# AWS Playbook says "NoCredentialsError: Unable to locate credentials" **URL:** \ **Category:** Ansible Project\ **Tags:** ubuntu, aws, ansible-lint\ **Created:** [August 7, 2018, 6:23pm UTC](https://forum.ansible.com/t/aws-playbook-says-nocredentialserror-unable-to-locate-credentials/28284 "2018-08-07T18:23:09Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![ttwalto](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@ttwalto](https://forum.ansible.com/u/ttwalto)\ **Post date:** [August 7, 2018, 6:23pm UTC](https://forum.ansible.com/t/aws-playbook-says-nocredentialserror-unable-to-locate-credentials/28284/1 "2018-08-07T18:23:09Z")
\*\* A heads up: the following post is very detailed, and I eventually figured out the problem. So if you’re not up for wading through it, that’s cool. I have an Ansible playbook that I’m trying to run. It creates an AWS VPC, so it requires AWS credentials. I’ve set up a couple of environment variables and run: aws configure So I have environment variables and the two files: $ ll ~/.aws/ total 12 drwxrwxr-x 3 developer developer 4096 2018-08-03\_16:59 cli/ -rw------- 1 developer developer 159 2018-08-06\_11:26 config -rw------- 1 developer developer 235 2018-08-06\_11:22 credentials $ cat ~/.aws/config [default] region = us-east-1 cli\_timestamp\_format = iso8601 [profile TestAdmin] role\_arn = arn:aws:iam::327329368532:role/Test-Admin source\_profile = default output = json region = us-east-1 $ cat ~/.aws/credentials [default] aws\_secret\_access\_key = a9xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx aws\_access\_key\_id = ARxxxxxxxxxxxxxx [TestAdmin] aws\_secret\_access\_key = a9xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx aws\_access\_key\_id = ARxxxxxxxxxxxxxx $ env | grep AWS AWS\_PROFILE=TestAdmin AWS\_REGION=us-east-1 If I use awscli to fetch a list of VPCs, to create one, and to delete one, it works: $ aws ec2 describe-vpcs { “Vpcs”: [ { “VpcId”: “vpc-423ce7e8”, “InstanceTenancy”: “default”, “Tags”: [ { “Value”: “vpcone”, “Key”: “Name” } ], “CidrBlockAssociationSet”: [ { “AssociationId”: “vpc-cidr-assoc-fcb91d90”, “CidrBlock”: “10.100.0.0/16”, “CidrBlockState”: { “State”: “associated” } } ], “State”: “available”, “DhcpOptionsId”: “dopt-8d3787f4”, “CidrBlock”: “10.100.0.0/16”, “IsDefault”: false } ] } $ aws ec2 create-vpc --cidr-block 10.103.0.0/16 { “Vpc”: { “VpcId”: “vpc-bd743cc7”, “InstanceTenancy”: “default”, “Tags”: , “CidrBlockAssociationSet”: [ { “AssociationId”: “vpc-cidr-assoc-e058fe8c”, “CidrBlock”: “10.103.0.0/16”, “CidrBlockState”: { “State”: “associated” } } ], “Ipv6CidrBlockAssociationSet”: , “State”: “pending”, “DhcpOptionsId”: “dopt-8d3787f4”, “CidrBlock”: “10.103.0.0/16”, “IsDefault”: false } } $ aws ec2 delete-vpc --vpc-id vpc-bd885cc7 $ I have this in the output of ‘pip list’: $ pip list | grep -E ‘(boto|ansible)’ ansible 2.6.2 ansible-lint 3.4.23 boto 2.48.0 boto3 1.7.50 botocore 1.10.50 I’m on Ubuntu and here are some apt packages: $ cat /etc/lsb-release DISTRIB\_ID=Ubuntu DISTRIB\_RELEASE=16.04 DISTRIB\_CODENAME=xenial DISTRIB\_DESCRIPTION=“Ubuntu 16.04.5 LTS” $ apt search ^ansible$ Sorting… Done Full Text Search… Done ansible/xenial,xenial,now 2.6.2-1ppa~xenial all [installed] Ansible IT Automation $ apt search ^python.?