aws_kms_info - Gracefully Handle Keys That Don't Allow kms:GetKeyRotationStatus API Calls

[ichekaldin]

SUMMARY

Some AWS KMS keys (e.g. aws/acm) do not allow permissions to call the API
kms:GetKeyRotationStatus. As a result, module execution fails, even if the
user executing it has full admin privileges (example).

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

aws_kms_info.py

ADDITIONAL INFORMATION

The following module execution:

- community.aws.aws_kms_info:
  filter:
    alias: aws/ebs

will fail with the following error:

An exception occurred during task execution. To see the full traceback, use -vvv. The error was: botocore.exceptions.ClientError: An error occurred (AccessDeniedException) when calling the GetKeyRotationStatus operation: User: arn:aws:sts::123412341234:assumed-role/MyRole/i-1234abcd1234 is not authorized to perform: kms:GetKeyRotationStatus on resource: arn:aws:kms:us-east-1:123412341234:key/3b5bbd74-1234-abcd-1234-1234abcd1234

Key ID 3b5bbd74-1234-abcd-1234-1234abcd1234 in the example above is aws/acm key.

[tremble]

Many thanks for your contribution.

We have some test cases (they care currently only run 'manually') do you think you could update the integration test to account for this issue and help avoid a regression?

[ichekaldin]

Trying to think of a good integration test to cover this situation.

Would something like this work:

- module_defaults:
    group/aws:
        region: "{{ aws_region }}"
        aws_access_key: "{{ aws_access_key }}"
        aws_secret_key: "{{ aws_secret_key }}"
        security_token: "{{ security_token | default(omit) }}"
  collections:
    - amazon.aws

  block:
    #   TESTS
    - name: Retrive information about aws/kms key 
      aws_kms_info:
        filters:
          alias: aws/kms
      register: check_key

    - name: assert that key rotation state is None
      assert:
        that:
          - check_key.enable_key_rotation == None

[tremble]

tests/integration/targets/aws_kms/ already contains a suite of tests.

My suggestion would be that as one of the last tests before the key is scheduled for deletion you set a new policy on the key that includes an explicit deny (for everyone) on kms:GetKeyRotationStatus. You then attempt to fetch the info for that key.

[ichekaldin]

That makes sense. I added an integration test that (I think) covers this situation.

[tremble]

Minor thing for the future, and possibly for your playbooks, the templating engine used by Ansible doesn't like "== None", it needs "is undefined" for a situation like this.

[tremble]

Looks good and local tests show the expected behaviour.

[tremble]

Many thanks for your contribution. Now for me to fix the aws_kms issue and some minor bugs in the test suite :)

[ichekaldin]

Thank you!