Repository: ansible/ansible

Issue:
IAM module remove all groups does not work
##### ISSUE TYPE
Feature Request

##### COMPONENT NAME
iam

##### ANSIBLE VERSION
```
ansible 2.2.1.0
```

##### CONFIGURATION

##### OS / ENVIRONMENT
N/A

##### SUMMARY
When using IAM module want to be able to set groups input parameter to [] in order to remove all the groups associated with a user. Currently the code does "if groups" and thus does not change anything with an empty list.

##### STEPS TO REPRODUCE
```
- hosts: localhost
  connection: local
  become: False
  pre_tasks:
    - include_vars: envs/iam_users.yml
    - set_fact:
        iam_users: "{{iam_users[account]}}"
        aws_account_id: "{{account_info[account]['aws_account_id']}}"
  tasks:
    - name: create users
      iam:
        iam_type: user
        name: "test-user"
        groups: ["test-group"]
        state: present

    - name: update user groups
      iam:
        iam_type: user
        name: "test-user"
        groups: []
        state: update
```

##### EXPECTED RESULTS
Remove "test-group" from "test-user"

##### ACTUAL RESULTS
Does not get removed

```
TASK [create users] ************************************************************
task path: /home/bfloyd/ansible/temp.yml:13
Using module file /usr/lib/python2.7/site-packages/ansible/modules/core/cloud/amazon/iam.py
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: bfloyd
<localhost> EXEC /bin/sh -c '/usr/bin/python && sleep 0'
changed: [localhost] => {
    "changed": true,
    "groups": [
        "test-group"
    ],
    "invocation": {
        "module_args": {
            "access_key_ids": null,
            "access_key_state": null,
            "aws_access_key": null,
            "aws_secret_key": null,
            "ec2_url": null,
            "groups": [
                "test-group"
            ],
            "iam_type": "user",
            "key_count": 1,
            "name": "test-user",
            "new_name": null,
            "new_path": null,
            "password": null,
            "path": "/",
            "profile": null,
            "region": null,
            "security_token": null,
            "state": "present",
            "trust_policy": null,
            "trust_policy_filepath": null,
            "update_password": "always",
            "validate_certs": true
        },
        "module_name": "iam"
    },
    "keys": [],
    "user_meta": {
        "access_keys": null,
        "created_user": {
            "arn": "arn:aws:iam::230700467799:user/test-user",
            "create_date": "2017-03-08T00:04:40.819Z",
            "path": "/",
            "user_id": "AIDAJOUN7ZJF6VWQCKJM2",
            "user_name": "test-user"
        },
        "password": null
    }
}

TASK [update user groups] ******************************************************
task path: /home/bfloyd/ansible/temp.yml:20
Using module file /usr/lib/python2.7/site-packages/ansible/modules/core/cloud/amazon/iam.py
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: bfloyd
<localhost> EXEC /bin/sh -c '/usr/bin/python && sleep 0'
ok: [localhost] => {
    "changed": false,
    "groups": null,
    "invocation": {
        "module_args": {
            "access_key_ids": null,
            "access_key_state": null,
            "aws_access_key": null,
            "aws_secret_key": null,
            "ec2_url": null,
            "groups": [],
            "iam_type": "user",
            "key_count": 1,
            "name": "test-user",
            "new_name": null,
            "new_path": null,
            "password": null,
            "path": "/",
            "profile": null,
            "region": null,
            "security_token": null,
            "state": "update",
            "trust_policy": null,
            "trust_policy_filepath": null,
            "update_password": "always",
            "validate_certs": true
        },
        "module_name": "iam"
    },
    "keys": {},
    "user_name": "test-user"
}

PLAY RECAP *********************************************************************
localhost                  : ok=6    changed=1    unreachable=0    failed=0

```

IAM module remove all groups does not work
##### ISSUE TYPE
Feature Request

##### COMPONENT NAME
iam

##### ANSIBLE VERSION
```
ansible 2.2.1.0
```

##### CONFIGURATION

##### OS / ENVIRONMENT
N/A

##### SUMMARY
When using IAM module want to be able to set groups input parameter to [] in order to remove all the groups associated with a user. Currently the code does "if groups" and thus does not change anything with an empty list.

##### STEPS TO REPRODUCE
```
- hosts: localhost
  connection: local
  become: False
  pre_tasks:
    - include_vars: envs/iam_users.yml
    - set_fact:
        iam_users: "{{iam_users[account]}}"
        aws_account_id: "{{account_info[account]['aws_account_id']}}"
  tasks:
    - name: create users
      iam:
        iam_type: user
        name: "test-user"
        groups: ["test-group"]
        state: present

    - name: update user groups
      iam:
        iam_type: user
        name: "test-user"
        groups: []
        state: update
```

