Repository: ansible/ansible

Issue:
ec2.py: iam_role option fails when using more than one region
<!---
Verify first that your issue/request is not already reported on GitHub.
THIS FORM WILL BE READ BY A MACHINE, COMPLETE ALL SECTIONS AS DESCRIBED.
Also test if the latest release, and devel branch are affected too.
ALWAYS add information AFTER (OUTSIDE) these html comments.
Otherwise it may end up being automatically closed by our bot. -->

##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
<!--- Insert, BELOW THIS COMMENT, the name of the module, plugin, task or feature.
Do not include extra details here, e.g. "vyos_command" not "the network module vyos_command" or the full path-->
`contrib/inventory/ec2.py`

##### ANSIBLE VERSION
<!--- Paste, BELOW THIS COMMENT, verbatim output from "ansible --version" between quotes below -->
```
ansible 2.4.3.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.6 (default, Nov 23 2017, 15:49:48) [GCC 4.8.4]
```

##### CONFIGURATION
<!--- If using Ansible 2.4 or above, paste, BELOW THIS COMMENT, the results of "ansible-config dump --only-changed"
Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).-->
ec2.ini:
```
[ec2]
regions = eu-central-1,us-east-1
iam_role = arn:aws:iam::4242424242:role/ansible-inventory
```
##### OS / ENVIRONMENT
<!--- Mention, BELOW THIS COMMENT, the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.-->
AWS

##### SUMMARY
<!--- Explain the problem briefly -->
On these lines:
https://github.com/ansible/ansible/blob/e0893aacc5bd13dd571c44b9a58c8c803f42dc07/contrib/inventory/ec2.py#L574-L593
`connect_args` is a reference to `self.credentials` instead of a copy.
This causes that, when `iam_role` is set and more than a region is specified, it will:
- process the first region, run over `iam_role`, and overwrite `self.credentials` with the credentials for the assumed IAM role
- when it gets to the second region, it will use the overwritten credentials to try to assume the role again against the second region, so that the role tries to assume itself and fails:
```
ERROR: "Error connecting to AWS backend.
User: arn:aws:sts::4242424242:assumed-role/ansible-inventory/ansible_dynamic_inventory is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::4242424242:role/ansible-inventory",
```

##### STEPS TO REPRODUCE
Setup ec2.ini as set before, with an IAM role that has to be assumed and multiple regions 

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
Working inventory

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```
ERROR: "Error connecting to AWS backend.
User: arn:aws:sts::4242424242:assumed-role/ansible-inventory/ansible_dynamic_inventory is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::4242424242:role/ansible-inventory",
```

##### PROPOSED FIX
```diff
-      connect_args = self.credentials 
+      connect_args = dict(self.credentials)
```

A brief locally test shows that this workaround works - I think there shouldn't be any other side effects in the code but couldn't test further.


Discussion:

Resolving patch:
diff --git a/contrib/inventory/ec2.py b/contrib/inventory/ec2.py
--- a/contrib/inventory/ec2.py
+++ b/contrib/inventory/ec2.py
@@ -152,6 +152,7 @@
 import argparse
 import re
 from time import time
+from copy import deepcopy
 import boto
 from boto import ec2
 from boto import rds
@@ -565,7 +566,7 @@ def boto_fix_security_token_in_profile(self, connect_args):
         return connect_args
 
     def connect_to_aws(self, module, region):
-        connect_args = self.credentials
+        connect_args = deepcopy(self.credentials)
 
         # only pass the profile name if it's set (as it is not supported by older boto versions)
         if self.boto_profile:


Test patch: