# AWS IAM modules

**URL:** <https://forum.ansible.com/t/aws-iam-modules/19663>\
**Category:** Ansible Developer\
**Tags:** aws\
**Created:** [October 31, 2015, 3:52am UTC](https://forum.ansible.com/t/aws-iam-modules/19663 "2015-10-31T03:52:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![K\_Cheng](https://avatars.discourse-cdn.com/v4/letter/k/8baadc/32.png) [@K\_Cheng](https://forum.ansible.com/u/K_Cheng)\
**Post date:** [October 31, 2015, 3:52am UTC](https://forum.ansible.com/t/aws-iam-modules/19663/1 "2015-10-31T03:52:00Z")

</div>

Hey guys,

I’ve been using the beta 2.0 code for IAM modules in Ansible and was hoping to propose a couple of changes to these modules?

Firstly, I’ve noticed that the creates of an IAM role doesn’t return the AWS boto result. Instead it returns a list of all the IAM roles including the newly created one.

This seems a little odd, as surely if I just created a new IAM role, I want the results that AWS provides as part of that command.

AWS response:

> `{ 'Role': { 'Path': 'string', 'RoleName': 'string', 'RoleId': 'string', 'Arn': 'string', 'CreateDate': datetime(2015, 1, 1), 'AssumeRolePolicyDocument': 'string' } }`

I was wondering whether there was any objections to updating from the following example:

`  
def create\_role(module, iam, name, path, role\_list, prof\_list):  
changed = False  
try:  
if name not in role\_list:  
changed = True  
iam.create\_role(  
name, path=path).create\_role\_response.create\_role\_result.role.role\_name

if name not in prof\_list:  
iam.create\_instance\_profile(name, path=path)  
iam.add\_role\_to\_instance\_profile(name, name)  
except boto.exception.BotoServerError, err:  
module.fail\_json(changed=changed, msg=str(err))  
else:  
updated\_role\_list = [rl[‘role\_name’] for rl in iam.list\_roles().list\_roles\_response.  
list\_roles\_result.roles]  
**return changed, updated\_role\_list**  
`

To this instead?

`  
def create\_role(module, iam, name, path, role\_list, prof\_list):  
changed = False  
try:  
if name not in role\_list:  
changed = True  
iam.create\_role(  
name, path=path).create\_role\_response.create\_role\_result.role.role\_name

if name not in prof\_list:  
iam.create\_instance\_profile(name, path=path)  
iam.add\_role\_to\_instance\_profile(name, name)  
except boto.exception.BotoServerError, err:  
module.fail\_json(changed=changed, msg=str(err))  
else:  
updated\_role\_list = [rl[‘role\_name’] for rl in iam.list\_roles().list\_roles\_response.  
list\_roles\_result.roles]  
**return result**  
`

The other thing that I’ve found but I’m not 100% sure how to fix is AWS’s eventual consistency issue. I can see that for the ec2 modules it’s being catered for by using a wait\_for timeout to check for running state. But I’m not sure how IAM would work.

I’ve had the issue where I create a new IAM role for EC2 to consume, but when I go to attach it slightly later on in the play, I get instance\_profile does not exist even though it does. If I rerun the play it’s fine, but this would cause me some issues as I’m running some of these plays using the in-memory hosts/variables.

_“Instance creation failed =\> InvalidParameterValue: Value (vc\_spectre\_mongod\_ec2\_iam\_role) for parameter iamInstanceProfile.name is invalid. Invalid IAM Instance Profile name”_

Karen

---

<div class="post-metadata">

**Author:** ![Jonathan\_Davila](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jonathan\_Davila](https://forum.ansible.com/u/Jonathan_Davila)\
**Post date:** [November 3, 2015, 5:54pm UTC](https://forum.ansible.com/t/aws-iam-modules/19663/2 "2015-11-03T17:54:43Z")

</div>

I’m open to a pull request that implements this, just be sure to update all calls to `create_role`. Be sure to mention @defionscode when you make the PR.