##### EXPECTED RESULTS
Remove "test-group" from "test-user"

##### ACTUAL RESULTS
Does not get removed

```
TASK [create users] ************************************************************
task path: /home/bfloyd/ansible/temp.yml:13
Using module file /usr/lib/python2.7/site-packages/ansible/modules/core/cloud/amazon/iam.py
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: bfloyd
<localhost> EXEC /bin/sh -c '/usr/bin/python && sleep 0'
changed: [localhost] => {
    "changed": true,
    "groups": [
        "test-group"
    ],
    "invocation": {
        "module_args": {
            "access_key_ids": null,
            "access_key_state": null,
            "aws_access_key": null,
            "aws_secret_key": null,
            "ec2_url": null,
            "groups": [
                "test-group"
            ],
            "iam_type": "user",
            "key_count": 1,
            "name": "test-user",
            "new_name": null,
            "new_path": null,
            "password": null,
            "path": "/",
            "profile": null,
            "region": null,
            "security_token": null,
            "state": "present",
            "trust_policy": null,
            "trust_policy_filepath": null,
            "update_password": "always",
            "validate_certs": true
        },
        "module_name": "iam"
    },
    "keys": [],
    "user_meta": {
        "access_keys": null,
        "created_user": {
            "arn": "arn:aws:iam::230700467799:user/test-user",
            "create_date": "2017-03-08T00:04:40.819Z",
            "path": "/",
            "user_id": "AIDAJOUN7ZJF6VWQCKJM2",
            "user_name": "test-user"
        },
        "password": null
    }
}

TASK [update user groups] ******************************************************
task path: /home/bfloyd/ansible/temp.yml:20
Using module file /usr/lib/python2.7/site-packages/ansible/modules/core/cloud/amazon/iam.py
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: bfloyd
<localhost> EXEC /bin/sh -c '/usr/bin/python && sleep 0'
ok: [localhost] => {
    "changed": false,
    "groups": null,
    "invocation": {
        "module_args": {
            "access_key_ids": null,
            "access_key_state": null,
            "aws_access_key": null,
            "aws_secret_key": null,
            "ec2_url": null,
            "groups": [],
            "iam_type": "user",
            "key_count": 1,
            "name": "test-user",
            "new_name": null,
            "new_path": null,
            "password": null,
            "path": "/",
            "profile": null,
            "region": null,
            "security_token": null,
            "state": "update",
            "trust_policy": null,
            "trust_policy_filepath": null,
            "update_password": "always",
            "validate_certs": true
        },
        "module_name": "iam"
    },
    "keys": {},
    "user_name": "test-user"
}

PLAY RECAP *********************************************************************
localhost                  : ok=6    changed=1    unreachable=0    failed=0

```



Discussion:

Resolving patch:
diff --git a/lib/ansible/modules/cloud/amazon/iam.py b/lib/ansible/modules/cloud/amazon/iam.py
--- a/lib/ansible/modules/cloud/amazon/iam.py
+++ b/lib/ansible/modules/cloud/amazon/iam.py
@@ -55,7 +55,8 @@
     choices: [ "present", "absent", "update" ]
   path:
     description:
-      - When creating or updating, specify the desired path of the resource. If state is present, it will replace the current path to match what is passed in when they do not match.
+      - When creating or updating, specify the desired path of the resource. If state is present,
+        it will replace the current path to match what is passed in when they do not match.
     required: false
     default: "/"
   trust_policy:
@@ -101,7 +102,8 @@
     description:
      - C(always) will update passwords if they differ.  C(on_create) will only set the password for newly created users.
 notes:
-  - 'Currently boto does not support the removal of Managed Policies, the module will error out if your user/group/role has managed policies when you try to do state=absent. They will need to be removed manually.'
+  - 'Currently boto does not support the removal of Managed Policies, the module will error out if your
+    user/group/role has managed policies when you try to do state=absent. They will need to be removed manually.'
 author:
     - "Jonathan I. Davila (@defionscode)"
     - "Paul Seiffert (@seiffert)"
@@ -701,7 +703,7 @@ def main():
             if name_change and new_name:
                 orig_name = name
                 name = new_name
-            if groups:
+            if isinstance(groups, list):
                 user_groups, groups_changed = set_users_groups(
                     module, iam, name, groups, been_updated, new_name)
                 if groups_changed == user_changed:


Test patch:
diff --git a/test/sanity/pep8/legacy-files.txt b/test/sanity/pep8/legacy-files.txt
--- a/test/sanity/pep8/legacy-files.txt
+++ b/test/sanity/pep8/legacy-files.txt
@@ -47,7 +47,6 @@ lib/ansible/modules/cloud/amazon/ecs_service.py
 lib/ansible/modules/cloud/amazon/ecs_service_facts.py
 lib/ansible/modules/cloud/amazon/ecs_taskdefinition.py
 lib/ansible/modules/cloud/amazon/elasticache.py
-lib/ansible/modules/cloud/amazon/iam.py
 lib/ansible/modules/cloud/amazon/iam_cert.py
 lib/ansible/modules/cloud/amazon/iam_policy.py
 lib/ansible/modules/cloud/amazon/iam_role.py