# How to manage AWS resources by Ansible Without Access Keys and Secret Access Keys **URL:** \ **Category:** Ansible Project\ **Tags:** aws\ **Created:** [January 2, 2019, 11:13am UTC](https://forum.ansible.com/t/how-to-manage-aws-resources-by-ansible-without-access-keys-and-secret-access-keys/29350 "2019-01-02T11:13:08Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![S\_Saravanan](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@S\_Saravanan](https://forum.ansible.com/u/S_Saravanan)\ **Post date:** [January 2, 2019, 11:13am UTC](https://forum.ansible.com/t/how-to-manage-aws-resources-by-ansible-without-access-keys-and-secret-access-keys/29350/1 "2019-01-02T11:13:08Z")
Hi All, How can we manage AWS resources by Ansible without Access Keys and Secret Access Keys ? There is a requirement to use Ansible server to manage AWS, but should not use access and secret keys for security policy in the project. We have to use only IAM role based access for this. Which IAM role can be used ? what are the policies need to attached with the role ? Please give some suggestions. Thank you in advance. Regards, Saravanan S ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [January 2, 2019, 11:39am UTC](https://forum.ansible.com/t/how-to-manage-aws-resources-by-ansible-without-access-keys-and-secret-access-keys/29350/2 "2019-01-02T11:39:59Z")
It sounds as if you need to run ansible on an AWS instance, and create an instance policy for the instance. Read up on instance policies in the AWS doco. The simplest instance policy is just a role that gives the instance AdministratorAccess, but depending on what you are planning to use Ansible to do, that may be overkill. You should avoid giving an instance too much power, just as you should avoid giving a user too much power. The big advantage of using an instance policy is that software on the instance - like Ansible - can do anything the instance is allowed to do, without having to worry about IAM users, access keys or secrets of any kind (although you will need to be able to log into the instance to do stuff). The other thing you can do is attach a limited instance policy first, and change it later - any change to the role will be effective almost immediately. Regards, K. ---
**Author:** ![S\_Saravanan](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@S\_Saravanan](https://forum.ansible.com/u/S_Saravanan)\ **Post date:** [January 2, 2019, 4:55pm UTC](https://forum.ansible.com/t/how-to-manage-aws-resources-by-ansible-without-access-keys-and-secret-access-keys/29350/3 "2019-01-02T16:55:52Z")
Thanks for your reply. I will create role with limited policy and check it. Even If we assign roles, how to write playbooks without access and secret access keys , keys in variable file or export ACCESS\_KEYS…etc. For below example, without keys variable, how ansible will communicate AWS API ? - name: create ec2 instance ec2: aws\_access\_key: “xxxxxxxxxxxx” \<----- without this line aws\_secret\_key: “xxxxxxxxxxxx” \<----- without this line image: ami-abcdefghi wait: yes instance\_type: t2.micro group\_id: security\_group.group\_id region: us-east-2 count\_tag: Name: webserver exact\_count: 1 register: ec2 Regards, Saravanan S ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [January 3, 2019, 4:35am UTC](https://forum.ansible.com/t/how-to-manage-aws-resources-by-ansible-without-access-keys-and-secret-access-keys/29350/4 "2019-01-03T04:35:07Z")
> Thanks for your reply. > > I will create role with limited policy and check it. > > Even If we assign roles, how to write playbooks without access and secret access keys , keys in variable file or export ACCESS\_KEYS…etc. > > For below example, without keys variable, how ansible will communicate AWS API ? > > - name: create ec2 instance > ec2: > aws\_access\_key: “xxxxxxxxxxxx” \<----- without this line > aws\_secret\_key: “xxxxxxxxxxxx” \<----- without this line > image: ami-abcdefghi > wait: yes > instance\_type: t2.micro > group\_id: security\_group.group\_id > region: us-east-2 > count\_tag: > Name: webserver > exact\_count: 1 > register: ec2 Those two options are mandatory for the module to work, you cannot just skip them. AWS provides you with temporary credentials based that give access to the iam policy the machine is assigned. You should be able to retrieve those from the instance’s metadata: [https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html#instance-metadata-security-credentials) When you have set up some (initially restricted, as Karl said) policy, I suggest using the ec2\_metadata\_facts module to find the temporary credentials: [https://docs.ansible.com/ansible/2.4/ec2\_metadata\_facts\_module.html](https://docs.ansible.com/ansible/2.4/ec2_metadata_facts_module.html) Then simply refer to the appropriate keys in your ec2 task. Dick ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [January 3, 2019, 4:45am UTC](https://forum.ansible.com/t/how-to-manage-aws-resources-by-ansible-without-access-keys-and-secret-access-keys/29350/5 "2019-01-03T04:45:25Z")
If the tasks are being carried out on the Ansible server, then you just leave out the access keys and so on. If the tasks are being carried out on other hosts, then those hosts are the ones that will need AWS access, either via an instance policy or via access keys etc. And Ansible will need suitable credentials to access the hosts it is running the tasks on. Regards, K. ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [January 3, 2019, 12:02pm UTC](https://forum.ansible.com/t/how-to-manage-aws-resources-by-ansible-without-access-keys-and-secret-access-keys/29350/6 "2019-01-03T12:02:06Z")
I have used the ec2 module a LOT on a build host with an instance policy and have never had to include those two items. I simply omit them. The module still works fine. So I think you CAN “just skip them”… as long as you have an appropriate instance policy. And (obviously) as long as Ansible is executing the module on the system with the instance policy! Regards, K. ---
**Author:** ![S\_Saravanan](https://avatars.discourse-cdn.com/v4/letter/s/6bbea6/32.png) [@S\_Saravanan](https://forum.ansible.com/u/S_Saravanan)\ **Post date:** [January 3, 2019, 12:39pm UTC](https://forum.ansible.com/t/how-to-manage-aws-resources-by-ansible-without-access-keys-and-secret-access-keys/29350/7 "2019-01-03T12:39:46Z")
Thank you Karl and Dick.