# next branch: question about boto3\_conn (from lib/ansible/module\_utils/ec2.py) and STS

**URL:** <https://forum.ansible.com/t/next-branch-question-about-boto3-conn-from-lib-ansible-module-utils-ec2-py-and-sts/19835>\
**Category:** Ansible Developer\
**Created:** [November 23, 2015, 8:34pm UTC](https://forum.ansible.com/t/next-branch-question-about-boto3-conn-from-lib-ansible-module-utils-ec2-py-and-sts/19835 "2015-11-23T20:34:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Clement\_Laforet](https://avatars.discourse-cdn.com/v4/letter/c/a698b9/32.png) [@Clement\_Laforet](https://forum.ansible.com/u/Clement_Laforet)\
**Post date:** [November 23, 2015, 8:34pm UTC](https://forum.ansible.com/t/next-branch-question-about-boto3-conn-from-lib-ansible-module-utils-ec2-py-and-sts/19835/1 "2015-11-23T20:34:16Z")

</div>

Hi,

I’m currently writing an EMR module for ansible at $WORK (sorry no plan for now to open source it) and I’m trying to use boto3, and I have to admit I’m confused with logic behind boto3\_conn().  
I have to use a role to access our environment so I must use sts\_assume\_role to gain privileges. Unfortunately, my “security\_token” is set to None since rev 27398131cf31eb7ca834a30ea2d8a871a937a377 ([Fixes #13010 by updating boto3 methods to update boto3\_conn to check … · ansible/ansible@2739813 · GitHub](https://github.com/ansible/ansible/commit/27398131cf31eb7ca834a30ea2d8a871a937a377))  
Here’s the non working pseudo-code (copy’n’paste from ECS ones)

class EMRClusterManager:  
“”" Handles EMR clusters"“”  
def **init** (self, module):  
self.module = module  
try:  
region, ec2\_url, aws\_connect\_kwargs = get\_aws\_connection\_info(module, boto3=True)  
if not region:  
module.fail\_json(msg=“Region must be specified as a parameter, in EC2\_REGION or AWS\_REGION environment variables or in boto configuration file”)  
self.emr = boto3\_conn(module, conn\_type=‘client’, resource=‘emr’, region=region, endpoint=ec2\_url, \*\*aws\_connect\_kwargs)

# XXX doesn’t catch error IRL

except boto.exception.NoAuthHandlerFound, e:  
self.module.fail\_json(msg="Can’t authorize connection - "+str(e))

def main()

argument\_spec = ec2\_argument\_spec()

argument\_spec.update( [SNIP] )

module = AnsibleModule(argument\_spec=argument\_spec)

emr = EMRClusterManager(module)

[SNIP]

it fails with : “The security token included in the request is invalid.” error message.

IMHO, the culpit is here ([https://github.com/ansible/ansible/blob/devel/lib/ansible/module\_utils/ec2.py#L45](https://github.com/ansible/ansible/blob/devel/lib/ansible/module_utils/ec2.py#L45))

def boto3\_conn(module, conn\_type=None, resource=None, region=None, endpoint=None, \*\*params):  
profile = params.pop(‘profile\_name’, None)  
params[‘aws\_session\_token’] = params.pop(‘security\_token’, None)

params[‘aws\_session\_token’] is already set via get\_aws\_connection\_info() line 151

if HAS\_BOTO3 and boto3:  
boto\_params = dict(aws\_access\_key\_id=access\_key,  
aws\_secret\_access\_key=secret\_key,  
aws\_session\_token=security\_token)  
if validate\_certs:  
boto\_params[‘verify’] = validate\_certs

if profile\_name:  
boto\_params[‘profile\_name’] = profile\_name

removing the last line fix the problem (params[‘aws\_session\_token’] = params.pop(‘security\_token’, None))

Since I’m not very familiar with ansible core, I wonder if I missed something.

Thanks for your help

clem

---

<div class="post-metadata">

**Author:** ![Jonathan\_Davila](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jonathan\_Davila](https://forum.ansible.com/u/Jonathan_Davila)\
**Post date:** [November 24, 2015, 4:50pm UTC](https://forum.ansible.com/t/next-branch-question-about-boto3-conn-from-lib-ansible-module-utils-ec2-py-and-sts/19835/2 "2015-11-24T16:50:15Z")

</div>

Hmm so not sure why it’s not working for you. However, to explain:

Lines 2 & 3 in boto3\_conn() re label the fields of the param dict b/c, as you mentioned it brings the dict over form get\_aws\_connection\_info(), those two entries for the temp token and cert validation have different keywords in boto vs boto3.

