Ansible cannot upload AWS public key - wrong AWS credentials - amazon-web-services

Question

I am trying to upload a custom Public keypair to my Amazon AWS account because I would like to use my custom-generated keypair for communication with AWS. I am trying to perform this upload using Ansible's ec2_key module.
Here is what I have done so far:
STEP 1. Sign up for Amazon AWS account here. I entered an "AWS Account Name" and password.
STEP 2. Install Python packages AWS CLI and boto:
$ pip install awscli boto
STEP 3. Generate SSH keypair (I used Ansible for this as well):
- name: Generate a 2048-bit SSH key for user
user:
name: "{{ ansible_ssh_user }}"
generate_ssh_key: yes
ssh_key_bits: 2048
ssh_key_file: ~/.ssh/id_rsa
STEP 4. I copied the contents of the public key (~/.ssh/id_rsa.pub) into /home/username/.aws/credentials.
STEP 5. Use Ansible task to upload public key to Amazon AWS with Ansible:
vars:
aws_access_key_id: my_key_name
aws_region: "us-west-2"
aws_secret_access_key: "ssh-rsa Y...r"
tasks:
- name: example3 ec2 key
ec2_key:
name: "{{ aws_access_key_id }}"
region: "{{ aws_region }}"
key_material: "{{ aws_secret_access_key }}"
state: present
force: True
validate_certs: yes
The output of step 5. is:
An exception occurred during task execution. ..."module_stderr": "Traceback (most
recent call last):\n File \"/tmp/ansible_WqbqHU/ansible_module_ec2_key.py\",...
raise self.ResponseError(response.status, response.reason,
body)\nboto.exception.EC2ResponseError: EC2ResponseError: 401 Unauthorized\n<?xml
version=\"1.0\" encoding=\"UTF-8\"?>
\n<Response><Errors><Error><Code>AuthFailure</Code><Message>AWS was not able to
validate the provided access credentials</Message></Error></Errors>...
Here is my /home/username/.aws/credentials (I just made up some key_id):
[default]
aws_access_key_id = my_key_name
aws_secret_access_key = ssh-rsa Y...r
Here is my /home/username/.aws/config:
[default]
output = json
region = us-west-2
Both of these files seem to agree with the AWS doc requirements here.
Additional Info:
Host system: Ubuntu 17.10 (non-root user)
The 2 Ansible tasks are run from separate Ansible playbooks - first the sshkeygen playbook is run and then the ec2_key playbook is run. Ansible playbooks are not run using become.
Ansible version = ansible==2.4.1.0
Boto version = boto==2.48.0, botocore==1.7.47
Questions
How can I instruct AWSCLI to communicate with my online account (STEP 1.)? It seems like I am missing this step somewhere in the Ansible task using the ec2_key module.
Currently, I have the SAME public key in (a) the 2nd Ansible task to upload the public key and (b) /home/username/.aws/credentials. Is this Ansible task missing something/incorrect? Should there be a 2nd public key?

Answer 1

You've put the SSH public key into the secret_access_key field.
It looks like this for me (letters mixed and replaced here of course, not my real key):
[Credentials]
aws_access_key_id = FMZAIQGTCHSLGSNDIPXT
aws_secret_access_key = gcmbyMs1Osj3ISCSasFtEx7sVCr92S3Mvjxlcwav
If you go to IAM (https://console.aws.amazon.com/iam), you can regenerate your keys.
You'll need to go to IAM->Users, click your username, click the Security Credentials, and "Create Access Key".
If you've just set up your account, it's likely that you don't have IAM users, only the so-called root account user (the one you signed up with). In this case, click your name at the top of the main screen, and select My Security Credentials. You might get a warning, but no worries in your case, you're not running a large organization. Click the Access Keys dropdown and click Create New Access Key (you might have none). This will give you the keys you need. Save them somewhere, because when you leave the screen, you'll no longer get the chance to see the secret access key, only the key ID.
However, if you are using a machine with a role attached, you don't need credentials at all, boto should pick them up.

Answer 2

Your secret access key looks wrong in your credentials. That should be associated with an IAM user or left blank if you’re running from an EC2 instance with an IAM role attached; not the key you’re trying to upload.

Answer 3

Can you SSH to the host already? I think the unauthorised error is coming from your attempted access to the host.
Something like:
ssh ec2-user#165.0.0.105 - i my_key.pem
You can see your public ip address in the aws console. If you face errors there, double check the instance is accepting ssh traffic in the security profile.