# modifying am IAM policy

**URL:** <https://forum.ansible.com/t/modifying-am-iam-policy/37644>\
**Category:** Ansible Project\
**Created:** [February 9, 2023, 7:46pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644 "2023-02-09T19:46:09Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 9, 2023, 7:46pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/1 "2023-02-09T19:46:09Z")

</div>

I am trying to add or modify an iam policy with below. it ran but did not modify anything

any idea?

---

<div class="post-metadata">

**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\
**Post date:** [February 9, 2023, 7:47pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/2 "2023-02-09T19:47:26Z")

</div>

Does your AWS user ID used by the task have rights to modify IAM policies?

Walter

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 9, 2023, 7:49pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/3 "2023-02-09T19:49:40Z")

</div>

yes it does

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 9, 2023, 9:29pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/4 "2023-02-09T21:29:52Z")

</div>

ok I tried doing it this way and it worked but wiped out my existing policy. any idea how to append instead of replace?

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 9, 2023, 10:02pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/5 "2023-02-09T22:02:20Z")

</div>

trying my loop but its only putting in one value . any idea?

---

<div class="post-metadata">

**Author:** ![utoddl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/utoddl/32/249_2.png) [@utoddl](https://forum.ansible.com/u/utoddl)\
**Post date:** [February 9, 2023, 10:52pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/6 "2023-02-09T22:52:36Z")

</div>

Here’s an idea: Register the result, and show us the output from `ansible-playbook -vv`.  
Based on what you said before about it replacing rather than adding to, I’m going to guess you’re only getting the last value. (?)

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 9, 2023, 11:34pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/7 "2023-02-09T23:34:09Z")

</div>

Yep only last value

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [February 10, 2023, 12:41pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/8 "2023-02-10T12:41:04Z")

</div>

You could use an inline template to loop over the list of actions, for example:

---

<div class="post-metadata">

**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\
**Post date:** [February 10, 2023, 12:55pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/9 "2023-02-10T12:55:59Z")

</div>

Has this discussion gotten away from ansible and drifted into an AWS question?

Walter

---

<div class="post-metadata">

**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\
**Post date:** [February 10, 2023, 12:56pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/10 "2023-02-10T12:56:38Z")

</div>

Perhaps you need to query the current state of the IAM role, modify it, and re-apply it so you are adding to the existing policy?

Walter

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 10, 2023, 8:18pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/11 "2023-02-10T20:18:19Z")

</div>

hi

I got

“msg”: “Failed to decode the policy as valid JSON: Expecting value: line 1 column 1 (char 0)”

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 13, 2023, 2:55pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/12 "2023-02-13T14:55:24Z")

</div>

any idea on this?

fatal: [localhost]: FAILED! =\> {  
“changed”: false,  
“invocation”: {  
“module\_args”: {  
“access\_key”: null,  
“aws\_ca\_bundle”: null,  
“aws\_config”: null,  
“debug\_botocore\_endpoint\_logs”: false,  
“endpoint\_url”: null,  
“iam\_name”: “aws\_test\_role”,  
“iam\_type”: “role”,  
“policy\_json”: “Version: "2012-10-17"\nStatement:\n - Action: acm-pca:ListTags\n Effect: Allow\n Resource: "_"\n - Action: acm-pca:GetPolicy\n Effect: Allow\n Resource: "_"\n - Action: acm-pca:GetPolicy\n Effect: Allow\n Resource: "\*"”,  
“policy\_name”: “PrismaCloud-IAM-ReadOnly-Policy”,  
“profile”: null,  
“region”: null,  
“secret\_key”: null,  
“session\_token”: null,  
“skip\_duplicates”: false,  
“state”: “present”,  
“validate\_certs”: true  
}  
},  
“msg”: “Failed to decode the policy as valid JSON: Expecting value: line 1 column 1 (char 0)”  
}

---

<div class="post-metadata">

**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\
**Post date:** [February 13, 2023, 3:16pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/13 "2023-02-13T15:16:39Z")

</div>

Your policy\_json doesn’t look like JSON.

Walter

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [February 13, 2023, 4:01pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/14 "2023-02-13T16:01:47Z")

</div>

So, you will need to use proper JSON.  
Give this a try:

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 13, 2023, 6:47pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/15 "2023-02-13T18:47:17Z")

