na_sg_org_container - Bucketpolicy will be deleted if omitted

[robertattenberger]

SUMMARY

I have an existing bucket in StorageGRID with a bucket policy. I would like to modify that bucket e.g. in size but I do not want to touch the bucket policy. So I do not provide the parameter policy. But after running the module na_sg_org_container to resize the bucket the bucket policy is removed.
The change is also mention in check-mode.

ISSUE TYPE

• Bug Report

COMPONENT NAME

na_sg_org_container

ANSIBLE VERSION

ansible-playbook [core 2.18.10]
  config file = /runner/project/ansible.cfg
  configured module search path = ['/runner/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.12/site-packages/ansible
  ansible collection location = /runner/requirements_collections:/runner/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible-playbook
  python version = 3.12.12 (main, Jan  8 2026, 00:00:00) [GCC 11.5.0 20240719 (Red Hat 11.5.0-14)] (/usr/bin/python3.12)
  jinja version = 3.1.6
  libyaml = True

COLLECTION VERSION

netapp.storagegrid                       21.16.0

CONFIGURATION

CONFIG_FILE() = mydir/ansible.cfg
DEFAULT_FILTER_PLUGIN_PATH(mydir/ansible.cfg) = ['mydir/filter_plugins']
DEFAULT_HOST_LIST(mydir/ansible.cfg) = ['mydir/inventories/inventory.yml']
DEFAULT_ROLES_PATH(mydir/ansible.cfg) = ['mydir/roles/']                                                                                                  DEFAULT_STDOUT_CALLBACK(mydir/ansible.cfg) = yaml
DISPLAY_SKIPPED_HOSTS(mydir/ansible.cfg) = True
EDITOR(env: EDITOR) = vim
HOST_KEY_CHECKING(mydir/ansible.cfg) = False

OS / ENVIRONMENT

AWX: OpenShift-Container
StorageGRID 11.9.0.7

STEPS TO REPRODUCE

1. Create a new bucket with an bucket policy
2. Check the existance of the bucket policy
3. Resize the bucket and omit in this step the policy
4. Check the existance of the bucket policy again

---
- hosts: s3c
  gather_facts: false
  vars:
    grid_fqdn: "XXXXXXXXXXXXXXXXXX"
    accountid: "XXXXXXXXXXXXXXXXXXX"
    bucket_name: test
  tasks:
    - name: Get authorization token
      uri:
        url: "https://{{ grid_fqdn }}/api/v3/authorize"
        method: POST
        body: {
          "accountId": "{{ accountid }}",
          "username": "XXXXXXXXXXXXXXXXXXXX",
          "password": "XXXXXXXXXXXXXXXXXXXX",
          "cookie": false,
          "csrfToken": false
        }
        body_format: json
        validate_certs: false
      register: tenant_auth_token
      no_log: true
      check_mode: false
      delegate_to: localhost
    - name: Create bucket with policy
      netapp.storagegrid.na_sg_org_container:
        api_url: "https://{{ grid_fqdn }}"
        auth_token: "{{ tenant_auth_token.json.data }}"
        name: "{{ bucket_name }}"
        policy: |
          {
            "Statement": [
              {
                "Principal": "*",
                "Effect": "Deny",
                "Action": "s3:PutObject",
                "Resource": "arn:aws:s3:::test/*"
              }
            ]
          }
        state: present
        validate_certs: false
      delegate_to: localhost
    - pause:
        seconds: 30
    - name: Change bucket size
      netapp.storagegrid.na_sg_org_container:
        api_url: "https://{{ grid_fqdn }}"
        auth_token: "{{ tenant_auth_token.json.data }}"
        name: "{{ bucket_name }}"
        capacity_limit: 10
        state: present
        validate_certs: false
      delegate_to: localhost
    - name: Delete authorization token
      uri:
        url: "https://{{ grid_fqdn }}/api/v3/authorize"
        method: DELETE
        headers:
          X-Csrf-Token: "{{ tenant_auth_token.json.data }}"
        status_code: 204
        validate_certs: false
      no_log: true
      check_mode: false
      delegate_to: localhost

EXPECTED RESULTS

I expect that the bucket is resized to 10 GB but the bucket policy is still unchanged present after the resize.

ACTUAL RESULTS

The bucket policy is deleted during the resize of the bucket.

