# Help with Amazon STS Module \[sts\_assume\_role\]

**URL:** <https://forum.ansible.com/t/help-with-amazon-sts-module-sts-assume-role/24541>\
**Category:** Ansible Project\
**Tags:** rhel, fedora, aws\
**Created:** [May 22, 2017, 3:34pm UTC](https://forum.ansible.com/t/help-with-amazon-sts-module-sts-assume-role/24541 "2017-05-22T15:34:28Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Brian\_O\_Mahony1](https://avatars.discourse-cdn.com/v4/letter/b/eb9ed0/32.png) [@Brian\_O\_Mahony1](https://forum.ansible.com/u/Brian_O_Mahony1)\
**Post date:** [May 22, 2017, 3:34pm UTC](https://forum.ansible.com/t/help-with-amazon-sts-module-sts-assume-role/24541/1 "2017-05-22T15:34:28Z")

</div>

I am starting to use ansible for my AWS environment and have run into a few snags with the STS Module. I am relatively new to ansible, so it may just be user error 🙂 Apologies if these are

Issue #1:  
I have set thefollowing variables:  
sts\_role\_arn: “arn:aws:iam::1234567890:role/My\_AccountAccessRole”  
sts\_role\_session\_name: “ansible”  
aws\_access\_key: ###key####  
aws\_secret\_key: ###key###

However it seems to be trying to run the sts\_assume\_role as the instance, rather than the user, as the error shows:  
User: arn:aws:sts::9876543210:assumed-role/My\_EC2InstanceRole/i-00000000000000 is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::1234567890:role/My\_AccountAccessRole

If I run any commands using the aws cli, they work correctly. IE if I run: aws ec2 describe-instances --profile MyProfile | egrep “SubnetId|AvailabilityZone|test”, it returns the details. The profile contains a line of "role\_arn = arn:aws:iam::1234567890:role/My\_AccountAccessRole, but these are running as the user, rather than the instance.

Issue #2:  
It doesnt seem to read the ~/.aws/config file for a profile. If I set ‘profile: MyProfile’ and this profile exists in ~/.aws/config, it till returns a ‘nboto.provider.ProfileNotFoundError: Profile "MyProfile" not found!\n’ error. As stated above, if i use the cli with the --profile flag, it works fine…

Ansible was installed using git clone, make rpm, rpm -e.  
Details:  
[briano@ip-XXX-xx-XXX-xx tasks]$ ansible --version  
ansible 2.3.0.0  
config file = /etc/ansible/ansible.cfg  
configured module search path = Default w/o overrides  
python version = 2.7.12 (default, Sep 1 2016, 22:14:00) [GCC 4.8.3 20140911 (Red Hat 4.8.3-9)]  
[briano@ip-XXX-xx-XXX-xx tasks]$ cat /etc/os-release  
NAME=“Amazon Linux AMI”  
VERSION=“2017.03”  
ID=“amzn”  
ID\_LIKE=“rhel fedora”  
VERSION\_ID=“2017.03”  
PRETTY\_NAME=“Amazon Linux AMI 2017.03”  
ANSI\_COLOR=“0;33”  
CPE\_NAME=“cpe:/o:amazon:linux:2017.03:ga”  
HOME\_URL=“[http://aws.amazon.com/amazon-linux-ami/](http://aws.amazon.com/amazon-linux-ami/)”

Thanks for any help, and if i am in the wrong place, please let me know!

B