amazon.aws.ec2_spot_instance failed to create tags for the spot instance launched when tags parameter is used

[roy-boy]

Summary

When use model amazon.aws.ec2_spot_instance with tags specified, the spot instance got launched but the tags are missing, the tags are only shown in the AWS console "Spot Requests" page. See screenshot attached.

I'm upgrading Ansible version from 2.9 to 9 at the moment, the aws spot request is still working in 2.9 version with the tags, I've referenced the this AWS Doc page: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts-spot-instances-request-tags.html added an iam policy for my user to allow RequestSpotInstances and CreateTags, however it's still not working. I wonder if it's permission related or it's a bug of the ec2_spot_instance model.

Any advice would be much appreciated , thanks!

Issue Type

Bug Report

Component Name

ec2_spot_instance

Ansible Version

(ansible9) [rli@sandbox1 cluster]$ ansible --version
ansible [core 2.16.14]
  config file = /home/rli/cluster/ansible.cfg
  configured module search path = ['/home/rli/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/rli/ansible9/lib/python3.11/site-packages/ansible
  ansible collection location = /home/rli/.ansible/collections:/usr/share/ansible/collections
  executable location = /home/rli/ansible9/bin/ansible
  python version = 3.11.7 (main, Jan 26 2024, 20:24:17) [GCC 8.5.0 20210514 (Red Hat 8.5.0-21)] (/home/rli/ansible9/bin/python)
  jinja version = 3.1.5
  libyaml = True

Collection Versions

(ansible9) [rli@sandbox1 cluster]$ ansible-galaxy collection list

# /home/rli/ansible9/lib/python3.11/site-packages/ansible_collections
Collection                               Version
---------------------------------------- -------
amazon.aws                               7.6.1  
ansible.netcommon                        5.3.0  
ansible.posix                            1.6.2  
ansible.utils                            2.12.0 
ansible.windows                          2.5.0  
arista.eos                               6.2.2  
awx.awx                                  23.9.0 
azure.azcollection                       1.19.0 
check_point.mgmt                         5.2.3  
chocolatey.chocolatey                    1.5.3  
cisco.aci                                2.10.1 
cisco.asa                                4.0.3  
cisco.dnac                               6.25.0 
cisco.intersight                         2.0.20 
cisco.ios                                5.3.0  
cisco.iosxr                              6.1.1  
cisco.ise                                2.9.6  
cisco.meraki                             2.18.3 
cisco.mso                                2.9.0  
cisco.nxos                               5.3.0  
cisco.ucs                                1.14.0 
cloud.common                             2.1.4  
cloudscale_ch.cloud                      2.4.0  
community.aws                            7.2.0  
community.azure                          2.0.0  
community.ciscosmb                       1.0.9  
community.crypto                         2.22.3 
community.digitalocean                   1.27.0 
community.dns                            2.9.8  
community.docker                         3.13.3 
community.general                        8.6.8  
community.grafana                        1.9.1  
community.hashi_vault                    6.2.0  
community.hrobot                         1.9.4  
community.library_inventory_filtering_v1 1.0.2  
community.libvirt                        1.3.0  
community.mongodb                        1.7.8  
community.mysql                          3.11.0 
community.network                        5.1.0  
community.okd                            2.3.0  
community.postgresql                     3.9.0  
community.proxysql                       1.6.0  
community.rabbitmq                       1.3.0  
community.routeros                       2.20.0 
community.sap                            2.0.0  
community.sap_libs                       1.4.2  
community.sops                           1.9.1  
community.vmware                         4.8.1  
community.windows                        2.3.0  
community.zabbix                         2.5.1  
containers.podman                        1.16.2 
cyberark.conjur                          1.3.1  
cyberark.pas                             1.0.30 
dellemc.enterprise_sonic                 2.5.1  
dellemc.openmanage                       8.7.0  
dellemc.powerflex                        2.5.0  
dellemc.unity                            1.7.1  
f5networks.f5_modules                    1.32.1 
fortinet.fortimanager                    2.8.2  
fortinet.fortios                         2.3.8  
frr.frr                                  2.0.2  
gluster.gluster                          1.0.2  
google.cloud                             1.4.1  
grafana.grafana                          2.2.5  
hetzner.hcloud                           2.5.0  
hpe.nimble                               1.1.4  
ibm.qradar                               2.1.0  
ibm.spectrum_virtualize                  2.0.0  
ibm.storage_virtualize                   2.5.0  
ieisystem.inmanage                       2.0.0  
infinidat.infinibox                      1.4.5  
infoblox.nios_modules                    1.7.1  
inspur.ispim                             2.2.3  
inspur.sm                                2.3.0  
junipernetworks.junos                    5.3.1  
kaytus.ksmanage                          1.2.2  
kubernetes.core                          2.4.2  
lowlydba.sqlserver                       2.3.4  
microsoft.ad                             1.7.1  
netapp.aws                               21.7.1 
netapp.azure                             21.10.1
netapp.cloudmanager                      21.24.0
netapp.elementsw                         21.7.0 
netapp.ontap                             22.13.0
netapp.storagegrid                       21.13.0
netapp.um_info                           21.8.1 
netapp_eseries.santricity                1.4.1  
netbox.netbox                            3.20.0 
ngine_io.cloudstack                      2.5.0  
ngine_io.exoscale                        1.1.0  
openstack.cloud                          2.3.0  
openvswitch.openvswitch                  2.1.1  
ovirt.ovirt                              3.2.0  
purestorage.flasharray                   1.32.0 
purestorage.flashblade                   1.19.1 
purestorage.fusion                       1.6.1  
sensu.sensu_go                           1.14.0 
splunk.es                                2.1.2  
t_systems_mms.icinga_director            2.0.1  
telekom_mms.icinga_director              1.35.0 
theforeman.foreman                       3.15.0 
vmware.vmware                            1.7.1  
vmware.vmware_rest                       2.3.1  
vultr.cloud                              1.13.0 
vyos.vyos                                4.1.0  
wti.remote                               1.0.10 

AWS SDK versions

(ansible9) [rli@sandbox1 cluster]$ pip show boto boto3 botocore
WARNING: Package(s) not found: boto
Name: boto3
Version: 1.35.87
Summary: The AWS SDK for Python
Home-page: https://github.com/boto/boto3
Author: Amazon Web Services
Author-email: 
License: Apache License 2.0
Location: /home/rli/ansible9/lib/python3.11/site-packages
Requires: botocore, jmespath, s3transfer
Required-by: 
---
Name: botocore
Version: 1.35.87
Summary: Low-level, data-driven core of boto 3.
Home-page: https://github.com/boto/botocore
Author: Amazon Web Services
Author-email: 
License: Apache License 2.0
Location: /home/rli/ansible9/lib/python3.11/site-packages
Requires: jmespath, python-dateutil, urllib3
Required-by: boto3, s3transfer

Configuration

(ansible9) [rli@sandbox1 cluster]$ ansible-config dump --only-changed
ACTION_WARNINGS(/home/rli/cluster/ansible.cfg) = False
CONFIG_FILE() = /home/rli/cluster/ansible.cfg
DEFAULT_VAULT_PASSWORD_FILE(/home/rli/cluster/ansible.cfg) = /home/rli/cluster/files/vault.pass
DISPLAY_SKIPPED_HOSTS(/home/rli/cluster/ansible.cfg) = False
HOST_KEY_CHECKING(/home/rli/cluster/ansible.cfg) = False
INTERPRETER_PYTHON(/home/rli/cluster/ansible.cfg) = auto_silent
LOCALHOST_WARNING(/home/rli/cluster/ansible.cfg) = False

OS / Environment

(ansible9) [rli@sandbox1 cluster]$ cat /etc/redhat-release
Rocky Linux release 8.7 (Green Obsidian)

Steps to Reproduce

- name:  to debug spot intance with tags
  hosts: localhost
  any_errors_fatal: true
  connection: local
  gather_facts: false
  environment:
    BOTO_USE_ENDPOINT_HEURISTICS: True
  pre_tasks:
    - include_vars: "../../{{ run_dir }}global_var.yml"

  tasks:
    - name: start up HS cluster nodes from saved ami - spot
      amazon.aws.ec2_spot_instance:
        aws_access_key: "{{ec2_access_key}}"
        aws_secret_key: "{{ec2_secret_key}}"
        region: "{{ aws_region }}"
        spot_price: "{{ec2_spot_price}}"
        launch_specification:
          image_id: "{{id}}"
          instance_type: t3.large
          placement:
            availability_zone: "ap-northeast-2a"
          network_interfaces:
            - associate_public_ip_address: true
              groups: "{{g_id}}"
              subnet_id: "{{subnet-id}}"
              device_index: 0
        tags:
          Name: "test_tag"
          cluster_id: "12345"

