Add boto3 session cache

[mixja]

SUMMARY

This PR provides a session cache for boto3 assume role provider.

This is useful if you use AWS CLI profiles locally and use MFA when running Ansible locally, and don't want to have to input your MFA token each time you run your playbook.

Note that this cache is only invoked if boto3 invokes the assume-role provider, hence it does not affect operation if you have configured AWS credentials that don't require role assumption.

ISSUE TYPE

• Feature Pull Request

COMPONENT NAME

ec2 utils

ANSIBLE VERSION

ansible 2.4.0
  config file =
  configured module search path = [u'/Users/jmenga/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.13 (default, Dec 18 2016, 07:03:39) [GCC 4.2.1 Compatible Apple LLVM 8.0.0 (clang-800.0.42.1)]

ADDITIONAL INFORMATION

Before this PR:

$ ansible-playbook site.yml 
PLAY [Test Play]

TASK [Execute a boto3 based module] ***************************************
Enter MFA code: *****
ok: [localhost]

PLAY RECAP ************************************************************************************
localhost                     : ok=1   changed=1    unreachable=0    failed=0

# Re-running the playbook requires you to enter your MFA token every time
$ ansible-playbook site.yml 
PLAY [Test Play]

TASK [Execute a boto3 based module] ***************************************
Enter MFA code: *****
ok: [localhost]

PLAY RECAP ************************************************************************************
localhost                     : ok=1   changed=1    unreachable=0    failed=0

After this PR:

$ ansible-playbook site.yml 
PLAY [Test Play]

TASK [Execute a boto3 based module] ***************************************
Enter MFA code: *****
ok: [localhost]

PLAY RECAP ************************************************************************************
localhost                     : ok=1   changed=1    unreachable=0    failed=0

# We can now run the playbook without MFA for up to the temporary session credential lifetime (typically one hour)
$ ansible-playbook site.yml 
PLAY [Test Play]

TASK [Execute a boto3 based module] ***************************************
ok: [localhost]

PLAY RECAP ************************************************************************************
localhost                     : ok=1   changed=1    unreachable=0    failed=0

[ansibot]

cc @willthames
click here for bot help

[ansibot]

The test ansible-test sanity --test pep8 failed with the following errors:

lib/ansible/module_utils/ec2.py:67:1: W293 blank line contains whitespace
lib/ansible/module_utils/ec2.py:153:1: W293 blank line contains whitespace

click here for bot help

[dsouzajude]

Any update on this feature?

[michalgasek]

I am interested in this also, any updates?

[mixja]

boto3 now includes native support for the session cache, would make sense to leverage that

[dsouzajude]

Any updates yet? We'd like ansible to make boto use the awscli credential cache so we're not asked to provide mfa tokens repeatedly. The solution is already present here! Needs review and merging!

[goneri]

f is already at 0, the truncate() is uselesss.

[goneri]

Could you instead reuse the version from botocore?: https://github.com/boto/botocore/blob/develop/botocore/credentials.py#L182-L224

[s-hertel]

There's a code snippet from mixja in boto/botocore#1157 (comment) that looks like a good way to go about this. Ideally this would be enabled for boto3 via config (here are a couple issues tracking that boto/boto3#1179, boto/botocore#1148) and require minimal if any code changes to Ansible. It appears other SDKs keeping parity may be part of the hold-up for that though.

[jankeesvanandel]

What's the status of this PR? It's really annoying having to type the token each time I run a script.

[willthames]

@jankeesvanandel the status is that the feedback hasn't been addressed and it needs rebasing to avoid merge conflicts.

If you're happy with the code you can just use the file in your own environment:

http://willthames.github.io/2017/12/12/using-updated-modules-with-stable-ansible.html

[gundalow]

This PR has needed a rebase since October 2017.

@jankeesvanandel Would you be interested in creating a fresh PR for this?