ec2_metadata_facts reports wrong role name with _expiration suffix

[gchiesa]

SUMMARY

The ec2_metadata_facts module reports a wrong role name

ISSUE TYPE

• Bug Report

COMPONENT NAME

ec2_metadata_facts.py

ANSIBLE VERSION

ansible 2.6.3
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/root/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /bin/ansible
  python version = 2.7.5 (default, Jul 13 2018, 13:06:57) [GCC 4.8.5 20150623 (Red Hat 4.8.5-28)]

CONFIGURATION

DEFAULT_LOG_PATH(/etc/ansible/ansible.cfg) = /var/log/ansible.log

OS / ENVIRONMENT

CentOS Linux release 7.5.1804 (Core)

STEPS TO REPRODUCE

Start an AWS EC2 instance with a instance profile (role) attached
Install ansible 2.6.3 with pip
Run the commands:

ansible localhost -m ec2_metadata_facts | grep instance_profile

EXPECTED RESULTS

We expect to get the role associated to the instance, with a similar output:

 [WARNING]: Unable to parse /etc/ansible/hosts as an inventory source
 [WARNING]: No inventory was parsed, only implicit localhost is available
 [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'
        "ansible_ec2_iam_instance_profile_role": "<ROLE_NAME>", 

ACTUAL RESULTS

It reports instead the <ROLE_NAME>_expiration

 [WARNING]: Unable to parse /etc/ansible/hosts as an inventory source
 [WARNING]: No inventory was parsed, only implicit localhost is available
 [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'
        "ansible_ec2_iam_instance_profile_role": "<ROLE_NAME>_expiration", 

This is due to the changes introduced with this commit:
bed5f73#diff-6b099934176f95df43f465d4ea00b635

[ansibot]

Files identified in the description:

• lib/ansible/modules/cloud/amazon/ec2_metadata_facts.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

cc @roadmapper @silviud
click here for bot help

[ansibot]

Hi @gchiesa,

Thank you for the issue, just so you are aware we have a dedicated Working Group for aws.
You can find other people interested in this in #ansible-aws on Freenode IRC
For more information about communities, meetings and agendas see https://github.com/ansible/community

click here for bot help

[roadmapper]

Sorry for the delay in checking this, but I now understand that the underscore check was there to prevent the keys (accesskeyid, code, expiration, lastupdated, secretaccesskey, tokentype) from the JSON dictionary after the IAM role (169.254.169.254/latest/meta-data/iam/security-credentials/<role name>) from leaking into the check to parse out the IAM role name. I've identified a fix for this.

[roman-vynar]

It is still broken. Now the role is set to the profile name instead of a role name, please see #45534 (comment)