# Recommended way for remote host to pull from s3: authentication questions **URL:** \ **Category:** Ansible Project\ **Tags:** aws\ **Created:** [September 10, 2013, 5:36am UTC](https://forum.ansible.com/t/recommended-way-for-remote-host-to-pull-from-s3-authentication-questions/13440 "2013-09-10T05:36:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Chris\_Shenton](https://avatars.discourse-cdn.com/v4/letter/c/f9ae1b/32.png) [@Chris\_Shenton](https://forum.ansible.com/u/Chris_Shenton)\ **Post date:** [September 10, 2013, 5:36am UTC](https://forum.ansible.com/t/recommended-way-for-remote-host-to-pull-from-s3-authentication-questions/13440/1 "2013-09-10T05:36:56Z")
I’m trying to use the ‘s3’ module to pull down large binary installers onto remote hosts and having confusion about how best to authenticate the remote host to AWS. I was hoping I could just use my environment’s AWS\_ACCESS\_KEY\_ID and AWS\_SECRET\_ACCESS\_KEY, but they’re not passed to the remote; not surprising. Then I thought I could pass them to the remote by referencing in the action, but it doesn’t expand the environment variables. I _can_ pass in the literal key and secret strings and the remote can then access the s3 object, but don’t want those in my git repo for the playbook. For example: - name: Download installer hosts: all user: ec2-user sudo: yes tasks: - name: TEST S3 copy on remote host action: module: s3 mode: get bucket: mybucket-iaas-256 object: /installers/oracle/11.2/oracle-instantclient11.2-basic-11.2.0.3.0-1.x86\_64.rpm dest: /tmp/ORA\_TEST.bin # Failed: #aws\_access\_key: ${AWS\_ACCESS\_KEY\_ID} #aws\_secret\_key: ${AWS\_SECRET\_ACCESS\_KEY} # Works but don’t want actual keys in git: aws\_access\_key: XYZZYPLOUGHPLOVER aws\_secret\_key: youwontgetitupthestairsyouareinamazeoftwistylittlepassages Am I missing a common pattern on how to pass AWS creds to the remote hosts? Thanks for any clues. ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [September 10, 2013, 12:32pm UTC](https://forum.ansible.com/t/recommended-way-for-remote-host-to-pull-from-s3-authentication-questions/13440/2 "2013-09-10T12:32:09Z")
Your variables should interpolate fine. I don’t think they are explicitly removed so I suspect they are not defined. Also: please don’t use old style variables. ---
**Author:** ![Chris\_Shenton](https://avatars.discourse-cdn.com/v4/letter/c/f9ae1b/32.png) [@Chris\_Shenton](https://forum.ansible.com/u/Chris_Shenton)\ **Post date:** [September 11, 2013, 10:56pm UTC](https://forum.ansible.com/t/recommended-way-for-remote-host-to-pull-from-s3-authentication-questions/13440/3 "2013-09-11T22:56:19Z")
Got it, I was missing the $ENV variable to get at my environment, e.g.: - name: Oracle Instant Client Basic copy action: module: s3 mode: get aws\_access\_key: $ENV(AWS\_ACCESS\_KEY\_ID) aws\_secret\_key: $ENV(AWS\_SECRET\_ACCESS\_KEY) Thanks ---
**Author:** ![John\_Fuller](https://avatars.discourse-cdn.com/v4/letter/j/5f9b8f/32.png) [@John\_Fuller](https://forum.ansible.com/u/John_Fuller)\ **Post date:** [September 12, 2013, 12:41am UTC](https://forum.ansible.com/t/recommended-way-for-remote-host-to-pull-from-s3-authentication-questions/13440/4 "2013-09-12T00:41:16Z")
The EC2 and S3 modules should pull from the environmental variables if these items are not explicitly set in the playbook. But the variables it looks for is EC2\_ACCESS\_KEY and EC2\_SECRET\_KEY as of Ansible 1.2.3 from the Ubuntu PPA. ---
**Author:** ![John\_Fuller](https://avatars.discourse-cdn.com/v4/letter/j/5f9b8f/32.png) [@John\_Fuller](https://forum.ansible.com/u/John_Fuller)\ **Post date:** [September 12, 2013, 1:10am UTC](https://forum.ansible.com/t/recommended-way-for-remote-host-to-pull-from-s3-authentication-questions/13440/5 "2013-09-12T01:10:55Z")
Ugh, sorry, since you are able to pull down files from S3 using the S3 module I assume you are using 1.3 because 1.2.3 seems to support “put” for ensuring a “present” state. So, 1.3 also pulls from AWS\_ACCESS\_KEY and AWS\_SECRET\_KEY in addition to the previously mentioned variables (they have been kept there for backwards compatibility.) The point is still that S3 pulls from your environment variables automatically if not set explicitly in the playbook. So, that might save you a couple of lines in your playbook. ---
**Author:** ![Jay\_Moorthi](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@Jay\_Moorthi](https://forum.ansible.com/u/Jay_Moorthi)\ **Post date:** [November 17, 2013, 8:21am UTC](https://forum.ansible.com/t/recommended-way-for-remote-host-to-pull-from-s3-authentication-questions/13440/6 "2013-11-17T08:21:27Z")
I’m running 1.3.3 from the ubuntu ppa, and I find similar behavior to Chris Shenton - that the AWS creds in local environment variables aren’t pushed to the remotes. I need to explicitly capture the variables: aws\_access\_key=$ENV(AWS\_ACCESS\_KEY) aws\_secret\_key=$$ENV(AWS\_SECRET\_KEY) … and then it works fine. ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [November 17, 2013, 5:57pm UTC](https://forum.ansible.com/t/recommended-way-for-remote-host-to-pull-from-s3-authentication-questions/13440/7 "2013-11-17T17:57:17Z")
They are not meant to be pushed to the remotes. You use the ec2 modules with “local\_action: ec2 …” as per the examples, and it will be fine. Otherwise you could just pass the credentials as parameters to the module if you want to execute them on another host.