Repository: ansible/ansible

Issue:
EC2 inventory script (ec2.py) needs better error messages & guidance
Tried running ec2.py/ec2.ini "out of the box" with all the proper boto configuration in place.
Got error "Forbidden" and nothing else - obviously not helpful in tracking down the issue.

After I hacked the script and added some additional error printing to the script I got:

```
<Code>OptInRequired</Code>
<Message>The AWS Access Key Id needs a subscription for the service</Message>
```

Still it wasn't clear what the problem was and where to go to fix it.
Eventually I guessed lucky and set rds = False in ec2.ini and this worked.

Suggestions:
- rds should be defaulted to 'False' especially since script fails cryptically for users not signed up to rds
- Error message should indicate which part of the script failed (rds, ec2, etc)
- Error message should ideally suggest a solution (i.e. set rds = False if you're not signed up to rds)
- Script should provide fuller error message not just "Forbidden"



Discussion:
+1

I had the same "Forbidden" message and it confused the heck out of me.  Thanks to this issue, I found that setting `elasticache = False` and `rds = False` solved it for me.  It's probably because the IAM user I set up for Ansible only has EC2FullAccess.  Could definitely be some better reporting here.

+1 Bump.  Here it is a year later and I ran into this same problem.  The error message was useless.  In my case the AWS Key secret variables were not properly set.  The failure of a KEY or SECRET should at least output that the authentication failed.

The entire error I get with ansible-playbook -vvvv is:

ERROR: Inventory script (hosts/ec2.py) had an execution error:

Setting `elasticache = False` and `rds = False` solved it for me as well. Thanks @IanVS 

Thanks it works :neckbeard: 

while using the default configs for [ec2.ini](https://github.com/ansible/ansible/blob/devel/contrib/inventory/ec2.ini#L62-L66)

![screenshot-20160623-10 34 50](https://cloud.githubusercontent.com/assets/1695906/16292234/41898b40-392f-11e6-98b6-83575bf7ddd6.png)

So i made a [change ](https://github.com/zerOnepal/ansible/commit/348811ab5252a28d1d7f77286db13c8ac5f40f26)... 

Should I create a new pull request (Can't we correct it ?? ) 
OR  just change my config file and ignore the config issues ( if this usecase is for minority of ansible aws users)  

I am using `ansible 2.2.0.19652.bd8b041-1` 
[My ansible details](https://git.io/voXju)

@zerOnepal the ini file defaults to "all the features" mode which for many admins is probably appropriate.  I think your changes are specific to your needs.  We make a similar change on the INI file we use (our default users don't have RDS/elasticache rights)

hmm, similar case for us. (our user's are also without RDS and elasticcache rights). But better if we could document these somewhere, such that newbies of ansible-aws (ec2.py & ec2.ini)  would get it from [docs](http://docs.ansible.com/ansible/intro_dynamic_inventory.html#example-aws-ec2-external-inventory-script).  (rather than suffering the error and redirecting to this [page](https://github.com/ansible/ansible/issues/10840) for solving such a simple problem)

There are few lines there, but we can definitely improve it. :sunglasses: 
![screenshot-20160626-19 41 04](https://cloud.githubusercontent.com/assets/1695906/16362745/5d16250e-3bd6-11e6-8e92-dc1472a98d07.png)

thanks @alexlo03 

@zerOnepal If you have a recommended change for the docs, please file a PR.

Docs updates were applied in #18306 

Resolving patch:
diff --git a/contrib/inventory/ec2.py b/contrib/inventory/ec2.py
--- a/contrib/inventory/ec2.py
+++ b/contrib/inventory/ec2.py
@@ -598,6 +598,10 @@ def get_rds_instances_by_region(self, region):
 
             if e.error_code == 'AuthFailure':
                 error = self.get_auth_error_message()
+            if e.error_code == "OptInRequired":
+                error = "RDS hasn't been enabled for this account yet. " \
+                    "You must either log in to the RDS service through the AWS console to enable it, " \
+                    "or set 'rds = False' in ec2.ini"
             if not e.reason == "Forbidden":
                 error = "Looks like AWS RDS is down:\n%s" % e.message
             self.fail_with_error(error, 'getting RDS instances')
@@ -680,6 +684,10 @@ def get_elasticache_clusters_by_region(self, region):
 
             if e.error_code == 'AuthFailure':
                 error = self.get_auth_error_message()
+            if e.error_code == "OptInRequired":
+                error = "ElastiCache hasn't been enabled for this account yet. " \
+                    "You must either log in to the ElastiCache service through the AWS console to enable it, " \
+                    "or set 'elasticache = False' in ec2.ini"
             if not e.reason == "Forbidden":
                 error = "Looks like AWS ElastiCache is down:\n%s" % e.message
             self.fail_with_error(error, 'getting ElastiCache clusters')


Test patch: