aws_ssm lookup does not fail when parameter does not exist #126

From @tinyzimmer on Jan 02, 2019 20:09

SUMMARY

Using the aws_ssm lookup plugin to fetch an application secret, if the parameter does not exist, the plugin will fail silently setting an empty string for the queried value.

ISSUE TYPE

• Bug Report

COMPONENT NAME

aws_ssm

ANSIBLE VERSION

2.7.5

CONFIGURATION

user@somecomputer /cygdrive/c/Users/{{ redacted }}/Development/{{ redacted }}
$ ansible-config dump --only-changed

user@somecomputer /cygdrive/c/Users/{{ redacted }}/Development/{{ redacted }}
$

OS / ENVIRONMENT

Running in Cygwin on Windows 10 Pro (work computer 🤢) but likely affects other platforms?

STEPS TO REPRODUCE

# test.yml
- name: Test Param Retrieval
  hosts: localhost
  gather_facts: false
  tasks:

    # I'd expect this to fail
    - set_fact:
        test_var: "{{ lookup('aws_ssm', 'nonexistant_param', region='us-east-1') }}"

    - debug:
        var: test_var

EXPECTED RESULTS

Fail because of non-existent parameter. Since it wasn't failing, I had no idea I was using the wrong AWS Shared Credentials Profile on the computer I was running this from. If this is expected behavior I suppose that's fine, but I don't see why it would be.

ACTUAL RESULTS

Playbook continues and any templates that use that value set it to an empty string

$ ansible-playbook test.yml
 [WARNING]: Unable to parse /etc/ansible/hosts as an inventory source

 [WARNING]: No inventory was parsed, only implicit localhost is available

 [WARNING]: provided hosts list is empty, only localhost is available. Note
that the implicit localhost does not match 'all'


PLAY [Test Param Retrieval] ****************************************************

TASK [set_fact] ****************************************************************
ok: [localhost]

TASK [debug] *******************************************************************
ok: [localhost] => {
    "test_var": ""
}

PLAY RECAP *********************************************************************
localhost                  : ok=2    changed=0    unreachable=0    failed=0

Copied from original issue: ansible/ansible#50466