1

I am using ansible's community.aws.iam_server_certificate_info module to get information about a server certificate on aws ec2, and registering it as a variable "server_cert_info_result"

Unfortunately, this module returns a JSON structure with a high level key that is the actual value of the "name" of the server certificate, as opposed to the more standard format of returning a list of dictionaries, one of which would be {name: <actual_name_of_cert>}. I have the actual name of the cert as a variable "server_ssl_cert_name" in my playbook. This is what the module's return value looks like, with the offending key highlighted:

TASK [aws_full_deployment : Debug server cert return info] ************************************************************************************************
ok: [localhost] => {                                                                                                                                                         
    "server_cert_info_result": {                                                                                                                                             
        "ansible_module_results": {                                                                                                                                          
            **"v6-full-deployment-SSL-Certificate"**: {                                                                                                                          
                "arn": "arn:aws-us-gov:iam::xxxxxxxxxxxxxxxxxxxxxxOBFUSCATED",                                         [truncated.....]

I want the arn value, in order to create an application elastic load balancer with and https listener. How do I retrieve the value of the arn, using jinja2 filters?

Things I've tried (which failed):

  1. use the jinja builtin attr filter, which cannot accept the variable name of the cert inside it's parameter space, and throws an error. It only accepts strings as parameters, such that trying expand a playbook variable with the normal {{ }} will not work.
- name: Debug jinja2 attr filter
  ansible.builtin.debug:
    msg: "{{ server_cert_info_result.ansible_module_results | attr({{ server_ssl_certificate_name }} | attr('arn') }}"
  tags: list_server_certificate_info

which returns:

TASK [aws_full_deployment : Debug jinja2 attr filter] ***********************************************************************************************************************
fatal: [localhost]: FAILED! => {"msg": "template error while templating string: expected token ':', got '}'. String: {{ server_cert_info_result.ansible_module_results | attr({{ server_ssl_certificate_name }} | attr('arn') }}"}
  1. community.builtin.json_query:
- name: Create and debug a query for json_query
  vars:
    cert_arn_query: "'{{ server_ssl_certificate_name }}.arn'"
  ansible.builtin.debug:
    var: cert_arn_query
  tags: list_server_certificate_info

Returns:

TASK [aws_full_deployment : Create and debug a query for json_query] ********************************************************************************************************
ok: [localhost] => {
    "cert_arn_query": "'v6-full-deployment-SSL-Certificate.arn'"
}

and

- name: Debug the json_query result of the above query
  vars:
    cert_arn_query: "'{{ server_ssl_certificate_name }}.arn'"
  ansible.builtin.debug:
    msg: "{{ server_cert_info_result.ansible_module_results | community.general.json_query(cert_arn_query) }}"
  tags: list_server_certificate_info

Which returns:

TASK [aws_full_deployment : Debug the json_query result of the above query] *************************************************************************************************
ok: [localhost] => {
    "msg": "v6-full-deployment-SSL-Certificate.arn"
}

which obviously fails when I try to create the load balancer, since the json_query didn't actually retrieve the arn. Any ideas? I may have to resort to using ansible.builtin.command and using the raw awscli call, which I believe returns the data in a format that jinja could handle.

2

Don't nest moustaches. Once you're in a Jinja context, you should reference variables by name without any further delimiters.

Using standard attribute access syntax can be a lot easier to read than the attr() filter (and actually works for this situation, which attr() doesn't):

- name: Debug jinja2
  ansible.builtin.debug:
    msg: "{{ server_cert_info_result.ansible_module_results[server_ssl_certificate_name].arn }}"
  tags: list_server_certificate_info
7
  • Unfortunately, the first suggestion didn't work: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'dict object' has no attribute 'server_ssl_certificate_name'
    – Life5ign
    Mar 15 at 17:02
  • The second didn't either, I think it contains mixed . and [ ] attribute references too: FAILED! => {"msg": "template error while templating string: expected name or number. String: {{ server_cert_info_result.ansible_module_results.[server_ss l_certificate_name].arn }}"}
    – Life5ign
    Mar 15 at 17:04
  • edit for my first comment, I posted the wrong error; correct error is Unfortunately, the first suggestion didn't work: FAILED! => {"msg": "The task includes an option with an undefined variable. The error was: 'dict object' has no attribute 'v6-full-deployment-SSL-Certificate'
    – Life5ign
    Mar 15 at 17:09
  • server_cert_info_result.ansible_module_results.[server_ssl_certificate_name].arn is not what I suggested using. You've inserted an extra . before the [, so it's not surprising that it results in a syntax error. Mixing . and bracket accesses in an expression is perfectly valid. Mar 15 at 18:25
  • you're right; I removed the extra . that I inadvertently inserted, and it worked. Thanks
    – Life5ign
    Mar 19 at 0:17
0

I think you don't need to do anything special:

"{{ server_cert_info_result.ansible_module_results[server_ssl_cert_name].arn }}"
2
  • Unfortunately, didn't work: FAILED! => {"msg": "template error while templating string: expected name or number. String: {{ server_cert_info_result.ansible_module_results.[server_ss l_certificate_name].arn }}"}
    – Life5ign
    Mar 15 at 17:04
  • As above, I inadvertently inserted an extra . in my comment above; so your suggestion does work. Why is there nothing about needing [ ] to surround variable names in attribute access in the ansible docs?
    – Life5ign
    Mar 19 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.