Expected Results

The spot instance launched with 2 tags attached
Name: "test_tag"
cluster_id: "12345"

Actual Results

TASK [start up HS cluster nodes from saved ami - spot] ************************************************************************************************************************************************
task path: /home/rli/cluster/aws_ansible/playbooks/spot_tag_test.yml:12
changed: [127.0.0.1] => {
    "changed": true,
    "invocation": {
        "module_args": {
            "access_key": "xxxxx",
            "aws_access_key": "xxxx",
            "aws_ca_bundle": null,
            "aws_config": null,
            "aws_secret_key": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "client_token": null,
            "count": 1,
            "debug_botocore_endpoint_logs": false,
            "endpoint_url": null,
            "interruption": "terminate",
            "launch_group": null,
            "launch_specification": {
                "block_device_mappings": null,
                "ebs_optimized": false,
                "iam_instance_profile": null,
                "image_id": "ami-xxxxxx",
                "instance_type": "t3.large",
                "kernel_id": null,
                "key_name": null,
                "monitoring": null,
                "network_interfaces": [
                    {
                        "associate_carrier_ip_address": null,
                        "associate_public_ip_address": true,
                        "delete_on_termination": null,
                        "description": null,
                        "device_index": 0,
                        "groups": [
                            "sg-xxxxxx"
                        ],
                        "interface_type": null,
                        "ipv4_prefix_count": null,
                        "ipv4_prefixes": null,
                        "ipv6_address_count": null,
                        "ipv6_addresses": null,
                        "ipv6_prefix_count": null,
                        "ipv6_prefixes": null,
                        "network_card_index": null,
                        "network_interface_id": null,
                        "private_ip_address": null,
                        "private_ip_addresses": null,
                        "secondary_private_ip_address_count": null,
                        "subnet_id": "subnet-xxxxxx"
                    }
                ],
                "placement": {
                    "availability_zone": "ap-northeast-2a",
                    "group_name": null,
                    "tenancy": "default"
                },
                "ramdisk_id": null,
                "security_group_ids": null,
                "security_groups": null,
                "subnet_id": null,
                "user_data": null
            },
            "profile": null,
            "region": "ap-northeast-2",
            "secret_key": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "session_token": null,
            "spot_instance_request_ids": null,
            "spot_price": "0.3",
            "spot_type": "one-time",
            "state": "present",
            "tags": {
                "Name": "test_tag",
                "cluster_id": "12345"
            },
            "terminate_instances": false,
            "validate_certs": true,
            "zone_group": null
        }
    },
    "spot_request": {
        "create_time": "2025-01-10T10:15:55+00:00",
        "instance_interruption_behavior": "terminate",
        "launch_specification": {
            "ebs_optimized": false,
            "image_id": "ami-xxxxxxx",
            "instance_type": "t3.large",
            "monitoring": {
                "enabled": false
            },
            "network_interfaces": [
                {
                    "associate_public_ip_address": true,
                    "device_index": 0,
                    "subnet_id": "subnet-xxxxxx"
                }
            ],
            "placement": {
                "availability_zone": "ap-northeast-2a",
                "tenancy": "default"
            },
            "security_groups": [
                {
                    "group_name": "default"
                }
            ]
        },
        "product_description": "Linux/UNIX",
        "spot_instance_request_id": "sir-hqkq378h",
        "spot_price": "0.300000",
        "state": "open",
        "status": {
            "code": "pending-evaluation",
            "message": "Your Spot request has been submitted for review, and is pending evaluation.",
            "update_time": "2025-01-10T10:15:55+00:00"
        },
        "tags": {
            "Name": "test_tag",
            "cluster_id": "12345"
        },
        "type": "one-time"
    },
    "warnings": [
        "packaging.version Python module not installed, unable to check AWS SDK versions"
    ]
}

Please note that I masked all the personal aws info in the console output wit "xxxx".

Code of Conduct

• I agree to follow the Ansible Code of Conduct

[abikouo]

@roy-boy This is an expected behavior, the tags parameter defined in the module is used to tag spot instance requests, according to AWS documentation

When you tag a Spot Instance request, the instances and volumes that are launched by the Spot Instance request are not automatically tagged. You need to explicitly tag the instances and volumes launched by the Spot Instance request. (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts-spot-instances-request-tags.html)

We cannot add a new feature to tag instances created because the API request_spot_instances does not allow it.

[roy-boy]

@abikouo Thanks for the explanation, I will use amazon.aws.ec2_tag this model to add tags explicitly after the spot instance is launched.