omitting-undefined-variables-and-parameters](https://docs.ansible.com/ansible/playbooks_filters.html#omitting-undefined-variables-and-parameters)

---

<div class="post-metadata">

**Author:** ![viper233](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/viper233/32/2060_2.png) [@viper233](https://forum.ansible.com/u/viper233)\
**Post date:** [August 19, 2016, 1:28am UTC](https://forum.ansible.com/t/ansible-ec2-to-assume-or-not/22314/3 "2016-08-19T01:28:27Z")

</div>

if the token is null the tasks will still run.

---

<div class="post-metadata">

**Author:** ![David\_Blackburn](https://avatars.discourse-cdn.com/v4/letter/d/85f322/32.png) [@David\_Blackburn](https://forum.ansible.com/u/David_Blackburn)\
**Post date:** [August 20, 2016, 2:41am UTC](https://forum.ansible.com/t/ansible-ec2-to-assume-or-not/22314/4 "2016-08-20T02:41:58Z")

</div>

Many thanks for your reply Kai, this only seems to work on module parameters and not bare variables.

Dave

---

<div class="post-metadata">

**Author:** ![David\_Blackburn](https://avatars.discourse-cdn.com/v4/letter/d/85f322/32.png) [@David\_Blackburn](https://forum.ansible.com/u/David_Blackburn)\
**Post date:** [August 20, 2016, 2:42am UTC](https://forum.ansible.com/t/ansible-ec2-to-assume-or-not/22314/5 "2016-08-20T02:42:30Z")

</div>

Thanks for your Reply Steve, I did think I tested this I will have to give it another try…  
Dave