</div>

tried but it failed

fatal: [localhost]: FAILED! =\> {  
“boto3\_version”: “1.24.27”,  
“botocore\_version”: “1.27.27”,  
“changed”: false,  
“error”: {  
“code”: “MalformedPolicyDocument”,  
“message”: “Syntax errors in policy.”,  
“type”: “Sender”  
},  
“invocation”: {  
“module\_args”: {  
“access\_key”: null,  
“aws\_ca\_bundle”: null,  
“aws\_config”: null,  
“debug\_botocore\_endpoint\_logs”: false,  
“endpoint\_url”: null,  
“iam\_name”: “aws\_test\_role”,  
“iam\_type”: “role”,  
“policy\_json”: “"Version: \"2012-10-17\"\nStatement:\n - Action: acm-pca:ListTags\n Effect: Allow\n Resource: \"_\"\n - Action: acm-pca:GetPolicy\n Effect: Allow\n Resource: \"_\"\n - Action: acm-pca:GetPolicy\n Effect: Allow\n Resource: \"\*\"\n"”,  
“policy\_name”: “PrismaCloud-IAM-ReadOnly-Policy”,  
“profile”: null,  
“region”: null,  
“secret\_key”: null,  
“session\_token”: null,  
“skip\_duplicates”: false,  
“state”: “present”,  
“validate\_certs”: true  
}  
},  
“msg”: “An error occurred (MalformedPolicyDocument) when calling the PutRolePolicy operation: Syntax errors in policy.”,  
“response\_metadata”: {  
“http\_headers”: {  
“connection”: “close”,  
“content-length”: “279”,  
“content-type”: “text/xml”,  
“date”: “Mon, 13 Feb 2023 16:10:28 GMT”,  
“x-amzn-requestid”: “8ab06377-a416-45ea-a132-328cd03d329f”  
},  
“http\_status\_code”: 400,  
“request\_id”: “8ab06377-a416-45ea-a132-328cd03d329f”,  
“retry\_attempts”: 0  
}  
}

---

<div class="post-metadata">

**Author:** ![Walter\_Rowe](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/walter_rowe/32/4506_2.png) [@Walter\_Rowe](https://forum.ansible.com/u/Walter_Rowe)\
**Post date:** [February 14, 2023, 1:05pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/16 "2023-02-14T13:05:38Z")

</div>

This is not an ansible problem. You need to ready the AWS docs on specifying IAM policies and make sure your policy adheres to their format and only includes the key:value pairs they accept.

Walter

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 16, 2023, 4:11pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/17 "2023-02-16T16:11:32Z")

</div>

ok this is more ansible problem.

I like to put my policy changes in a vars file

so I got a policy.yaml file like this

policy.yaml

acm-pca:ListTags  
acm-pca:GetPolicy  
acm-pca:GetPolicy

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 16, 2023, 5:13pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/18 "2023-02-16T17:13:10Z")

</div>

ended up using the policy lookup method

---

<div class="post-metadata">

**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\
**Post date:** [February 16, 2023, 7:05pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/19 "2023-02-16T19:05:10Z")

</div>

> ok this is more ansible problem.
> 
> I like to put my policy changes in a vars file
> 
> so I got a policy.yaml file like this
> 
> policy.yaml
> 
> acm-pca:ListTags  
> acm-pca:GetPolicy  
> acm-pca:GetPolicy
> 
> * * *
> 
> - name: test  
> hosts: localhost  
> vars\_files:
> - policy.yml  
> tasks:
> - name: Create IAM Managed Policy  
> amazon.aws.iam\_policy:  
> iam\_type: role  
> iam\_name: “aws\_test\_role”  
> policy\_name: “PrismaCloud-IAM-ReadOnly-Policy”  
> policy\_json: “{{ policy | to\_json }}”  
> state: present  
> policy: |  
> Version: “2012-10-17”  
> Statement:  
> {% for action in actions %}
> - Action: {{ action }}  
> Effect: Allow  
> Resource: “\*”  
> {% endfor %}
> 
> but when i run the pb it says
> 
> ERROR! variable files must contain either a dictionary of variables, or a list of dictionaries.

This is correct.

> Got: acm-pca:ListTags acm-pca:GetPolicy acm-pca:GetPolicy (\<class ‘ansible.parsing.yaml.objects.AnsibleUnicode’\>)

Your policy yaml file should read something like

policy:  
acm-pca:ListTags  
acm-pca:GetPolicy  
acm-pca:GetPolicy

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [February 17, 2023, 3:15pm UTC](https://forum.ansible.com/t/modifying-am-iam-policy/37644/20 "2023-02-17T15:15:53Z")

</div>

now getting this

fatal: [localhost]: FAILED! =\> {  
“msg”: “The task includes an option with an undefined variable. The error was: ‘actions’ is undefined\n\nThe error appears to be in ‘/Users/t/virtualenv/ansible/update\_iam\_policy/update\_iam3.yaml’: line 7, column 5, but may\nbe elsewhere in the file depending on the exact syntax problem.\n\nThe offending line appears to be:\n\n tasks:\n - name: Create IAM Managed Policy\n ^ here\n”  
}

[Next page](https://forum.ansible.com/t/modifying-am-iam-policy/37644.md?page=2)