aws_secrets.py: add on_missing and on_denied option

[rene1977]

SUMMARY

Add "on_missing" and "on_denied" option for aws_secret lookup.
This option controls how to handle a not existing secret (ResourceNotFoundException) or missing access rights (AccessDeniedException). The option naming is based on the "config" lookup.

At some places we are using aws secrets optional when they are configured or the running user has access to it. With the generic lookup error control we can not differentiate between such state and a regular error.

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

aws_secret

ADDITIONAL INFORMATION

The option "on_missing" and "on_denied" can be set to:

• 'error' - return a fatal error (default, old behavior)
• 'warn' - return empty list and print a warning
• 'skip' - return empty list

playbook:

---
- name: test read a secret
  hosts: localhost
  connection: local
  gather_facts: no
  vars:
    aws_access_key: <aws_access_key>
    aws_secret_key: <aws_secret_key>
  tasks:
    - name: secret successfull
      debug:
        var: bla
      vars:
        bla: "{{ lookup('amazon.aws.aws_secret','secret_test',region='eu-west-1',aws_access_key=aws_access_key,aws_secret_key=aws_secret_key) }}"
    - name: secret not found error
      debug:
        var: bla
      vars:
        bla: "{{ lookup('amazon.aws.aws_secret','secret_not_exist',region='eu-west-1',aws_access_key=aws_access_key,aws_secret_key=aws_secret_key) }}"
      ignore_errors: true
    - name: secret denied error
      debug:
        var: bla
      vars:
        bla: "{{ lookup('amazon.aws.aws_secret','secret_test',region='eu-west-1') }}"
      ignore_errors: true
    - name: secret not found warning
      debug:
        var: bla
      vars:
        bla: "{{ lookup('amazon.aws.aws_secret','secret_not_exist',region='eu-west-1',aws_access_key=aws_access_key,aws_secret_key=aws_secret_key,on_missing='warn') }}"
    - name: secret denied warning
      debug:
        var: bla
      vars:
        bla: "{{ lookup('amazon.aws.aws_secret','secret_test',region='eu-west-1',on_denied='warn') }}"
    - name: secret not found skipped
      debug:
        var: bla
      vars:
        bla: "{{ lookup('amazon.aws.aws_secret','secret_not_exist',region='eu-west-1',aws_access_key=aws_access_key,aws_secret_key=aws_secret_key,on_missing='skip') }}"
    - name: secret denied skipped
      debug:
        var: bla
      vars:
        bla: "{{ lookup('amazon.aws.aws_secret','secret_test',region='eu-west-1',on_denied='skip') }}"

output:

PLAY [test read a secret] ********************************************************************************************************************

TASK [secret successfull] ********************************************************************************************************************
ok: [localhost] => {
    "bla": {
        "secret_test": "secret_test_value"
    }
}

TASK [secret not found error] ****************************************************************************************************************
fatal: [localhost]: FAILED! => {"msg": "An unhandled exception occurred while templating '{{ lookup('amazon.aws.aws_secret','secret_not_exist',region='eu-west-1',aws_access_key=aws_access_key,aws_secret_key=aws_secret_key) }}'. Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while running the lookup plugin 'amazon.aws.aws_secret'. Error was a <class 'ansible.errors.AnsibleError'>, original message: Failed to retrieve secret: An error occurred (ResourceNotFoundException) when calling the GetSecretValue operation: Secrets Manager can't find the specified secret."}
...ignoring

TASK [secret denied error] *******************************************************************************************************************
fatal: [localhost]: FAILED! => {"msg": "An unhandled exception occurred while templating '{{ lookup('amazon.aws.aws_secret','secret_test',region='eu-west-1') }}'. Error was a <class 'ansible.errors.AnsibleError'>, original message: An unhandled exception occurred while running the lookup plugin 'amazon.aws.aws_secret'. Error was a <class 'ansible.errors.AnsibleError'>, original message: Failed to retrieve secret: An error occurred (AccessDeniedException) when calling the GetSecretValue operation: User: arn:aws:sts::963812274078:assumed-role/AnsibleBTServiceZoneStandard/i-0d041a344eb853269 is not authorized to perform: secretsmanager:GetSecretValue on resource: arn:aws:secretsmanager:eu-west-1:963812274078:secret:secret_test-u3hpk5"}
...ignoring

TASK [secret not found warning] **************************************************************************************************************
[WARNING]: Skipping, did not find secret secret_not_exist
ok: [localhost] => {
    "bla": []
}

TASK [secret denied warning] *****************************************************************************************************************
[WARNING]: Skipping, access denied for secret secret_test
ok: [localhost] => {
    "bla": []
}

TASK [secret not found skipped] **************************************************************************************************************
ok: [localhost] => {
    "bla": []
}

TASK [secret denied skipped] *****************************************************************************************************************
ok: [localhost] => {
    "bla": []
}

PLAY RECAP ***********************************************************************************************************************************
localhost                  : ok=7    changed=0    unreachable=0    failed=0    skipped=0    rescued=0    ignored=2

[jillr]

Thanks for this change, the code looks good but could you please add unit tests to tests/unit/plugins/lookup/test_aws_secret.py to cover these new options?

[rene1977]

@jillr

Yes, i will add some unit tests.

[rene1977]

/rebuild

[tremble]

Thanks for this. A couple of minor things.

Please see https://docs.ansible.com/ansible/latest/dev_guide/developing_modules_documenting.html#linking-and-other-format-macros-within-module-documentation and https://docs.ansible.com/ansible/latest/community/development_process.html#changelogs-how-to for more info.

[tremble]

Assuming the tests pass, LGTM

[tremble]

Thank you for your contribution.