<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Documentation Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">ansible/lib/ansible/modules/cloud/amazon/*</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.3.0.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]"><pre class="notranslate"><code class="notranslate">ansible 2.3.0.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
  python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]
</code></pre></div>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Working with three modules from the cloud/amazon library</p>
<ul dir="auto">
<li>iam</li>
<li>iam_policy</li>
<li>s3_bucket</li>
</ul>
<p dir="auto">I had to experiment with the ansible user I created on amazon to get the user privileges correct for each module. This was because I want to allow the anisble user the MINIMUM required to perform the actions in my role and no more. Finally I created the following two policies:</p>
<div class="highlight highlight-source-js notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="//Create a user
{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Sid&quot;: &quot;AllowUsersToPerformUserActions&quot;,
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
                &quot;iam:GetUser&quot;,
                &quot;iam:UpdateUser&quot;,
                &quot;iam:CreateUser&quot;,
                &quot;iam:CreateAccessKey&quot;,
                &quot;iam:PutUserPolicy&quot;,
                &quot;iam:ListUsers&quot;,
                &quot;iam:ListAccessKeys&quot;,
                &quot;iam:ListGroups&quot;,
                &quot;iam:ListRoles&quot;,
                &quot;iam:ListInstanceProfiles&quot;,
                &quot;iam:ListGroupsForUser&quot;,
                &quot;iam:ListUserPolicies&quot;,
                &quot;iam:ListAttachedUserPolicies&quot;
            ],
            &quot;Resource&quot;: &quot;*&quot;
        }
    ]
}

//Create a bucket
{
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
        {
            &quot;Sid&quot;: &quot;DBCreateVersionedBucketWithTags&quot;,
            &quot;Effect&quot;: &quot;Allow&quot;,
            &quot;Action&quot;: [
                &quot;s3:CreateBucket&quot;,
                &quot;s3:ListBucket&quot;,
                &quot;s3:GetBucketPolicy&quot;,
                &quot;s3:GetBucketVersioning&quot;,
                &quot;s3:GetBucketRequestPayment&quot;,
                &quot;s3:GetBucketTagging&quot;,
                &quot;s3:PutBucketPolicy&quot;,
                &quot;s3:PutBucketTagging&quot;,
                &quot;s3:PutBucketVersioning&quot;
            ],
            &quot;Resource&quot;: [
                &quot;*&quot;
            ]
        }
    ]
}"><pre class="notranslate"><span class="pl-c">//Create a user</span>
<span class="pl-kos">{</span>
    <span class="pl-s">"Version"</span>: <span class="pl-s">"2012-10-17"</span><span class="pl-kos">,</span>
    <span class="pl-s">"Statement"</span>: <span class="pl-kos">[</span>
        <span class="pl-kos">{</span>
            <span class="pl-s">"Sid"</span>: <span class="pl-s">"AllowUsersToPerformUserActions"</span><span class="pl-kos">,</span>
            <span class="pl-s">"Effect"</span>: <span class="pl-s">"Allow"</span><span class="pl-kos">,</span>
            <span class="pl-s">"Action"</span>: <span class="pl-kos">[</span>
                <span class="pl-s">"iam:GetUser"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:UpdateUser"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:CreateUser"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:CreateAccessKey"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:PutUserPolicy"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:ListUsers"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:ListAccessKeys"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:ListGroups"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:ListRoles"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:ListInstanceProfiles"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:ListGroupsForUser"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:ListUserPolicies"</span><span class="pl-kos">,</span>
                <span class="pl-s">"iam:ListAttachedUserPolicies"</span>
            <span class="pl-kos">]</span><span class="pl-kos">,</span>
            <span class="pl-s">"Resource"</span>: <span class="pl-s">"*"</span>
        <span class="pl-kos">}</span>
    <span class="pl-kos">]</span>
<span class="pl-kos">}</span>

<span class="pl-c">//Create a bucket</span>
<span class="pl-kos">{</span>
    <span class="pl-s">"Version"</span>: <span class="pl-s">"2012-10-17"</span><span class="pl-kos">,</span>
    <span class="pl-s">"Statement"</span>: <span class="pl-kos">[</span>
        <span class="pl-kos">{</span>
            <span class="pl-s">"Sid"</span>: <span class="pl-s">"DBCreateVersionedBucketWithTags"</span><span class="pl-kos">,</span>
            <span class="pl-s">"Effect"</span>: <span class="pl-s">"Allow"</span><span class="pl-kos">,</span>
            <span class="pl-s">"Action"</span>: <span class="pl-kos">[</span>
                <span class="pl-s">"s3:CreateBucket"</span><span class="pl-kos">,</span>
                <span class="pl-s">"s3:ListBucket"</span><span class="pl-kos">,</span>
                <span class="pl-s">"s3:GetBucketPolicy"</span><span class="pl-kos">,</span>
                <span class="pl-s">"s3:GetBucketVersioning"</span><span class="pl-kos">,</span>
                <span class="pl-s">"s3:GetBucketRequestPayment"</span><span class="pl-kos">,</span>
                <span class="pl-s">"s3:GetBucketTagging"</span><span class="pl-kos">,</span>
                <span class="pl-s">"s3:PutBucketPolicy"</span><span class="pl-kos">,</span>
                <span class="pl-s">"s3:PutBucketTagging"</span><span class="pl-kos">,</span>
                <span class="pl-s">"s3:PutBucketVersioning"</span>
            <span class="pl-kos">]</span><span class="pl-kos">,</span>
            <span class="pl-s">"Resource"</span>: <span class="pl-kos">[</span>
                <span class="pl-s">"*"</span>
            <span class="pl-kos">]</span>
        <span class="pl-kos">}</span>
    <span class="pl-kos">]</span>
<span class="pl-kos">}</span></pre></div>
<p dir="auto">However, I am still not completely sure these are the MINIMUM required by the modules.</p>
<p dir="auto">Can I request that the module documentation include a set of minimal permissions for performing each module operation? Or is that beyond the scope of the docs?</p>
<p dir="auto">Many thanks</p>
<ul dir="auto">
<li>Documentation Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">aws modules (various)</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<p dir="auto">2.2.1.0</p>
<p dir="auto">Documentation for AWS specific modules (ec2_vol etc), should outline which IAM permissions are required for the module to work.</p>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">There should be a note on the AWS specific module outlining the list of IAM permissions that module uses to do it's job. Otherwise the end user is left with the prospect of pouring through ansible source code, and trying to guess what has been called. At the very least, the sts coded errors should be displayed to the user in the output together with the existing 'permission denied' error.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">Currently the error message of 'permission denied' is pretty useless, as you don't know WHICH permission was denied, or which was being attempted, either.</p>