Fix ec2_win_password to allow blank key_passphrase

[jonjozwiak]

SUMMARY

There was a change between ansible 2.3.2 and ansible 2.4.0 that broke the ec2_win_password module if using a key without a passphrase. The below task worked in 2.3.2 and fails in 2.4.0:

- name: obtain windows passwords for instances
  ec2_win_password:
    region: "us-east-1"
    instance_id: "i-09b943879876303ea"
    key_file: "/home/jjozwiak/.ssh/id_rsa"
    wait: yes
    wait_timeout: 45
  register: ec2_password

In 2.4.0 this returns a failure indicating the private key is given a passphrase, but the key isn't encrypted.

The full traceback is:
File "/tmp/ansible_6K5Q9I/ansible_module_ec2_win_password.py", line 167, in main
key = load_pem_private_key(f.read(), b_key_passphrase, BACKEND)
File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/primitives/serialization.py", line 20, in load_pem_private_key
return backend.load_pem_private_key(data, password)
File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1006, in load_pem_private_key
password,
File "/usr/lib64/python2.7/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 1231, in _load_key
"Password was given but private key is not encrypted.")

This can be fixed by passing a None as the passphrase if one isn't defined

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

modules/cloud/amazon/ec2_win_password.py

ANSIBLE VERSION

ansible 2.4.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/jjozwiak/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/site-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.13 (default, Jun 26 2017, 10:20:05) [GCC 7.1.1 20170622 (Red Hat 7.1.1-3)]

ADDITIONAL INFORMATION

After change, I get a successful run: 
PLAY [localhost] ***********************************************************************************************

TASK [obtain windows passwords for instances] ******************************************************************
changed: [localhost]

TASK [debug] ***************************************************************************************************
ok: [localhost] => {
    "ec2_password": {
        "changed": true, 
        "elapsed": 0, 
        "failed": false, 
        "win_password": "******************************"
    }
}

PLAY RECAP *****************************************************************************************************
localhost                  : ok=2    changed=1    unreachable=0    failed=0  

[ansibot]

cc @RickMendes @willthames
click here for bot help

[jhawkesworth]

I'm not a user of this module but the code looks like it does what is described.

[carpnick]

I can validate this broke between 2.3.2 and 2.4

[willthames]

@carpnick are you able to validate the fix works for you?

[carpnick]

@willthames I can confirm that this does fix the issue. I installed 2.4, validated it failed, applied the patch, everything works.

[carpnick]

@crazycoop74 FYI

[willthames]

rebuild_merge

Thanks @carpnick for verifying the PR and @jonjozwiak for the implementation

[jborean93]

@willthames I'm guessing this should be cherry-picked to stable-2.4 for the 2.4.1 release. Let me know if you don't want this to happen.

[willthames]

@jborean93 I'm fine with it being cherry picked

[jborean93]

Thanks @willthames, cherry-picked under 60e98a3 for 2.4.1.