# bare variables deprecated, what am I suppose to use instead?

**URL:** <https://forum.ansible.com/t/bare-variables-deprecated-what-am-i-suppose-to-use-instead/21171>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [April 15, 2016, 11:59am UTC](https://forum.ansible.com/t/bare-variables-deprecated-what-am-i-suppose-to-use-instead/21171 "2016-04-15T11:59:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Willjw1](https://avatars.discourse-cdn.com/v4/letter/w/77aa72/32.png) [@Willjw1](https://forum.ansible.com/u/Willjw1)\
**Post date:** [April 15, 2016, 11:59am UTC](https://forum.ansible.com/t/bare-variables-deprecated-what-am-i-suppose-to-use-instead/21171/1 "2016-04-15T11:59:19Z")

</div>

So first I’ll point out that we probably aren’t using this the standard way. I get that. But please tell me another way of doing this without as much user interaction which gets rid of these deprecation warnings and we’ll try that too.

We use ansible with cloudformation over multiple accounts.  
One of our playbooks is to setup security procedures over all accounts. In the end it will have to be run by security not by a build server, which would have made this easier. Instead what I did was create a playbook which iterates over all of them. using the security role as a trusted entity to the account that is running the script.

My playbook:

- hosts: our-security-rules  
roles:
- buckets
- zipfile
- ststoken

group\_vars/all.yml:

aws:  
accounts:

- 123456789101
- 234567891011  
ACCOUNT\_ROLE: security

buckets role:

- name: Manage Lambda Bucket CloudFormation Stack  
cloudformation:  
aws\_access\_key: “{{ assumed\_role.sts\_creds.access\_key }}”  
aws\_secret\_key: “{{ assumed\_role.sts\_creds.secret\_key }}”  
security\_token: “{{ assumed\_role.sts\_creds.session\_token }}”  
…  
register: buckets\_stack\_{{ACCOUNT\_ID}}

zipfile role (as the example):  
main.yml:

- name: prepare the zipfile  
include: zipfile.yml ACCOUNT\_ID={{ item }}  
with\_items: “{{aws.accounts}}”

zipfile.yml:

- name: Assume the sts role  
sts\_assume\_role:  
role\_arn: “arn:aws:iam::{{ ACCOUNT\_ID }}:role/{{ACCOUNT\_ROLE}}”  
role\_session\_name: “stsSessionRole”  
region: “{{ region }}”  
register: assumed\_role

- name: find all zip files  
find:  
paths: “./rendered\_templates/lambda/”  
patterns: “\*.zip”  
register: find\_zips

- set\_fact: buckets\_name=“[‘buckets\_stack\_’, {{ACCOUNT\_ID}}, ‘.stack\_outputs.LambdaStorageBucket’]”

- set\_fact: bn=“{{buckets\_name[0]}}{{buckets\_name[1]}}{{buckets\_name[2]}}”

# I’m creating the variable name here as the bucket name comes in the form eg: buckets\_stack\_123456789101.stack\_outputs.LambdaStorageBucket

- name: s3 sync the folder to the selected environment  
s3:  
aws\_access\_key: “{{ assumed\_role.sts\_creds.access\_key }}”  
aws\_secret\_key: “{{ assumed\_role.sts\_creds.secret\_key }}”  
security\_token: “{{ assumed\_role.sts\_creds.session\_token }}”  
bucket: “{{ item[1] }}”  
object: “/{{ item[0].path|basename }}”  
overwrite: different  
src: “{{ item[0].path }}”  
mode: put  
with\_nested:
- “{{find\_zips.files}}”
- “{{bn}}”

So basically what’s happening here, is I build the variable name into bn using set\_fact. Then on the zipfile role with with\_nested I use the variable to pass the variable name into the s3 put to be used as the bucket and file name.

this allows me to hand this off to security where they only have to run the one playbook and it iterates through all the different accounts setting up config rules and lambda functions. But it gives me this nice big warning:

[DEPRECATION WARNING]: Using bare variables is deprecated. Update your playbooks so that the environment  
value uses the full variable syntax (‘{{buckets\_stack\_123456789101.stack\_outputs.LambdaStorageBucket}}’).  
This feature will be removed in a future release. Deprecation warnings can be disabled by setting  
deprecation\_warnings=False in ansible.cfg.

So now I’m worried that upgrading ansible within the next 2 major releases this script will stop working.

What should we replace this with?

(My current backup plan is just to use a shell script to do a for loop over the accounts and then call the ansible-playbook multiple times with an ACCOUNT\_ID variable)