# facing issue with shell module in ansible

**URL:** <https://forum.ansible.com/t/facing-issue-with-shell-module-in-ansible/38371>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [August 24, 2023, 7:45pm UTC](https://forum.ansible.com/t/facing-issue-with-shell-module-in-ansible/38371 "2023-08-24T19:45:25Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shivani\_Arora](https://avatars.discourse-cdn.com/v4/letter/s/919ad9/32.png) [@Shivani\_Arora](https://forum.ansible.com/u/Shivani_Arora)\
**Post date:** [August 24, 2023, 7:45pm UTC](https://forum.ansible.com/t/facing-issue-with-shell-module-in-ansible/38371/1 "2023-08-24T19:45:25Z")

</div>

Hi Team,

I’m trying the below code to attach region-specific waf to region-specific alb’s. But the below code doesn’t seem to be working for associating the waf to alb’s. The last shell module is having issues, “$alb\_arn” value is not getting interpreted and getting the error mentioned below.

tasks:

- block:

- name: Get service alb info  
community.aws.elb\_application\_lb\_info:  
profile: “{{ aws\_profile\_name }}”  
region: “{{ region }}”  
names:

- “Service-{{ ec2\_tag\_environment }}”

- “ServiceInt-{{ ec2\_tag\_environment }}”

- “Web-{{ ec2\_tag\_environment }}”  
register: alb\_info  
loop: “{{ aws\_cloud\_regions }}”  
loop\_control:  
loop\_var: region

- debug:  
var=alb\_info

- name: Extract ALB ARNs  
set\_fact:  
alb\_arns: “{{ alb\_arns | default() + item.load\_balancers | map(attribute=‘load\_balancer\_arn’) | list }}”  
loop: “{{ alb\_info.results }}”

- name: Extract ALB map ARNs  
set\_fact:  
alb\_map\_arns: “{{ alb\_map\_arns | default({}) | combine({item.region: item.load\_balancers | map(attribute=‘load\_balancer\_arn’) | list}) }}”  
loop: “{{ alb\_info.results }}”

- name: Display ALB ARNs  
debug:  
var: alb\_map\_arns

- name: Get WAF WebACL ARN  
shell: |  
aws wafv2 list-web-acls --scope REGIONAL --profile “{{ aws\_profile\_name }}” --region “{{ region }}” --query ‘WebACLs[?Name==`{{ ec2_tag_environment }}-ALB`].ARN’ --output text  
register: waf\_acl  
changed\_when: false  
loop: “{{ aws\_cloud\_regions }}”  
loop\_control:  
loop\_var: region

- debug:  
var=waf\_acl

- name: Print WebACL ARN  
set\_fact:  
waf\_arn: “{{ waf\_arn | default({}) | combine({item.region: item.stdout}) }}”  
loop: “{{ waf\_acl.results }}”

- debug:  
var=waf\_arn

- name: Attach WAF to ALBs  
shell: |  
for alb\_arn in {{ alb\_map\_arns[item] }}; do  
aws wafv2 associate-web-acl   
–web-acl-arn “{{ waf\_arn[item] }}”   
–resource-arn “$alb\_arn”   
–profile “{{ aws\_profile\_name }}”   
–region “{{ item }}”  
done  
loop: “{{ waf\_arn.keys() | list }}”  
when: item in alb\_map\_arns

below $alb\_arn is not getting interpreted

do\n aws wafv2 associate-web-acl --web-acl-arn "arn:aws:wafv2:eu-central-1::regional/webacl/QAtest-ALB/a6dda4d3-9973-4b88-bc49-a7cbad91a302" --resource-arn "$alb\_arn"

error reason: The ARN isn’t valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE\_ARN  
An error occurred (WAFNonexistentItemException) when calling the AssociateWebACL operation: AWS WAF couldn’t perform the operation because your resource doesn’t exist

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [August 24, 2023, 9:35pm UTC](https://forum.ansible.com/t/facing-issue-with-shell-module-in-ansible/38371/2 "2023-08-24T21:35:40Z")

</div>

Hii

You left out important information. For instance the output of the “Display ALB ARNs” debug task.  
That is used in your shell command at " for alb\_arn in {{ alb\_map\_arns[item] }}; do", so that is important.  
Post that debug output.  
Or, post the output of the “Attach WAF to ALBs” task with -vv.

