# cloudformation module support for AWS Security Token **URL:** \ **Category:** Ansible Developer\ **Tags:** aws\ **Created:** [September 25, 2014, 4:28pm UTC](https://forum.ansible.com/t/cloudformation-module-support-for-aws-security-token/16338 "2014-09-25T16:28:55Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Mick\_Bass](https://avatars.discourse-cdn.com/v4/letter/m/43a26b/32.png) [@Mick\_Bass](https://forum.ansible.com/u/Mick_Bass)\ **Post date:** [September 25, 2014, 4:28pm UTC](https://forum.ansible.com/t/cloudformation-module-support-for-aws-security-token/16338/1 "2014-09-25T16:28:55Z")
[Originally [posted](https://groups.google.com/forum/#!topic/ansible-project/9_yW4oPPlZ4) in [Ansible Project](https://groups.google.com/forum/#!forum/ansible-project), but more appropriate for this list] We have been using the cloudformation module for quite some time, and now need to use it with STS temporary credentials, but the cloudformation module (among others) does not appear to support the AWS Security Token. Are you open to a pull request to extend get\_ec2\_creds() in module\_utils/ec2.py to include the security token, and to update all consuming modules, including cloudformation, to receive aws\_security\_token if it is set. if there’s a better way of approaching getting support for Roles / STS in place within the Ansible cloud modules (and cloudformation in particular, our immediate need) please let us know. Thanks!! Best, - Mick Bass 47Lining ---
**Author:** ![Mick\_Bass](https://avatars.discourse-cdn.com/v4/letter/m/43a26b/32.png) [@Mick\_Bass](https://forum.ansible.com/u/Mick_Bass)\ **Post date:** [September 26, 2014, 5:56am UTC](https://forum.ansible.com/t/cloudformation-module-support-for-aws-security-token/16338/2 "2014-09-26T05:56:08Z")
Pull request is here: [https://github.com/ansible/ansible/pull/9163](https://github.com/ansible/ansible/pull/9163) This is working for us in the cloudformation module. I went ahead and extended the fix to all the other cloud modules as well. Please let us know your feedback. It would be great to see this in the next release. Best, - Mick ---
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [September 26, 2014, 2:24pm UTC](https://forum.ansible.com/t/cloudformation-module-support-for-aws-security-token/16338/3 "2014-09-26T14:24:43Z")
Hi Mick, I’ve responded on your PR, but will also mention it here - the PR looks great, with only one minor change to the documentation required. However, since we’re going to be splitting the modules up into a separate repo in the very near future, this will require the PR to be split since there are changes to both the core/common code and the modules themselves. So I’ve closed the PR for now, so that this can be reworked after the splitting of the modules is complete. If you have any further questions about the PR, or the module split, just let us know. Thanks! ---
**Author:** ![willthames](https://avatars.discourse-cdn.com/v4/letter/w/8dc957/32.png) [@willthames](https://forum.ansible.com/u/willthames)\ **Post date:** [September 29, 2014, 5:55am UTC](https://forum.ansible.com/t/cloudformation-module-support-for-aws-security-token/16338/4 "2014-09-29T05:55:38Z")
In addition to James’ feedback about the modules split, the cloudformation module should use the get\_aws\_connection\_info method rather than ec2\_connect (as it’s not an ec2 module) - the method does set security\_token. Moving cloudformation to use get\_aws\_connection\_info would definitely be an improvement. See e.g. ec2\_asg.py for an example of how to implement this without having to rewrite everything that depends on ec2\_connect [https://github.com/ansible/ansible-modules-core/blob/devel/cloud/ec2\_asg.py#L587-L593](https://github.com/ansible/ansible-modules-core/blob/devel/cloud/ec2_asg.py#L587-L593) Will ---
**Author:** ![Mick\_Bass](https://avatars.discourse-cdn.com/v4/letter/m/43a26b/32.png) [@Mick\_Bass](https://forum.ansible.com/u/Mick_Bass)\ **Post date:** [October 25, 2014, 3:46am UTC](https://forum.ansible.com/t/cloudformation-module-support-for-aws-security-token/16338/5 "2014-10-25T03:46:32Z")
James and Will, Thanks for the feedback on the PR and sorry that it’s been a few weeks. We are happy to take on changes to the docs and to the split into two PRs based on the split of modules from core, as described by James. I’ll also look more closely at get\_aws\_connection\_info as suggested by Will. James - do you have any steer on the likely timeframe for the split, and when I should return to this (maybe its ready to go now?) I’d love to get the PR into mainline; don’t like to be maintaining our own fork. LMK, thanks!! - Mick ---
**Author:** ![Mick\_Bass](https://avatars.discourse-cdn.com/v4/letter/m/43a26b/32.png) [@Mick\_Bass](https://forum.ansible.com/u/Mick_Bass)\ **Post date:** [October 25, 2014, 5:36am UTC](https://forum.ansible.com/t/cloudformation-module-support-for-aws-security-token/16338/6 "2014-10-25T05:36:39Z")
OK, I see the ansible-modules-core repo, will fork that and submit the two revised PRs… ---
**Author:** ![Mick\_Bass](https://avatars.discourse-cdn.com/v4/letter/m/43a26b/32.png) [@Mick\_Bass](https://forum.ansible.com/u/Mick_Bass)\ **Post date:** [December 25, 2014, 12:30am UTC](https://forum.ansible.com/t/cloudformation-module-support-for-aws-security-token/16338/7 "2014-12-25T00:30:35Z")
James and Will, Thanks again for the feedback on this front. I have completed the two revised PRs: Core Modules: [https://github.com/ansible/ansible-modules-core/pull/566](https://github.com/ansible/ansible-modules-core/pull/566) Ansible: [https://github.com/ansible/ansible/pull/9889](https://github.com/ansible/ansible/pull/9889) Things are largely the same as the prior PR, just separated into distinct chunks based on your recent refactor into submodules. I did notice that sources naming and ordering for security credentials were somewhat inconsistent across modules so I tried to clean that up. If these PRs are accepted and applied as well to the v2 refactoring, I believe that get\_ec2\_creds() could be deprecated as we’re using get\_aws\_connection\_info() everywhere. Please let me know if you have any questions or have further suggestions. Best, - Mick Bass 47Lining