Deion When using a dynamic secret backend that has multi-key

Multipart Dynamic secrets are not cached in Playbooks about ansible-vault HOT 1 OPEN

jhaals commented on July 4, 2024

Multipart Dynamic secrets are not cached in Playbooks

from ansible-vault.

Comments (1)

BenCoffeed commented on July 4, 2024

Also, to emphasize impact,
This also holds true with the playbook:

- name: download artifacts
  aws_s3:
    mode: get
    bucket: artifact-bucket
    object: artifacts.tar.gz
    dest: /tmp/artifacts.tar.gz
    overwrite: different
    aws_access_key: "{{ item.access_key }}"
    aws_secret_key: "{{ item.secret_key }}"
  register: artifacts
  with_vault:
    - aws/creds/common_get_s3_artifacts

Expected Results

Download succeeds

Actual Results

TASK [playbook : download artifacts] ************************************
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ClientError: An error occurred (403) when calling the HeadBucket operation: Forbidden
failed: [localhost] (item={u'access_key': u'A', u'secret_key': u'BB', u'security_token': None}) => {"changed": false, "error": {"code": "403", "message": "Forbidden"}, "item": {"access_key": "A", "secret_key": "BB", "security_token": null}, "msg": "Failed while looking up bucket (during bucket_check) artifact-check.", "response_metadata": {"host_id": "AKKKDHHTHAGHGHDHEG@G222222222224455=", "http_headers": {"content-type": "application/xml", "date": "Thu, 22 Feb 2018 16:20:20 GMT", "server": "AmazonS3", "transfer-encoding": "chunked", "x-amz-bucket-region": "us-east-1", "x-amz-id-2": "gAAAAAA+AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=", "x-amz-request-id": "AAAAAAAAAAAAA"}, "http_status_code": 403, "request_id": "AAAAAAAAAAAAAAA", "retry_attempts": 1}}

NOTE:
Access keys replaced by single-character identifiers.
Secret keys replaced by double-character identifiers matching corresponding access_key identifier.

from ansible-vault.

Recommend Projects