$ Sorting… Done Full Text Search… Done python/xenial-updates,now 2.7.12-1~16.04 amd64 [installed] interactive high-level object-oriented language (default version) python3/xenial,now 3.5.1-3 amd64 [installed] interactive high-level object-oriented language (default python3 version) Here’s ansible reporting its version: $ ansible --version ansible 2.6.2 config file = /etc/ansible/ansible.cfg configured module search path = [u’/usr/local/lib/python2.7/dist-packages/ara/plugins/modules’] ansible python module location = /usr/local/lib/python2.7/dist-packages/ansible executable location = /usr/local/bin/ansible python version = 2.7.12 (default, Dec 4 2017, 14:50:18) [GCC 5.4.0 20160609] All that should be good, I think. But when I run this playbook from the openshift-ansible project, I get a credentials error: $ ansible-playbook -i /var/www/html/provision-openshift/inventory/provisioning-inventory.ini /var/www/html/openshift-ansible/playbooks/aws/openshift-cluster/prerequisites.yml -e @/var/www/html/provision-openshift/inventory/provisioning\_vars.yml -vvv ansible-playbook 2.6.2 config file = /etc/ansible/ansible.cfg configured module search path = [u’/usr/local/lib/python2.7/dist-packages/ara/plugins/modules’] ansible python module location = /usr/local/lib/python2.7/dist-packages/ansible executable location = /usr/local/bin/ansible-playbook python version = 2.7.12 (default, Dec 4 2017, 14:50:18) [GCC 5.4.0 20160609] Using /etc/ansible/ansible.cfg as config file Parsed /var/www/html/provision-openshift/inventory/provisioning-inventory.ini inventory source with ini plugin [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match ‘all’ PLAYBOOK: prerequisites.yml \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* 3 plays in /var/www/html/openshift-ansible/playbooks/aws/openshift-cluster/prerequisites.yml PLAY [localhost] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* META: ran handlers TASK [openshift\_aws : Create AWS VPC] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* task path: /var/www/html/openshift-ansible/roles/openshift\_aws/tasks/vpc.yml:2 Monday 06 August 2018 13:38:42 -0400 (0:00:00.082) 0:00:00.082 \*\*\*\*\*\*\*\*\* \<127.0.0.1\> ESTABLISH LOCAL CONNECTION FOR USER: developer \<127.0.0.1\> EXEC /bin/sh -c ‘echo ~developer && sleep 0’ \<127.0.0.1\> EXEC /bin/sh -c ‘( umask 77 && mkdir -p “`echo /home/developer/.ansible/tmp/ansible-tmp-1533577122.72-96497498776150`” && echo ansible-tmp-1533577122.72-96497498776150=“`echo /home/developer/.ansible/tmp/ansible-tmp-1533577122.72-96497498776150`” ) && sleep 0’ Using module file /usr/local/lib/python2.7/dist-packages/ansible/modules/cloud/amazon/ec2\_vpc\_net.py \<127.0.0.1\> PUT /home/developer/.ansible/tmp/ansible-local-8154HxVYj9/tmp9sLZEU TO /home/developer/.ansible/tmp/ansible-tmp-1533577122.72-96497498776150/ec2\_vpc\_net.py \<127.0.0.1\> EXEC /bin/sh -c ‘chmod u+x /home/developer/.ansible/tmp/ansible-tmp-1533577122.72-96497498776150/ /home/developer/.ansible/tmp/ansible-tmp-1533577122.72-96497498776150/ec2\_vpc\_net.py && sleep 0’ \<127.0.0.1\> EXEC /bin/sh -c ‘sudo -H -S -n -u root /bin/sh -c ‘"’“‘echo BECOME-SUCCESS-bjpqfqmloapttckvdgwmfalyyeckoclc; /usr/bin/python /home/developer/.ansible/tmp/ansible-tmp-1533577122.72-96497498776150/ec2\_vpc\_net.py’”’"’ && sleep 0’ \<127.0.0.1\> EXEC /bin/sh -c ‘rm -f -r /home/developer/.ansible/tmp/ansible-tmp-1533577122.72-96497498776150/ \> /dev/null 2\>&1 && sleep 0’ The full traceback is: Traceback (most recent call last): File “/tmp/ansible\_iBOj3w/ansible\_module\_ec2\_vpc\_net.py”, line 182, in vpc\_exists matching\_vpcs = vpc.describe\_vpcs(Filters=[{‘Name’: ‘tag:Name’, ‘Values’: [name]}, {‘Name’: ‘cidr-block’, ‘Values’: cidr\_block}])[‘Vpcs’] File “/tmp/ansible\_iBOj3w/ansible\_modlib.zip/ansible/module\_utils/aws/core.py”, line 224, in deciding\_wrapper return unwrapped(\*args, \*\*kwargs) File “/usr/local/lib/python2.7/dist-packages/botocore/client.py”, line 314, in \_api\_call return self.\_make\_api\_call(operation\_name, kwargs) File “/usr/local/lib/python2.7/dist-packages/botocore/client.py”, line 599, in \_make\_api\_call operation\_model, request\_dict) File “/usr/local/lib/python2.7/dist-packages/botocore/endpoint.py”, line 148, in make\_request return self.\_send\_request(request\_dict, operation\_model) File “/usr/local/lib/python2.7/dist-packages/botocore/endpoint.py”, line 173, in \_send\_request request = self.create\_request(request\_dict, operation\_model) File “/usr/local/lib/python2.7/dist-packages/botocore/endpoint.py”, line 157, in create\_request operation\_name=operation\_model.name) File “/usr/local/lib/python2.7/dist-packages/botocore/hooks.py”, line 227, in emit return self.\_emit(event\_name, kwargs) File “/usr/local/lib/python2.7/dist-packages/botocore/hooks.py”, line 210, in \_emit response = handler(\*\*kwargs) File “/usr/local/lib/python2.7/dist-packages/botocore/signers.py”, line 90, in handler return self.sign(operation\_name, request) File “/usr/local/lib/python2.7/dist-packages/botocore/signers.py”, line 156, in sign auth.add\_auth(request) File “/usr/local/lib/python2.7/dist-packages/botocore/auth.py”, line 352, in add\_auth raise NoCredentialsError NoCredentialsError: Unable to locate credentials fatal: [localhost]: FAILED! =\> { “boto3\_version”: “1.7.50”, “botocore\_version”: “1.10.50”, “changed”: false, “invocation”: { “module\_args”: { “aws\_access\_key”: null, “aws\_secret\_key”: null, “cidr\_block”: [ “10.103.0.0/16” ], “dhcp\_opts\_id”: null, “dns\_hostnames”: true, “dns\_support”: true, “ec2\_url”: null, “multi\_ok”: false, “name”: “vpctest”, “profile”: null, “purge\_cidrs”: false, “region”: “us-east-1”, “security\_token”: null, “state”: “present”, “tags”: { “Name”: “vpctest” }, “tenancy”: “default”, “validate\_certs”: true } }, “msg”: “Failed to describe VPCs: Unable to locate credentials” } PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* localhost : ok=0 changed=0 unreachable=0 failed=1 Monday 06 August 2018 13:38:44 -0400 (0:00:01.726) 0:00:01.809 \*\*\*\*\*\*\*\*\* ---
**Author:** ![RAVITZ](https://avatars.discourse-cdn.com/v4/letter/r/57b2e6/32.png) [@RAVITZ](https://forum.ansible.com/u/RAVITZ)\ **Post date:** [July 21, 2019, 6:43pm UTC](https://forum.ansible.com/t/aws-playbook-says-nocredentialserror-unable-to-locate-credentials/28284/2 "2019-07-21T18:43:53Z")
Hey Todd, It helped me 🙂 Thanks a lot!! ---
**Author:** ![Juan\_Pablo](https://avatars.discourse-cdn.com/v4/letter/j/dec6dc/32.png) [@Juan\_Pablo](https://forum.ansible.com/u/Juan_Pablo)\ **Post date:** [July 21, 2019, 6:44pm UTC](https://forum.ansible.com/t/aws-playbook-says-nocredentialserror-unable-to-locate-credentials/28284/3 "2019-07-21T18:44:26Z")