# AWS RDS Cert Replacement Issue

**URL:** <https://forum.ansible.com/t/aws-rds-cert-replacement-issue/6668>\
**Category:** Get Help\
**Tags:** netbox, aws, collections\
**Created:** [June 19, 2024, 2:51pm UTC](https://forum.ansible.com/t/aws-rds-cert-replacement-issue/6668 "2024-06-19T14:51:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![marcstarr00](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@marcstarr00](https://forum.ansible.com/u/marcstarr00)\
**Post date:** [June 19, 2024, 2:51pm UTC](https://forum.ansible.com/t/aws-rds-cert-replacement-issue/6668/1 "2024-06-19T14:51:22Z")

</div>

Hello there. Posting for the first time.

I’m preparing/testing for the AWS RDS CA cert expiration. I have a script to update the cert (still testing for now) - heres a snippet:

- name: Get all RDS instances  
community.aws.rds\_instance\_info:  
aws\_access\_key: “{{ account\_item.value.aws\_access\_key\_id }}”  
aws\_secret\_key: “{{ account\_item.value.aws\_secret\_access\_key }}”  
region: “{{ item }}”  
loop: “{{ account\_item.value.regions }}”  
register: rds\_instances

- name: change the one cert-test instance  
amazon.aws.rds\_instance:  
db\_instance\_identifier: “cert-test” # “{{item.key}}”  
aws\_access\_key: “{{ account\_item.value.aws\_access\_key\_id }}”  
aws\_secret\_key: “{{ account\_item.value.aws\_secret\_access\_key }}”  
ca\_certificate\_identifier: “rds-ca-rsa2048-g1”  
loop: “{{ account\_instance\_certinfo | dict2items }}”  
when: item.key == “cert-test”

The scipt finds the rds instance and is green - meaning its already set to the new cert - but its not.

skipping: [localhost] =\> (item={‘key’: ‘RDS\_INSTANCE\_1’, ‘value’: {‘certname’: ‘rds-ca-2019’, ‘region’: ‘us-east-1b’, ‘cert\_expiration\_date’: ‘2024-08-22T17:08:50+00:00’}})  
ok: [localhost] =\> (item={‘key’: ‘cert-test’, ‘value’: {‘certname’: ‘rds-ca-2019’, ‘region’: ‘us-east-1c’, ‘cert\_expiration\_date’: ‘2024-08-22T17:08:50+00:00’}})k

![image](https://us1.discourse-cdn.com/ansible/original/2X/e/e8f3a8be252c2c0de87de1996b874814190f2269.png)

It looks like this issue was supposed to be fixed:  
[https://github.com/ansible-collections/amazon.aws/issues/1453](https://github.com/ansible-collections/amazon.aws/issues/1453)

Im using the latest:

Collection Version

* * *

amazon.aws 8.0.1

Kinda stuck here. Anyone experiencing the same thing or have advice?

Thanks

Playbook:

```auto
- name: Get information about AWS Certs
  hosts: localhost
  gather_facts: true
  collections:
    - /root/.ansible/collections/ansible_collections
  tasks:

    - name: Get Creds
      include_vars:
        file: .aws/credentials.yml
        name: aws_credentials

    - name: loop through creds and run again get_cert_info.yml
      include_tasks: rds_replace_test.yml
      loop: "{{ aws_credentials.accounts | dict2items }}"
      loop_control:
        loop_var: account_item

