aws_ssm: Wrong pre-signed URL when curl-ing AnsiballZ_systemd.py on newer AWS regions

[mfornasa]

Summary

AWS changed the behaviour of S3 in newer AWS regions (e.g. eu-south-1), so boto3 does not generate the correct pre-signed URL. This breaks aws-ssm when downloading AnsiballZ_systemd.py. The command:

<i-XXXXX> EXEC curl 'https://s3.eu-south-1.amazonaws.com/....../.ansible/tmp/ansible-tmp-1670516070.746575-42763-145799413608234/AnsiballZ_setup.py?X-Amz-Algorithm=...'

is return the following error:

The eu-south-1 location constraint is incompatible for the region specific endpoint this request was sent to.

A possible workaround can be found here: boto/boto3#3015 (comment)

I implemented a super-dirty workaround in file plugins/connection/aws_ssm.py, function _get_boto_client:

        if service == "s3" and region_name is not None:
            client = session.client(
                service,
                endpoint_url="https://s3." + region_name + ".amazonaws.com",
                config=Config(signature_version="s3v4")
            )
        else:
            client = session.client(
                service,
                config=Config(signature_version="s3v4")
            )
        return client

It works for me now. I did not test it on other regions / parameter combinations.

Issue Type

Bug Report

Component Name

aws_ssm

Ansible Version

$ ansible --version
ansible [core 2.13.6]
  config file = /Users/mf/mf/github/infra-ansible/ansible.cfg
  configured module search path = ['/Users/mf/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /opt/homebrew/Cellar/ansible/6.6.0/libexec/lib/python3.11/site-packages/ansible
  ansible collection location = /Users/mf/.ansible/collections:/usr/share/ansible/collections
  executable location = /opt/homebrew/bin/ansible
  python version = 3.11.0 (main, Oct 25 2022, 13:57:33) [Clang 14.0.0 (clang-1400.0.29.202)]
  jinja version = 3.1.2
  libyaml = True

Collection Versions

$ ansible-galaxy collection list
[...]
Collection    Version
------------- -------
amazon.aws    5.1.0
community.aws 5.0.0

OS / Environment

MacOS Monterey

Steps to Reproduce

Execute a playbook using aws_ssm access.

Expected Results

Playbook execution gives an error.

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[ansibullbot]

Files identified in the description:

• [plugins/connection/aws_ssm.py](https://github.com/['ansible-collections/amazon.aws', 'ansible-collections/community.aws', 'ansible-collections/community.vmware']/blob/main/plugins/connection/aws_ssm.py)

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help