---

<div class="post-metadata">

**Author:** ![Shivani\_Arora](https://avatars.discourse-cdn.com/v4/letter/s/919ad9/32.png) [@Shivani\_Arora](https://forum.ansible.com/u/Shivani_Arora)\
**Post date:** [August 25, 2023, 4:51am UTC](https://forum.ansible.com/t/facing-issue-with-shell-module-in-ansible/38371/3 "2023-08-25T04:51:59Z")

</div>

Hey Dick,

Thanks for responding.

Please find the attached debug output as requested

TASK [Display ALB ARNs] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
Thursday 24 August 2023 13:04:34 -0700 (0:00:00.338) 0:00:24.776 \*\*\*\*\*\*\*  
ok: [localhost] =\> {  
“alb\_map\_arns”: {  
“eu-central-1”: [  
“arn:aws:elasticloadbalancing:eu-central-1::loadbalancer/app/Web-QAtest/78c12741885fcfbb”,  
“arn:aws:elasticloadbalancing:eu-central-1::loadbalancer/app/Service-QAtest/a22b43074f64f9d7”,  
“arn:aws:elasticloadbalancing:eu-central-1::loadbalancer/app/ServiceInt-QAtest/2f7fff2fb7d354a7”  
],  
“us-east-1”: [  
“arn:aws:elasticloadbalancing:us-east-1::loadbalancer/app/Web-QAtest/c1fba8d4f0526447”,  
“arn:aws:elasticloadbalancing:us-east-1::loadbalancer/app/Service-QAtest/1c8cde570dbc2c98”,  
“arn:aws:elasticloadbalancing:us-east-1::loadbalancer/app/ServiceInt-QAtest/e8b1dcfb2f17b6e1”  
]  
}  
}

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [August 25, 2023, 5:56am UTC](https://forum.ansible.com/t/facing-issue-with-shell-module-in-ansible/38371/4 "2023-08-25T05:56:06Z")

</div>

And the output of “Attach WAF to ALBs”?

---

<div class="post-metadata">

**Author:** ![Shivani\_Arora](https://avatars.discourse-cdn.com/v4/letter/s/919ad9/32.png) [@Shivani\_Arora](https://forum.ansible.com/u/Shivani_Arora)\
**Post date:** [August 25, 2023, 8:34am UTC](https://forum.ansible.com/t/facing-issue-with-shell-module-in-ansible/38371/5 "2023-08-25T08:34:48Z")

</div>

output of "Attach WAF to ALBs:

TASK [Attach WAF to ALBs] _\__\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\ ***\_**

Thursday 24 August 2023 12:34:47 -0700 (0:00:00.305) 0:00:33.257 _\__\*\*\*\_\*\*