[DEPRECATION WARNING]: ANSIBLE_COLLECTIONS_PATHS option. Reason: does not fit 
var naming standard, use the singular form ANSIBLE_COLLECTIONS_PATH instead 
Alternatives: none. This feature will be removed in version 2.19. Deprecation 
warnings can be disabled by setting deprecation_warnings=False in ansible.cfg.
ansible-playbook [core 2.18.10]
  config file = /runner/project/ansible.cfg
  configured module search path = ['/runner/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.12/site-packages/ansible
  ansible collection location = /runner/requirements_collections:/runner/.ansible/collections:/usr/share/ansible/collections
  executable location = /usr/local/bin/ansible-playbook
  python version = 3.12.12 (main, Jan  8 2026, 00:00:00) [GCC 11.5.0 20240719 (Red Hat 11.5.0-14)] (/usr/bin/python3.12)
  jinja version = 3.1.6
  libyaml = True
Using /runner/project/ansible.cfg as config file
Vault password: 
host_list declined parsing /runner/inventory/hosts as it did not pass its verify_file() method
Parsed /runner/inventory/hosts inventory source with script plugin
Skipping callback 'awx_display', as we already have a stdout callback.
Skipping callback 'default', as we already have a stdout callback.
Skipping callback 'minimal', as we already have a stdout callback.
Skipping callback 'oneline', as we already have a stdout callback.

PLAYBOOK: debug_collection_21_16_0.yml *****************************************
1 plays in playbooks/storagegrid_pb/debug_collection_21_16_0.yml

PLAY [s3c] *********************************************************************

TASK [Get authorization token] *************************************************
task path: /runner/project/playbooks/storagegrid_pb/debug_collection_21_16_0.yml:9
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: 1000940000
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /tmp/ansible-$USER `"&& mkdir "` echo /tmp/ansible-$USER/ansible-tmp-1769587349.502967-21-159936605834984 `" && echo ansible-tmp-1769587349.502967-21-159936605834984="` echo /tmp/ansible-$USER/ansible-tmp-1769587349.502967-21-159936605834984 `" ) && sleep 0'
Using module file /usr/local/lib/python3.12/site-packages/ansible/modules/uri.py
<localhost> PUT /runner/.ansible/tmp/ansible-local-17sirs7opx/tmpy58p17ku TO /tmp/ansible-/ansible-tmp-1769587349.502967-21-159936605834984/AnsiballZ_uri.py
<localhost> EXEC /bin/sh -c 'chmod u+rwx /tmp/ansible-/ansible-tmp-1769587349.502967-21-159936605834984/ /tmp/ansible-/ansible-tmp-1769587349.502967-21-159936605834984/AnsiballZ_uri.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python3.12 /tmp/ansible-/ansible-tmp-1769587349.502967-21-159936605834984/AnsiballZ_uri.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /tmp/ansible-/ansible-tmp-1769587349.502967-21-159936605834984/ > /dev/null 2>&1 && sleep 0'
ok: [s3c -> localhost] => {
    "censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result",
    "changed": false
}

