How to do multi-conditional loops with Ansible? - ansible

Question

I have roles and users. I would like to loop over my roles for users that contains the state=present.
iam_roles:
- name: "developers-role"
assume_role_policy_document: "developers"
state: present
managed_policy:
- arn:aws:iam::XXXXXXXXXXX:policy/CustomAmazonS3ReadOnlyAccess
- name: "bigdata-role"
assume_role_policy_document: "bigdata"
state: present
managed_policy:
- arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess
- arn:aws:iam::XXXXXXXXXXX:policy/CustomAmazonRDSReadOnlyAccess
iam_users:
- name: test-user-1
state: present
groups: [developers]
password:
slack_name:
access_key_state: create
- name: test-user-2
state: present
groups: [developers]
password:
slack_name:
I'm trying filter and get only the users with the state=present and use it on my when clause, but no luck so far.
- name: Loop all the present users
debug: msg={{ item }}
when: "{{ item.state == 'present' }}"
with_items: "{{ iam_users }}"
tags: always
register: present_users
- set_fact:
iam_present_users: "{{ present_users.results }}"
tags: always
- name: Show only present users, ideally
debug: msg="{{ iam_present_users }}"
tags: always
- name: Manage AWS IAM Roles
iam_role:
name: "{{ item.name }}"
assume_role_policy_document: "{{ lookup('template', policies_path + '/assume-role/' + item.assume_role_policy_document + '.json') }}"
state: "{{ item.state }}"
managed_policy: "{{ item.managed_policy }}"
when: "{{ item.managed_policy is defined and iam_present_users is defined }}"
with_items: "{{ iam_roles }}"
tags: manage_roles

Answer 1

Your use of a debug statement to try to extract users seems odd. If you want to select objects from a list based on the value of an attribute, your best choice is probably the Jinja2 selectattr filter. For example, given this input:
iam_users:
- name: test-user-1
state: present
groups: [developers]
password:
slack_name:
access_key_state: create
- name: test-user-2
state: present
groups: [developers]
password:
slack_name:
- name: test-user-3
state: absent
groups: [developers]
password:
slack_name:
You could use this set_fact task:
- set_fact:
iam_present_users: "{{ iam_users|selectattr('state', 'equalto', 'present')|list }}"
Which would result in iam_present_users containing:
"iam_present_users": [
{
"access_key_state": "create",
"groups": [
"developers"
],
"name": "test-user-1",
"password": null,
"slack_name": null,
"state": "present"
},
{
"groups": [
"developers"
],
"name": "test-user-2",
"password": null,
"slack_name": null,
"state": "present"
}
]
See the jinja documentation for the stock list of filters, and the ansible documentation for a list of filters specific to ansible.