Unable to pull ec2 inventory due to SSL error

Get Help
, , ,
1

Below is the error that I am getting. I am using RHAAP 2.4.7. I am trying to pull an inventory of ec2 instances through a corporate proxy which results in an openssl error. I have tried adding the required CA to the execution environment and am quite certain I’m using the correct one. For whatever reason the aws_ec2.yml plugin is unaware of the CA added to the execution environment. How can I troubleshoot this issue considering everything is through a GUI and execution environment/container?

ansible-inventory [core 2.17.1]
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.11/site-packages/ansible
  ansible collection location = /root/.ansible/collections:/usr/share/ansible/collections:/usr/share/automation-controller/collections
  executable location = /usr/local/bin/ansible-inventory
  python version = 3.11.9 (main, Apr 26 2024, 22:18:02) [GCC 8.5.0 20210514 (Red Hat 8.5.0-22)] (/usr/bin/python3)
  jinja version = 3.1.4
  libyaml = True
No config file found; using defaults
[DEPRECATION WARNING]: ANSIBLE_COLLECTIONS_PATHS option, does not fit var 
naming standard, use the singular form ANSIBLE_COLLECTIONS_PATH instead. This 
feature will be removed from ansible-core in version 2.19. Deprecation warnings
 can be disabled by setting deprecation_warnings=False in ansible.cfg.
setting up inventory plugins
Loading collection ansible.builtin from 
redirecting (type: inventory) ansible.builtin.aws_ec2 to amazon.aws.aws_ec2
Loading collection amazon.aws from /usr/share/ansible/collections/ansible_collections/amazon/aws
Using inventory plugin 'ansible_collections.amazon.aws.plugins.inventory.aws_ec2' to process inventory source '/runner/inventory/aws_ec2.yml'
[WARNING]:  * Failed to parse /runner/inventory/aws_ec2.yml with auto plugin:
Failed to describe instances: SSL validation failed for https://ec2.us-
west-1.amazonaws.com/ [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify
failed: unable to get local issuer certificate (_ssl.c:1006)
  File "/usr/local/lib/python3.11/site-packages/ansible/inventory/manager.py", line 292, in parse_source
    plugin.parse(self._inventory, self._loader, source, cache=cache)
  File "/usr/local/lib/python3.11/site-packages/ansible/plugins/inventory/auto.py", line 58, in parse
    plugin.parse(inventory, loader, path, cache=cache)
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/inventory/aws_ec2.py", line 816, in parse
    results = self._query(regions, include_filters, exclude_filters, strict_permissions, use_ssm_inventory)
              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/inventory/aws_ec2.py", line 644, in _query
    for i in self._get_instances_by_region(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/inventory/aws_ec2.py", line 547, in _get_instances_by_region
    self.fail_aws("Failed to describe instances", exception=e)
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/plugin_utils/base.py", line 35, in fail_aws
    self._do_fail(f"{message}: {to_native(exception)}")
  File "/usr/share/ansible/collections/ansible_collections/amazon/aws/plugins/plugin_utils/base.py", line 28, in _do_fail
    raise AnsibleError(message)
[WARNING]: Unable to parse /runner/inventory/aws_ec2.yml as an inventory source
ERROR! No inventory was parsed, please check your configuration and options.
2

I’ve attempted to pull an inventory using ansible navigator and my execution environment using the following command

ansible-navigator inventory -i someinventory.yml --execution-environment-image=localhost/something_aws

Errors were encountered while gathering the inventory:
[WARNING]: * Failed to parse /var/lib/awx/dev/someinventory.yml with auto plugin: inventory source ‘/var/lib/awx/dev/someinventory.yml’ could not be verified by inventory plugin ‘aws_ec2’
[WARNING]: * Failed to parse /var/lib/awx/dev/someinventory.yml with yaml plugin: Plugin configuration YAML file, not YAML inventory
[WARNING]: * Failed to parse /var/lib/awx/dev/someinventory.yml with ini plugin: Invalid host pattern ‘—’ supplied, ‘—’ is normally a sign this is a YAML file.
[WARNING]: Unable to parse /var/lib/awx/dev/someinventory.yml as an inventory source
[WARNING]: No inventory was parsed, only implicit localhost is available

The contents of someinventory

---
plugin: aws_ec2
aws_access_key: xxxxxxxxxxxxxx
aws_secret_key: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
regions:
  - us-west-1
keyed_groups:
  - key: tags
    prefix: tag
3

Hi, have you tried that adding environment variable AWS_CA_BUNDLE=</path/to/your/ca/cert/for/your/proxy/in/ee.pem> to your EE?

https://boto3.amazonaws.com/v1/documentation/api/latest/guide/configuration.html#using-environment-variables