ansible & jinja2: How to reference JSON structure items whose keys are variables?

Question

I am using ansible's community.aws.iam_server_certificate_info module to get information about a server certificate on aws ec2, and registering it as a variable "server_cert_info_result"

Unfortunately, this module returns a JSON structure with a high level key that is the actual value of the "name" of the server certificate, as opposed to the more standard format of returning a list of dictionaries, one of which would be {name: <actual_name_of_cert>}. I have the actual name of the cert as a variable "server_ssl_cert_name" in my playbook. This is what the module's return value looks like, with the offending key highlighted:

TASK [aws_full_deployment : Debug server cert return info] ************************************************************************************************
ok: [localhost] => {                                                                                                                                                         
    "server_cert_info_result": {                                                                                                                                             
        "ansible_module_results": {                                                                                                                                          
            **"v6-full-deployment-SSL-Certificate"**: {                                                                                                                          
                "arn": "arn:aws-us-gov:iam::xxxxxxxxxxxxxxxxxxxxxxOBFUSCATED",                                         [truncated.....]

I want the arn value, in order to create an application elastic load balancer with and https listener. How do I retrieve the value of the arn, using jinja2 filters?

Things I've tried (which failed):

1. use the jinja builtin attr filter, which cannot accept the variable name of the cert inside it's parameter space, and throws an error. It only accepts strings as parameters, such that trying expand a playbook variable with the normal {{ }} will not work.

- name: Debug jinja2 attr filter
  ansible.builtin.debug:
    msg: "{{ server_cert_info_result.ansible_module_results | attr({{ server_ssl_certificate_name }} | attr('arn') }}"
  tags: list_server_certificate_info

which returns:

TASK [aws_full_deployment : Debug jinja2 attr filter] ***********************************************************************************************************************
fatal: [localhost]: FAILED! => {"msg": "template error while templating string: expected token ':', got '}'. String: {{ server_cert_info_result.ansible_module_results | attr({{ server_ssl_certificate_name }} | attr('arn') }}"}

2. community.builtin.json_query:

- name: Create and debug a query for json_query
  vars:
    cert_arn_query: "'{{ server_ssl_certificate_name }}.arn'"
  ansible.builtin.debug:
    var: cert_arn_query
  tags: list_server_certificate_info

Returns:

TASK [aws_full_deployment : Create and debug a query for json_query] ********************************************************************************************************
ok: [localhost] => {
    "cert_arn_query": "'v6-full-deployment-SSL-Certificate.arn'"
}

and

- name: Debug the json_query result of the above query
  vars:
    cert_arn_query: "'{{ server_ssl_certificate_name }}.arn'"
  ansible.builtin.debug:
    msg: "{{ server_cert_info_result.ansible_module_results | community.general.json_query(cert_arn_query) }}"
  tags: list_server_certificate_info

Which returns:

TASK [aws_full_deployment : Debug the json_query result of the above query] *************************************************************************************************
ok: [localhost] => {
    "msg": "v6-full-deployment-SSL-Certificate.arn"
}

which obviously fails when I try to create the load balancer, since the json_query didn't actually retrieve the arn. Any ideas? I may have to resort to using ansible.builtin.command and using the raw awscli call, which I believe returns the data in a format that jinja could handle.

Answer 1

Don't nest moustaches. Once you're in a Jinja context, you should reference variables by name without any further delimiters.

Using standard attribute access syntax can be a lot easier to read than the attr() filter (and actually works for this situation, which attr() doesn't):

- name: Debug jinja2
  ansible.builtin.debug:
    msg: "{{ server_cert_info_result.ansible_module_results[server_ssl_certificate_name].arn }}"
  tags: list_server_certificate_info

Answer 2

I think you don't need to do anything special:

"{{ server_cert_info_result.ansible_module_results[server_ssl_cert_name].arn }}"