# AWS IAM role and policy assume\_role\_policy\_document not parsing json

**URL:** <https://forum.ansible.com/t/aws-iam-role-and-policy-assume-role-policy-document-not-parsing-json/24838>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [June 28, 2017, 9:52am UTC](https://forum.ansible.com/t/aws-iam-role-and-policy-assume-role-policy-document-not-parsing-json/24838 "2017-06-28T09:52:25Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Darragh\_Grealish](https://avatars.discourse-cdn.com/v4/letter/d/f475e1/32.png) [@Darragh\_Grealish](https://forum.ansible.com/u/Darragh_Grealish)\
**Post date:** [June 28, 2017, 9:52am UTC](https://forum.ansible.com/t/aws-iam-role-and-policy-assume-role-policy-document-not-parsing-json/24838/1 "2017-06-28T09:52:25Z")

</div>

Hi,

I’ve been struggling to get IAM policy and IAM role working properly,  
These are the two modules with the issues:

[http://docs.ansible.com/ansible/iam\_policy\_module.html](http://docs.ansible.com/ansible/iam_policy_module.html)

[http://docs.ansible.com/ansible/iam\_role\_module.html#examples](http://docs.ansible.com/ansible/iam_role_module.html#examples)

IAM\_ROLE is where the issue happens:  
when creating a IAM\_policy works and it accepts a policy\_json file, with no issues.  
next step is to create IAM\_role and assotate that policy with the role and add a “Trust relationship” as AWS calls it. this is passed as a small json file but fails at assume\_role\_policy\_document:  
The Json is very simple,  
{“Version”: “2008-10-17”,“Statement”: [{“Effect”: “Allow”,“Principal”: {“Service”: “[ec2.amazonaws.com](http://ec2.amazonaws.com)”},“Action”: “sts:AssumeRole”}]}

task config:

- name: Create IAM Role with policy  
iam\_role:  
name: “iamrole-{{ aws\_deploy\_stage }}-{{ aws\_deployment\_tag }}”  
state: present  
**assume\_role\_policy\_document: “{{ lookup(‘file’.'…/templates/role-trust-policy-document.json) }}”**  
managed\_policy:
- arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM
- arn:aws:iam::aws:policy/AWSXrayFullAccess
- “policy-{{ aws\_deploy\_stage }}-{{ aws\_deployment\_name }}”

fatal: [localhost]: FAILED! =\> {  
“failed”: true,  
“msg”: “template error while templating string: expected name or number. String: {{ lookup  
(‘file’.‘…/templates/role-trust-policy-document.json’)|to\_json }}”  
}

if I just pass a string in double quotes “” I managed to make the module pass this to AWS and it expects JSON

“msg”: “An error occurred (MalformedPolicyDocument) when calling the CreateRole operation:  
This policy contains invalid Json”,  
“response\_metadata”: {  
“http\_headers”: {  
“connection”: “close”,  
“content-length”: “288”,  
“content-type”: “text/xml”,  
“date”: “Wed, 28 Jun 2017 09:12:50 GMT”,  
“x-amzn-requestid”: “f61bb6b4-5be1-11e7-9679-d5c1bf3ed860”  
},  
“http\_status\_code”: 400,  
“request\_id”: “f61bb6b4-5be1-11e7-9679-d5c1bf3ed860”,  
“retry\_attempts”: 0  
}

after spending quite some time googling and reading github issues, there is allot of related issues, both closed and opened but none accurately tell where the issue is  
if looks like a PR open tries to solve the great issue [https://github.com/ansible/ansible/pull/22097](https://github.com/ansible/ansible/pull/22097)  
another but old [https://github.com/ansible/ansible-modules-core/issues/2688](https://github.com/ansible/ansible-modules-core/issues/2688)

I hope someone else encounters this issue. any feedback welcome