# Unable to run the aws cli command in playbook

**URL:** <https://forum.ansible.com/t/unable-to-run-the-aws-cli-command-in-playbook/41057>\
**Category:** Get Help\
**Tags:** aws\
**Created:** [March 14, 2025, 2:22pm UTC](https://forum.ansible.com/t/unable-to-run-the-aws-cli-command-in-playbook/41057 "2025-03-14T14:22:25Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Madan\_Kumar\_Dusarlap](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/madan_kumar_dusarlap/32/7731_2.png) [@Madan\_Kumar\_Dusarlap](https://forum.ansible.com/u/Madan_Kumar_Dusarlap)\
**Post date:** [March 14, 2025, 2:22pm UTC](https://forum.ansible.com/t/unable-to-run-the-aws-cli-command-in-playbook/41057/1 "2025-03-14T14:22:25Z")

</div>

- name: Change DBSNMP User Password in Oracle database and OMS

Error:  
[ansibledba@itopslx03 playbooks]$ sudo ansible-playbook test1.yml

[WARNING]: Invalid characters were found in group names but not replaced, use -vvvv to see details

PLAY [Change DBSNMP User Password in Oracle database and OMS] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

TASK [Gathering Facts] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

ok: [localhost]

TASK [Execute old password from AWS CLI command] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

changed: [localhost]

TASK [Execute AWS CLI Command Locally] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

fatal: [localhost → localhost]: FAILED! =\> {“changed”: true, “cmd”: “/usr/local/bin/aws sts get-caller-identity”, “delta”: “0:00:00.825405”, “end”: “2025-03-14 07:21:45.635280”, “msg”: “non-zero return code”, “rc”: 254, “start”: “2025-03-14 07:21:44.809875”, “stderr”: “\nAn error occurred (ExpiredToken) when calling the GetCallerIdentity operation: The security token included in the request is expired”, “stderr\_lines”: [“”, “An error occurred (ExpiredToken) when calling the GetCallerIdentity operation: The security token included in the request is expired”], “stdout”: “”, “stdout\_lines”: }

PLAY RECAP \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

localhost : ok=2 changed=1 unreachable=0 failed=1 skipped=0 rescued=0 ignored=0

---

<div class="post-metadata">

**Author:** ![Lyle\_McKarns](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lyle_mckarns/32/8142_2.png) [@Lyle\_McKarns](https://forum.ansible.com/u/Lyle_McKarns)\
**Post date:** [March 14, 2025, 2:43pm UTC](https://forum.ansible.com/t/unable-to-run-the-aws-cli-command-in-playbook/41057/2 "2025-03-14T14:43:53Z")

</div>

I’d recommend checking out the [aws module](https://docs.ansible.com/ansible/latest/collections/amazon/aws/index.html) rather than using `aws-cli` from the [builtin shell module](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/shell_module.html). A quick search of the command you are running shows [this module](https://docs.ansible.com/ansible/latest/collections/amazon/aws/aws_caller_info_module.html) as a likely starting place.

Also, if you’re running against `localhost`, you don’t need to export your env variables in your playbook (you can do that locally in your shell beforehand, or using a `.env` file).

Lastly, its highly unlikely that you need to run with `become: root` in your play, or with `sudo` in your invocation (and especially not both, I think).

As an aside, your code will be easier to read/debug if you use [code formatting](https://meta.discourse.org/t/formatting-posts-using-markdown-bbcode-and-html/239348#supported-markdown-4)

---

<div class="post-metadata">

**Author:** ![kristianheljas](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/kristianheljas/32/7702_2.png) [@kristianheljas](https://forum.ansible.com/u/kristianheljas)\
**Post date:** [March 14, 2025, 2:46pm UTC](https://forum.ansible.com/t/unable-to-run-the-aws-cli-command-in-playbook/41057/3 "2025-03-14T14:46:17Z")

</div>

Each task runs in separate process so environment variables will not persist between them.

You can set environment variable for the task though, like so:

```auto
    - name: Execute AWS CLI Command Locally
      shell: “/usr/local/bin/aws sts get-caller-identity”
      environment:
        AWS_ACCESS_KEY_ID: "{{ aws_access_key }}"
        AWS_SECRET_ACCESS_KEY: "{{ aws_secret_key }}"
        AWS_SESSION_TOKEN: "{{ aws_session_token }}"
      register: old_pwd_aws_output
      delegate_to: localhost
      become: yes
      become_user: root

```

Secondly, not really sure why become is necessary there.

And can’t stress this enough, there are existing plugins to integrate with aws.

For example [amazon.aws.secretsmanager\_secret](https://docs.ansible.com/ansible/latest/collections/amazon/aws/secretsmanager_secret_lookup.html#ansible-collections-amazon-aws-secretsmanager-secret-lookup) lookup plugin is what you’re after here:

```auto
    - name: Display old password
      debug:
        msg: “{{ aws_access_key }} {{ lookup('amazon.aws.secretsmanager_secret', 'oracle_dbsnmp_user_pwd', access_key=aws_access_key, secret_key=aws_secret_key, session_token=aws_session_token) }}”

```