failed: [localhost] (item=us-east-1) =\> {“ansible\_loop\_var”: “item”, “changed”: true, “cmd”: “for alb\_arn in [‘arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/Web-QAtest/c1fba8d4f0526447’, ‘arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/Service-QAtest/1c8cde570dbc2c98’, ‘arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/ServiceInt-QAtest/e8b1dcfb2f17b6e1’]; do\n echo "ALB ARN: $alb\_arn"\n echo "WAF ARN: arn:aws:wafv2:us-east-1:\<\>:regional/webacl/QAtest-ALB/11dd2e60-7d87-4827-8be6-6b2660b759ee"\n aws wafv2 associate-web-acl --web-acl-arn "arn:aws:wafv2:us-east-1:\<\>:regional/webacl/QAtest-ALB/11dd2e60-7d87-4827-8be6-6b2660b759ee" --resource-arn $alb\_arn --profile "\<\>" --region "us-east-1"\ndone\n”, “delta”: “0:00:12.982311”, “end”: “2023-08-24 12:35:01.526408”, “item”: “us-east-1”, “msg”: “non-zero return code”, “rc”: 255, “start”: “2023-08-24 12:34:48.544097”, “stderr”: “\nAn error occurred (WAFInvalidParameterException) when calling the AssociateWebACL operation: Error reason: The ARN isn’t valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE\_ARN, parameter: [arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/Web-QAtest/c1fba8d4f0526447,\n\nAn error occurred (WAFNonexistentItemException) when calling the AssociateWebACL operation: AWS WAF couldn’t perform the operation because your resource doesn’t exist.\n\nAn error occurred (WAFNonexistentItemException) when calling the AssociateWebACL operation: AWS WAF couldn’t perform the operation because your resource doesn’t exist.”, “stderr\_lines”: [“”, “An error occurred (WAFInvalidParameterException) when calling the AssociateWebACL operation: Error reason: The ARN isn’t valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE\_ARN, parameter: [arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/Web-QAtest/c1fba8d4f0526447,”, “”, “An error occurred (WAFNonexistentItemException) when calling the AssociateWebACL operation: AWS WAF couldn’t perform the operation because your resource doesn’t exist.”, “”, “An error occurred (WAFNonexistentItemException) when calling the AssociateWebACL operation: AWS WAF couldn’t perform the operation because your resource doesn’t exist.”], “stdout”: “ALB ARN: [arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/Web-QAtest/c1fba8d4f0526447,\nWAF ARN: arn:aws:wafv2:us-east-1:\<\>:regional/webacl/QAtest-ALB/11dd2e60-7d87-4827-8be6-6b2660b759ee\nALB ARN: arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/Service-QAtest/1c8cde570dbc2c98,\nWAF ARN: arn:aws:wafv2:us-east-1:\<\>:regional/webacl/QAtest-ALB/11dd2e60-7d87-4827-8be6-6b2660b759ee\nALB ARN: arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/ServiceInt-QAtest/e8b1dcfb2f17b6e1]\nWAF ARN: arn:aws:wafv2:us-east-1:\<\>:regional/webacl/QAtest-ALB/11dd2e60-7d87-4827-8be6-6b2660b759ee”, “stdout\_lines”: [“ALB ARN: [arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/Web-QAtest/c1fba8d4f0526447,”, “WAF ARN: arn:aws:wafv2:us-east-1:\<\>:regional/webacl/QAtest-ALB/11dd2e60-7d87-4827-8be6-6b2660b759ee”, “ALB ARN: arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/Service-QAtest/1c8cde570dbc2c98,”, “WAF ARN: arn:aws:wafv2:us-east-1:\<\>:regional/webacl/QAtest-ALB/11dd2e60-7d87-4827-8be6-6b2660b759ee”, “ALB ARN: arn:aws:elasticloadbalancing:us-east-1:\<\>:loadbalancer/app/ServiceInt-QAtest/e8b1dcfb2f17b6e1]”, “WAF ARN: arn:aws:wafv2:us-east-1:\<\>:regional/webacl/QAtest-ALB/11dd2e60-7d87-4827-8be6-6b2660b759ee”]}

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [August 25, 2023, 3:16pm UTC](https://forum.ansible.com/t/facing-issue-with-shell-module-in-ansible/38371/6 "2023-08-25T15:16:07Z")

</div>

I think the problem is here. You are trying to loop over a yaml list in your shell code, which does not work. I’m guessing you’d need to join that yaml list by a space to make it work in the shell command. That is assuming the items themself do not contain spaces.  
So the first line of your shell command would be:

for alb\_arn in {{ alb\_map\_arns[item] | join(’ ') }}; do