Unable to pull ec2 inventory due to SSL error

, , ,

Below is the error that I am getting. I am using RHAAP 2.4.7. I am trying to pull an inventory of ec2 instances through a corporate proxy which results in an openssl error. I have tried adding the required CA to the execution environment and am quite certain I’m using the correct one. For whatever reason the aws_ec2.yml plugin is unaware of the CA added to the execution environment. How can I troubleshoot this issue considering everything is through a GUI and execution environment/container?

ansible-inventory [core 2.17.1]
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.11/site-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections:/usr/share/automation-controller/collections
  executable location = /usr/local/bin/ansible-inventory
  python version = 3.11.9 (main, Apr 26 2024, 22:18:02) [GCC 8.5.0 20210514 (Red Hat 8.5.0-22)] (/usr/bin/python3)
  jinja version = 3.1.4
  libyaml = True
No config file found; using defaults
[DEPRECATION WARNING]: ANSIBLE_COLLECTIONS_PATHS option, does not fit var 
naming standard, use the singular form ANSIBLE_COLLECTIONS_PATH instead. This 
feature will be removed from ansible-core in version 2.19. Deprecation warnings
 can be disabled by setting deprecation_warnings=False in ansible.cfg.
setting up inventory plugins
Loading collection ansible.builtin from 
redirecting (type: inventory) ansible.builtin.aws_ec2 to amazon.aws.aws_ec2
Loading collection amazon.aws from /usr/share/ansible/collections/ansible_collections/amazon/aws
Using inventory plugin 'ansible_collections.amazon.aws.plugins.inventory.aws_ec2' to process inventory source '/runner/inventory/aws_ec2.yml'
[WARNING]:  * Failed to parse /runner/inventory/aws_ec2.yml with auto plugin:
Failed to describe instances: SSL validation failed for https://ec2.us-
west-1.amazonaws.com/ [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify
failed: unable to get local issuer certificate (_ssl.c:1006)
  File "/usr/local/lib/python3.11/site-packages/ansible/inventory/manager.py", line 292, in parse_source
    plugin.parse(self._inventory, self._loader, source, cache=cache)
  File "/usr/local/lib/python3.11/site-packages/ansible/plugins/inventory/auto.py", line 58, in parse
    plugin.parse(inventory, loader, path, cache=cache)
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/inventory/aws_ec2.py", line 816, in parse
    results = self._query(regions, include_filters, exclude_filters, strict_permissions, use_ssm_inventory)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/inventory/aws_ec2.py", line 644, in _query
    for i in self._get_instances_by_region(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/inventory/aws_ec2.py", line 547, in _get_instances_by_region
    self.fail_aws("Failed to describe instances", exception=e)
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/plugin_utils/base.py", line 35, in fail_aws
    self._do_fail(f"{message}: {to_native(exception)}")
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/plugin_utils/base.py", line 28, in _do_fail
    raise AnsibleError(message)
[WARNING]: Unable to parse /runner/inventory/aws_ec2.yml as an inventory source
ERROR! No inventory was parsed, please check your configuration and options.

I’ve attempted to pull an inventory using ansible navigator and my execution environment using the following command

ansible-navigator inventory -i someinventory.yml --execution-environment-image=localhost/something_aws

Errors were encountered while gathering the inventory:
[WARNING]: * Failed to parse /var/lib/awx/dev/someinventory.yml with auto plugin: inventory source ‘/var/lib/awx/dev/someinventory.yml’ could not be verified by inventory plugin ‘aws_ec2’
[WARNING]: * Failed to parse /var/lib/awx/dev/someinventory.yml with yaml plugin: Plugin configuration YAML file, not YAML inventory
[WARNING]: * Failed to parse /var/lib/awx/dev/someinventory.yml with ini plugin: Invalid host pattern ‘—’ supplied, ‘—’ is normally a sign this is a YAML file.
[WARNING]: Unable to parse /var/lib/awx/dev/someinventory.yml as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available

The contents of someinventory

---
plugin: aws_ec2
aws_access_key: xxxxxxxxxxxxxx
aws_secret_key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
regions:
  - us-west-1
keyed_groups:
  - key: tags
    prefix: tag

Hi, have you tried that adding environment variable AWS_CA_BUNDLE=</path/to/your/ca/cert/for/your/proxy/in/ee.pem> to your EE?

https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#using-environment-variables