# Is this a bug or a security feature?  I am not sure...

**URL:** <https://forum.ansible.com/t/is-this-a-bug-or-a-security-feature-i-am-not-sure/16992>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [December 9, 2014, 5:20am UTC](https://forum.ansible.com/t/is-this-a-bug-or-a-security-feature-i-am-not-sure/16992 "2014-12-09T05:20:15Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Steven\_Truong](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Steven\_Truong](https://forum.ansible.com/u/Steven_Truong)\
**Post date:** [December 9, 2014, 5:20am UTC](https://forum.ansible.com/t/is-this-a-bug-or-a-security-feature-i-am-not-sure/16992/1 "2014-12-09T05:20:15Z")

</div>

Hi all,

Here is the situation that I am not sure how to deal with it.

shell: echo {{ ec2\_tag\_Name | regex\_replace(‘(\[1\]±[a-z0-9]+).\*’, ‘\1’) }}

And certainly, I have other shell command where I echo something and use register to capture the output such as the following:

- name: get public ipv4 address  
shell: curl [http://169.254.169.254/latest/meta-data/public-ipv4](http://169.254.169.254/latest/meta-data/public-ipv4)  
register: public\_ipv4

So when I ran these in ansible\_pull then these tasks worked just fine. When I ran against the public\_hostname of the EC2 instance with

ansible-playbook myplaybookyml -i /usr/local/src/public\_hostname

where public\_hostname in AWS has the public DNS entry of the instance and I believe this entry will resolve to private IP address in AWS. This will NOT work.

ansible-playbook myplaybook.yml -i host.localhost

where host.localhost has 'localhost" as the only entry and this will NOT work either.

ansible-playbook myplaybook.yml -i ec.py --limit $public\_ip

The public IP address is just the actual IP address of the instance. This will work.

For those 2 cases when things failed to work I did not get error message but and OK with something like the following:

ok: [a.b.c.c] =\> {“msg”: “check mode not supported for shell”, “skipped”: true}

So shell module seemed to give me these message and fail to execute the shell command at all in the case I use localhost or the public DNS name in AWS that resolves to the private IP address.

I ran these locally on the instance.

Please share your thoughts on what could have been the case here. Bug or security feature???

Thank you very much,  
Steven

* * *

1. a-z

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [December 9, 2014, 1:05pm UTC](https://forum.ansible.com/t/is-this-a-bug-or-a-security-feature-i-am-not-sure/16992/2 "2014-12-09T13:05:29Z")

</div>

“ok: [a.b.c.c] =\> {“msg”: “check mode not supported for shell”, “skipped”: true}”

shell commands don’t run in check mode because usually they have side effects, and check mode is there to be a dry run.

As such, this is neither a bug _NOR_ a security feature, it’s just making sure check mode doesn’t _do_ anything.

If I’m missing the question, perhaps you can summarize what I missed above.

Thanks!

---

<div class="post-metadata">

**Author:** ![davedash.sp](https://avatars.discourse-cdn.com/v4/letter/d/6a8cbe/32.png) [@davedash.sp](https://forum.ansible.com/u/davedash.sp)\
**Post date:** [December 9, 2014, 1:11pm UTC](https://forum.ansible.com/t/is-this-a-bug-or-a-security-feature-i-am-not-sure/16992/3 "2014-12-09T13:11:18Z")

</div>

Somehow you are in check mode… I’d find out why.

If you truly are checking things, you can do this:

[http://docs.ansible.com/playbooks\_checkmode.html#running-a-task-in-check-mode](http://docs.ansible.com/playbooks_checkmode.html#running-a-task-in-check-mode)

-d