# Updating an IAM cert

**URL:** <https://forum.ansible.com/t/updating-an-iam-cert/24526>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [May 19, 2017, 5:09pm UTC](https://forum.ansible.com/t/updating-an-iam-cert/24526 "2017-05-19T17:09:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Josh\_Smift1](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@Josh\_Smift1](https://forum.ansible.com/u/Josh_Smift1)\
**Post date:** [May 19, 2017, 5:09pm UTC](https://forum.ansible.com/t/updating-an-iam-cert/24526/1 "2017-05-19T17:09:30Z")

</div>

We uploaded an IAM cert to AWS, and now need to update the certificate  
(the contents). On the theory that a lost of this stuff is idempotent, I  
thought this task, which we used to upload it in the first place, would  
work to update it as well:

&nbsp;&nbsp;- name: configure IAM certificates  
&nbsp;&nbsp;&nbsp;&nbsp;iam\_cert:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;name: "{{ item }}"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;state: present  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cert: "{{ iam\_cert[item]['certfile'] }}"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;key: "{{ iam\_cert[item]['keyfile'] }}"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;cert\_chain: "{{ iam\_cert[item]['chainfile'] }}"  
&nbsp;&nbsp;&nbsp;&nbsp;with\_items: "{{ iam\_cert\_names }}"

We've got a dict iam\_cert in inventory, like this:

&nbsp;&nbsp;&nbsp;&nbsp;iam\_cert:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;myserver1:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;certfile: "/path/to/myserver1.crt"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;chainfile: "/path/to/myca.crt"  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;keyfile: "/path/to/myserver1.key"

(and so on for myserver2 etc)

So this works fine for adding a new cert, but if we put a new cert in  
/path/to/myserver.crt, it fails, saying:

&nbsp;&nbsp;failed: [localhost] (item=myserver1) =\> {"changed": false, "failed": true, "item": "myserver1", "msg": "A cert with the name myserver1 already exists and has a different certificate body associated with it. Certificates cannot have the same name"}

[https://docs.ansible.com/ansible/iam\_cert\_module.html](https://docs.ansible.com/ansible/iam_cert_module.html) has 'new\_path',  
which says "When present, this will update the path of the cert with the  
value passed here.", but it doesn't say what this is supposed to be -- a  
Boolean? a path to the new cert file on disk? Perhaps the same sort of  
thing as the 'path' option, which says "When creating or updating, specify  
the desired path of the certificate", but we're not using that, we're  
using 'cert', which says "The path to the certificate body in PEM encoded  
format." What's "the path of the certificate", and is it different from  
"the path to the certificate body"? There's only one example, and it  
doesn't use either 'path' or 'new\_path'.

Anyone know how this is supposed to work?

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;-Josh (jbs@care.com)

(apologies for the automatic corporate disclaimer that follows)

This email is intended for the person(s) to whom it is addressed and may contain information that is PRIVILEGED or CONFIDENTIAL. Any unauthorized use, distribution, copying, or disclosure by any person other than the addressee(s) is strictly prohibited. If you have received this email in error, please notify the sender immediately by return email and delete the message and any attachments from your system.

---

<div class="post-metadata">

**Author:** ![ttwalto](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@ttwalto](https://forum.ansible.com/u/ttwalto)\
**Post date:** [August 14, 2018, 3:21pm UTC](https://forum.ansible.com/t/updating-an-iam-cert/24526/2 "2018-08-14T15:21:51Z")

</div>

I’m also wondering how this works. The documentation is often confusing about what exactly it means.

I’m seeing “already exists and has a different certificate body”, which I’m guessing is related to the error described here.