Problem with the ec2_tag module

Archives Ansible Project
1

I’m having trouble with boto and the ec2_tags module I’m hoping someone will know what is up.

I’m spinning up an ec2 instance and then immediately calling the ec2_facts and ec2_tags to grab data to
configure the instance. The creation and ec2_facts work without a problem, but the ec2_tags fails with

msg: No handler was ready to authenticate. 1 handlers were checked. [‘QuerySignatureV2AuthHandler’] Check your credentials

which is the typical error when the the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY are not set; clearly
they are as the previous 2 calls (and the ec2 inventory plugin) are using them.

the tags command boils down to the following

ec2_tag resource=‘arn:aws:ec2:us-west-2:7XXXXXXXXX:instance/i-abcabcab’ region=us-west-2 state=list tags=

I’m using boto 2.27

Anyone know what is up here or what I can do to fix it?

thanks

Steve.

2

Try having the module run locally on an instance that is in an IAM role that has perms to update the tags on other instances. Boto should then get the credentials automatically from the metadata.

That’s been working well for us.

3

Thanks for the reply, the instance is created with an iam profile with very open permissions and its on this instance that the ec2_tag module is running. If I look at the metadata on the host i do see credentials for the profile

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/tagging/
{
“Code” : “Success”,
“LastUpdated” : “2014-04-02T22:13:03Z”,
“Type” : “AWS-HMAC”,
“AccessKeyId” : “ASIAIJZA6QAITICEXXXX”,
“SecretAccessKey” : “fdXki1+UXXXgQNt89G3Impl5vnU1IlRMkXXXX”,
“Token” : “AQoDYXdz…”,
“Expiration” : “2014-04-03T04:43:59Z”
}

Though I’m not too sure if this enough as its still complaining. I’ve tried a number of combinations of permissions but no joy this far. If its not too sensitive, would you mind sharing what your tagging profile looks like? Cheers for your help I really appreciate it.

Thanks,

Steve.