check_mode option is not referenced in ec2_instance

[cahlchang]

SUMMARY

In the ec2_instance module, the instance also starts up when check_mode is enabled.
I am working on this problem and I am planning to release PR later.

ISSUE TYPE

• Bug Report

COMPONENT NAME

ec2_instance

ANSIBLE VERSION

$ ansible --version
ansible 2.7.0
  config file = None
  configured module search path = ['/home/cahlchang/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.6/dist-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 3.6.5 (default, May  3 2018, 10:08:28) [GCC 5.4.0 20160609]

CONFIGURATION

$ ansible-config dump --only-changed
$
# no changed

OS / ENVIRONMENT

ubuntu16.04

STEPS TO REPRODUCE

$ ansible-playbook -C test.yml -vvv

  - name: create ec2 instance
    ec2_instance:
      name: test-ec2-2
      state: present
      image_id: "{{ map_ami_param.image_id }}"
      profile: wheel-base-iamrole
      instance_type: "t2.micro"
      key_name: "base_keypair"
      vpc_subnet_id: "{{ list_subnets | selectattr ('name_subnet', 'equalto', 'wheel-public-1c') | map(attribute='id_subnet') | list | first }}"
      security_group: "default"
      volumes:
        - device_name: "/dev/sda1"
          ebs:
            volume_size: 16
            delete_on_termination: true
      profile: "test"
      region: "ap-northeast-1"
    check_mode: true # Just for sure

EXPECTED RESULTS

ACTUAL RESULTS

TASK [create ec2 instance] ******************************************************************************************************************************************************************************************task path: /home/cahlchang/git/ansible_dev_work/test.yml:40
<127.0.0.1> ESTABLISH LOCAL CONNECTION FOR USER: cahlchang
<127.0.0.1> EXEC /bin/sh -c 'echo ~cahlchang && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /home/cahlchang/.ansible/tmp/ansible-tmp-1538977531.9534602-129065864925869 `" && echo ansible-tmp-1538977531.9534602-129065864925869="` echo /home/cahlchang/.ansible/tmp/ansible-tmp-1538977531.9534602-129065864925869 `" ) && sleep 0'
Using module file /usr/local/lib/python3.6/dist-packages/ansible/modules/cloud/amazon/ec2_instance.py
<127.0.0.1> PUT /home/cahlchang/.ansible/tmp/ansible-local-3124x71lxgex/tmp0s1jvslh TO /home/cahlchang/.ansible/tmp/ansible-tmp-1538977531.9534602-129065864925869/AnsiballZ_ec2_instance.py
<127.0.0.1> EXEC /bin/sh -c 'chmod u+x /home/cahlchang/.ansible/tmp/ansible-tmp-1538977531.9534602-129065864925869/ /home/cahlchang/.ansible/tmp/ansible-tmp-1538977531.9534602-129065864925869/AnsiballZ_ec2_instance.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c '/usr/bin/python3.6 /home/cahlchang/.ansible/tmp/ansible-tmp-1538977531.9534602-129065864925869/AnsiballZ_ec2_instance.py && sleep 0'
<127.0.0.1> EXEC /bin/sh -c 'rm -f -r /home/cahlchang/.ansible/tmp/ansible-tmp-1538977531.9534602-129065864925869/ > /dev/null 2>&1 && sleep 0'
changed: [localhost] => {
    "changed": true,
    "instance_ids": [
        "i-xxxxxxxxxxxxxxxxxx"
    ],
    "instances": [
        {

When I actually checked the AWS console, I confirmed that an EC 2 instance was made.

ASSUMED LOCATION AS PROBLEM

ansible/lib/ansible/modules/cloud/amazon/ec2_instance.py

Line 1515 in 990e95e

supports_check_mode=True

And there is no logic to use the check mode option in this code.

[ansibot]

Files identified in the description:

• lib/ansible/modules/cloud/amazon/ec2_instance.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[ansibot]

Hi @cahlchang,

Thank you for the issue, just so you are aware we have a dedicated Working Group for aws.
You can find other people interested in this in #ansible-aws on Freenode IRC
For more information about communities, meetings and agendas see https://github.com/ansible/community

click here for bot help

[briantist]

Thanks for this. It's really disconcerting how many ansible modules in "stable" releases make changes in check mode.

Workaround for anyone who encounters these: when: not ansible_check_mode :(

[cahlchang]

I sent the modified code with the above PR.
I changed the test, so it seems to be working properly.
Try it if you like.

[dead10ck]

This is a very serious bug. I ran into it today by inadvertently making changes to existing production ec2 instances. Fortunately, in my case it was only adding a tag and an IAM role, but it could easily have been accidental termination. This shouldn't wait until 2.8. I think this warrants an emergency patch release to all stable branches.