```

rds\_replace\_test.yml:

```auto
---
- name: Initialize account_instance_certinfo
  set_fact:
    account_instance_certinfo: {}

- name: Get all RDS instances
  community.aws.rds_instance_info:
    aws_access_key: "{{ account_item.value.aws_access_key_id }}"
    aws_secret_key: "{{ account_item.value.aws_secret_access_key }}"
    region: "{{ item }}"
  loop: "{{ account_item.value.regions }}"
  register: rds_instances

- name: Extract relevent info
  set_fact:
    account_name: "{{ account_item.key }}" # Assuming account name is available in account_item.key
    account_instance_certinfo: "{{ account_instance_certinfo | default({}) | combine({item.db_instance_identifier: {'certname': item.ca_certificate_identifier, 'region': item.availability_zone, 'cert_expiration_date': item.certificate_details.valid_till}}) }}"
  loop: "{{ rds_instances.results | json_query('[].instances[*]') | flatten }}"
  loop_control:
    loop_var: item

- name: Remove duplicate entries from account_instance_certinfo
  set_fact:
    account_instance_certinfo: "{{ account_instance_certinfo | combine({}, recursive=True) }}"

- name: debug var
  debug:
    msg: "{{ account_instance_certinfo }}"

- name: change the one cert-test instance
  amazon.aws.rds_instance:
    db_instance_identifier: "cert-test" # "{{item.key}}"
    aws_access_key: "{{ account_item.value.aws_access_key_id }}"
    aws_secret_key: "{{ account_item.value.aws_secret_access_key }}"
# region: "{{ item.value.region }}"
    ca_certificate_identifier: "rds-ca-rsa2048-g1"
  loop: "{{ account_instance_certinfo | dict2items }}"
  when: item.key == "cert-test" # and item.value.certname == "rds-ca-2019"

```

---

<div class="post-metadata">

**Author:** ![marcstarr00](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@marcstarr00](https://forum.ansible.com/u/marcstarr00)\
**Post date:** [June 19, 2024, 5:03pm UTC](https://forum.ansible.com/t/aws-rds-cert-replacement-issue/6668/2 "2024-06-19T17:03:08Z")

</div>

I just realized **apply\_immediately** wasnt added. I added it and it still isnt making the change.

Name: botocore  
Version: 1.29.59

Name: boto3  
Version: 1.26.59

python 3.9

---

<div class="post-metadata">

**Author:** ![markuman](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@markuman](https://forum.ansible.com/u/markuman)\
**Post date:** [June 19, 2024, 5:17pm UTC](https://forum.ansible.com/t/aws-rds-cert-replacement-issue/6668/3 "2024-06-19T17:17:50Z")

</div>

Yes, I think you need `apply_immediately: true`, otherwise your cert change will be applied in the next maintenance window.

```yml
---
- hosts: localhost

  tasks:
    - name: init mariadb rds
      amazon.aws.rds_instance:
        engine: mariadb
        db_instance_identifier: ansible-test-aurora-db-instance
        instance_type: db.t4g.micro
        password: 893rutugidjf9849
        username: username
        allocated_storage: 20
        ca_certificate_identifier: rds-ca-2019

    - name: update ca
      amazon.aws.rds_instance:
        engine: mariadb
        db_instance_identifier: ansible-test-aurora-db-instance
        instance_type: db.t4g.micro
        password: 893rutugidjf9849
        username: username
        allocated_storage: 20
        ca_certificate_identifier: rds-ca-rsa2048-g1
        apply_immediately: true

```

works for me using `amazon.aws 8.0.1 `

---

<div class="post-metadata">

**Author:** ![marcstarr00](https://avatars.discourse-cdn.com/v4/letter/m/f19dbf/32.png) [@marcstarr00](https://forum.ansible.com/u/marcstarr00)\
**Post date:** [June 19, 2024, 5:36pm UTC](https://forum.ansible.com/t/aws-rds-cert-replacement-issue/6668/4 "2024-06-19T17:36:20Z")

</div>

Thanks for checking.

Just FYI - if this is run once without “apply\_immediately” i believe it may be scheduled. Once scheduled, i dont think apply\_immediately works anymore so it looks broken.

I created a new rds\_testing instance and it worked the first time with apply\_immediately set.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [July 19, 2024, 5:36pm UTC](https://forum.ansible.com/t/aws-rds-cert-replacement-issue/6668/5 "2024-07-19T17:36:47Z")

</div>

Closed on July 19, 2024, 5:36pm UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.