{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2821","labels_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2821/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2821/comments","events_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2821/events","html_url":"https://github.com/ansible/ansible-modules-core/issues/2821","id":126921433,"number":2821,"title":"iam module not very useful for managing access keys","user":{"login":"jlaxson","id":97853,"avatar_url":"https://avatars.githubusercontent.com/u/97853?v=3","gravatar_id":"","url":"https://api.github.com/users/jlaxson","html_url":"https://github.com/jlaxson","followers_url":"https://api.github.com/users/jlaxson/followers","following_url":"https://api.github.com/users/jlaxson/following{/other_user}","gists_url":"https://api.github.com/users/jlaxson/gists{/gist_id}","starred_url":"https://api.github.com/users/jlaxson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlaxson/subscriptions","organizations_url":"https://api.github.com/users/jlaxson/orgs","repos_url":"https://api.github.com/users/jlaxson/repos","events_url":"https://api.github.com/users/jlaxson/events{/privacy}","received_events_url":"https://api.github.com/users/jlaxson/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-01-15T17:43:47Z","updated_at":"2016-01-15T17:52:13Z","closed_at":null,"body":"##### Issue Type:\r\n\r\nFeature Idea\r\n\r\n##### Ansible Version:\r\n\r\n2.0.0.2\r\n\r\n##### Ansible Configuration:\r\n\r\nN/A\r\n\r\n##### Environment:\r\n\r\nConfiguring non-EC2 machines with credentials to access AWS services.\r\n\r\n##### Summary:\r\n\r\nThe IAM module is not useful for most management of the access keys belonging to a user because it does not retrieve/output the secret access key in a way that allows one to persist it.  It is impossible to retrieve the secret key after an access key is created,  so any key created by ansible is can't be used.\r\n\r\n##### Steps To Reproduce:\r\n\r\nA simple task like:\r\n```yaml\r\n- iam:\r\n    iam_type: user\r\n    name: \"my-server-{{ansible_hostname}}\"\r\n    state: present\r\n    groups: my-group\r\n    access_key_state: create\r\n  delegate_to: 127.0.0.1\r\n  register: credentials\r\n- debug: var=credentials\r\n```\r\n\r\n##### Expected Results:\r\n\r\nI propose two changes:\r\n* The module should include the created access key and secret access key in the registered output so it can be accessed by later tasks, for example to write to a credentials file.\r\n* Add a new access_key_state called 'rotate' which causes key creation to perform the following logic:\r\n  * If the user has more than `key_count` access keys, delete the oldest until there are `key_count`-1 assigned to the user.\r\n  * Create a new access key and secret access key\r\n  * In the module output, provide output of the new key and old keys like so:\r\n```python\r\n{\r\n  \"changed\": true, \r\n  \"groups\": [\r\n    \"my-group\"\r\n  ], \r\n  \"current_key\": \r\n    \"access_key_id\": \"AKIA.......\",\r\n    \"secret_access_key\": \"random-aws-output\"\r\n  },\r\n  \"old_keys\": [\r\n    \"AKIAIoldkeyid\"\r\n  ], \r\n  \"user_name\": \"my-server-foo\"\r\n}\r\n```\r\n\r\nThen you could have a set of tasks like...\r\n```yaml\r\n- iam:\r\n    iam_type: user\r\n    name: \"my-server-{{ansible_hostname}}\"\r\n    key_count: 2\r\n    state: present\r\n    groups: my-group\r\n    access_key_state: rotate\r\n  delegate_to: 127.0.0.1\r\n  register: credentials\r\n- template: dest=/root/.aws/credentials src=credentials_template\r\n- service: name=some_server state=restarted\r\n- iam:\r\n    iam_type: user\r\n    access_key_ids: \"{{credentials.old_keys}}\"\r\n    access_key_state: remove\r\n    name: \"my-server-{{ansible_hostname}}\"\r\n```\r\n...that creates credentials for a server, installs them, restarts a service, and then deletes the old credentials it may have been using, performing a safe rotate.\r\n\r\n\r\n##### Actual Results:\r\n\r\nFor reference, the current module output when creating an access key is:\r\n```python\r\n{\r\n        \"changed\": true, \r\n        \"groups\": [\r\n            \"groups\"\r\n        ], \r\n        \"keys\": {\r\n            \"AKIAsomekeyid\": \"Active\"\r\n        }, \r\n        \"user_name\": \"user\"\r\n    }\r\n``` \r\n"},"comment":{"url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/comments/172033024","html_url":"https://github.com/ansible/ansible-modules-core/issues/2821#issuecomment-172033024","issue_url":"https://api.github.com/repos/ansible/ansible-modules-core/issues/2821","id":172033024,"user":{"login":"jlaxson","id":97853,"avatar_url":"https://avatars.githubusercontent.com/u/97853?v=3","gravatar_id":"","url":"https://api.github.com/users/jlaxson","html_url":"https://github.com/jlaxson","followers_url":"https://api.github.com/users/jlaxson/followers","following_url":"https://api.github.com/users/jlaxson/following{/other_user}","gists_url":"https://api.github.com/users/jlaxson/gists{/gist_id}","starred_url":"https://api.github.com/users/jlaxson/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jlaxson/subscriptions","organizations_url":"https://api.github.com/users/jlaxson/orgs","repos_url":"https://api.github.com/users/jlaxson/repos","events_url":"https://api.github.com/users/jlaxson/events{/privacy}","received_events_url":"https://api.github.com/users/jlaxson/received_events","type":"User","site_admin":false},"created_at":"2016-01-15T17:52:13Z","updated_at":"2016-01-15T17:52:13Z","body":"The key thing I forgot to add:  if somebody can say that this feature would not be objectionable, I'd be happy to contribute a PR to implement it."}}