Could you elaborate a bit more on how you are using sts\_assume\_role? Perhaps a sanitized version of the tasks relevant to this issue?

In the mean time, I’m going to try and replicate with other modules.

---

<div class="post-metadata">

**Author:** ![Clement\_Laforet](https://avatars.discourse-cdn.com/v4/letter/c/a698b9/32.png) [@Clement\_Laforet](https://forum.ansible.com/u/Clement_Laforet)\
**Post date:** [November 24, 2015, 7:11pm UTC](https://forum.ansible.com/t/next-branch-question-about-boto3-conn-from-lib-ansible-module-utils-ec2-py-and-sts/19835/3 "2015-11-24T19:11:22Z")

</div>

Hi,

Since we use several roles to make some sanity checks, add tags, etc. I post you the simpliest version. Note that it works for our ec2/s3/rds roles. we don’t use route53 or ecs module so I only can presume their behavior with boto3

- name: get token  
sts\_assume\_role:  
role\_arn: “{{ ValidARN[role].arn }}”  
role\_session\_name: “{{ ValidARN[role].session\_name }}”  
region: “{{ region }}”  
register: assumed\_role

- name: create EMR cluster  
ec2\_emr:  
aws\_access\_key: “{{ assumed\_role.sts\_creds.access\_key }}”  
aws\_secret\_key: “{{ assumed\_role.sts\_creds.secret\_key }}”  
security\_token: “{{ assumed\_role.sts\_creds.session\_token }}”  
key\_name: “{{ key }}”  
region: “{{ region }}”  
name: test ansible  
state: present  
emr\_version: emr-4.0.0

[…]

if I worked on python script generated (with ANSIBLE\_KEEP\_REMOTE\_FILES defined)  
here are the loosely obfuscated module args:

{“aws\_secret\_key”: “XXXXXX”, “aws\_access\_key”: “YYYYYYY”, “name”: “test ansible”, “security\_token”: “ZZZZZZ”, “tags”: {“my\_tag”: “foo”}, “key\_name”: “key\_bar”, “region”: “eu-west-1”, “instances”: [{“InstanceRole”: “MASTER”, “InstanceCount”: 1, “Name”: “master”, “Market”: “ON\_DEMAND”, “InstanceType”: “m3.xlarge”}, {“InstanceRole”: “CORE”, “InstanceCount”: 2, “Name”: “master”, “Market”: “ON\_DEMAND”, “InstanceType”: “m3.xlarge”}, {“InstanceRole”: “TASK”, “InstanceCount”: 0, “Name”: “master”, “Market”: “ON\_DEMAND”, “InstanceType”: “m3.xlarge”}], “state”: “present”, “vpc\_id”: “vpc-XXXXX”, “emr\_version”: “emr-4.0.0”, “applications”: [{“Version”: “2.6.0”, “Name”: “Hadoop”}, {“Version”: “3.7.1”, “Name”: “Hue”}, {“Version”: “0.14.0”, “Name”: “Hive”}]}’

if I modify boto3\_conn inside that script

def boto3\_conn(module, conn\_type=None, resource=None, region=None, endpoint=None, \*\*params):  
profile = params.pop(‘profile\_name’, None)  
print "PRE TOKEN BOTO3\_CONN "  
print params[‘aws\_session\_token’]  
params[‘aws\_session\_token’] = params.pop(‘security\_token’, None)  
print "POST TOKEN BOTO3\_CONN "

the output is :

PRE TOKEN BOTO3\_CONN  
ZZZZZZ  
POST TOKEN BOTO3\_CONN  
None

boto3\_conn clearly overrides valid parameters.

clem

---

<div class="post-metadata">

**Author:** ![Clement\_Laforet](https://avatars.discourse-cdn.com/v4/letter/c/a698b9/32.png) [@Clement\_Laforet](https://forum.ansible.com/u/Clement_Laforet)\
**Post date:** [November 24, 2015, 7:47pm UTC](https://forum.ansible.com/t/next-branch-question-about-boto3-conn-from-lib-ansible-module-utils-ec2-py-and-sts/19835/4 "2015-11-24T19:47:23Z")

</div>

I opened a pull request:  
[https://github.com/ansible/ansible/pull/13283](https://github.com/ansible/ansible/pull/13283)