TASK [Create bucket with policy] ***********************************************
task path: /runner/project/playbooks/storagegrid_pb/debug_collection_21_16_0.yml:26
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: XXXXXXXXXXXXXXXXXXX
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /tmp/ansible-$USER `"&& mkdir "` echo /tmp/ansible-$USER/ansible-tmp-1769587350.4629228-35-160062746118097 `" && echo ansible-tmp-1769587350.4629228-35-160062746118097="` echo /tmp/ansible-$USER/ansible-tmp-1769587350.4629228-35-160062746118097 `" ) && sleep 0'
Using module file /usr/share/ansible/collections/ansible_collections/netapp/storagegrid/plugins/modules/na_sg_org_container.py
<localhost> PUT /runner/.ansible/tmp/ansible-local-17sirs7opx/tmpyabv6c09 TO /tmp/ansible-/ansible-tmp-1769587350.4629228-35-160062746118097/AnsiballZ_na_sg_org_container.py
<localhost> EXEC /bin/sh -c 'chmod u+rwx /tmp/ansible-/ansible-tmp-1769587350.4629228-35-160062746118097/ /tmp/ansible-/ansible-tmp-1769587350.4629228-35-160062746118097/AnsiballZ_na_sg_org_container.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python3.12 /tmp/ansible-/ansible-tmp-1769587350.4629228-35-160062746118097/AnsiballZ_na_sg_org_container.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /tmp/ansible-/ansible-tmp-1769587350.4629228-35-160062746118097/ > /dev/null 2>&1 && sleep 0'
changed: [s3c -> localhost] => {
    "changed": true,
    "invocation": {
        "module_args": {
            "api_url": "https://XXXXXXXXXXXXXXXXXXXXXXXX",
            "auth_token": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "bucket_versioning_enabled": null,
            "capacity_limit": null,
            "compliance": null,
            "consistency": null,
            "name": "test",
            "policy": {
                "Statement": [
                    {
                        "Action": "s3:PutObject",
                        "Effect": "Deny",
                        "Principal": "*",
                        "Resource": "arn:aws:s3:::test/*"
                    }
                ]
            },
            "region": null,
            "s3_object_lock_enabled": null,
            "state": "present",
            "validate_certs": false
        }
    },
    "msg": "Org Container created",
    "resp": {
        "name": "test",
        "policy": {
            "Statement": [
                {
                    "Action": "s3:PutObject",
                    "Effect": "Deny",
                    "Principal": "*",
                    "Resource": "arn:aws:s3:::test/*"
                }
            ]
        },
        "region": null
    }
}

TASK [pause] *******************************************************************
task path: /runner/project/playbooks/storagegrid_pb/debug_collection_21_16_0.yml:45
Pausing for 30 seconds
(ctrl+C then 'C' = continue early, ctrl+C then 'A' = abort)
ok: [s3c] => {
    "changed": false,
    "delta": 30,
    "echo": true,
    "rc": 0,
    "start": "2026-01-28 09:02:41.868657",
    "stderr": "",
    "stdout": "Paused for 30.01 seconds",
    "stop": "2026-01-28 09:03:11.875130",
    "user_input": ""
}

TASK [Change bucket size] ******************************************************
task path: /runner/project/playbooks/storagegrid_pb/debug_collection_21_16_0.yml:47
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: XXXXXXXXXXXXX
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /tmp/ansible-$USER `"&& mkdir "` echo /tmp/ansible-$USER/ansible-tmp-1769587391.9177797-51-168675430512481 `" && echo ansible-tmp-1769587391.9177797-51-168675430512481="` echo /tmp/ansible-$USER/ansible-tmp-1769587391.9177797-51-168675430512481 `" ) && sleep 0'
Using module file /usr/share/ansible/collections/ansible_collections/netapp/storagegrid/plugins/modules/na_sg_org_container.py
<localhost> PUT /runner/.ansible/tmp/ansible-local-17sirs7opx/tmpwjqgj0tm TO /tmp/ansible-/ansible-tmp-1769587391.9177797-51-168675430512481/AnsiballZ_na_sg_org_container.py
<localhost> EXEC /bin/sh -c 'chmod u+rwx /tmp/ansible-/ansible-tmp-1769587391.9177797-51-168675430512481/ /tmp/ansible-/ansible-tmp-1769587391.9177797-51-168675430512481/AnsiballZ_na_sg_org_container.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python3.12 /tmp/ansible-/ansible-tmp-1769587391.9177797-51-168675430512481/AnsiballZ_na_sg_org_container.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /tmp/ansible-/ansible-tmp-1769587391.9177797-51-168675430512481/ > /dev/null 2>&1 && sleep 0'
changed: [s3c -> localhost] => {
    "changed": true,
    "invocation": {
        "module_args": {
            "api_url": "https://XXXXXXXXXXXXXXXXXXX",
            "auth_token": "VALUE_SPECIFIED_IN_NO_LOG_PARAMETER",
            "bucket_versioning_enabled": null,
            "capacity_limit": 10.0,
            "compliance": null,
            "consistency": null,
            "name": "test",
            "policy": null,
            "region": null,
            "s3_object_lock_enabled": null,
            "state": "present",
            "validate_certs": false
        }
    },
    "msg": "Org Container updated",
    "resp": {}
}

TASK [Delete authorization token] **********************************************
task path: /runner/project/playbooks/storagegrid_pb/debug_collection_21_16_0.yml:56
<localhost> ESTABLISH LOCAL CONNECTION FOR USER: XXXXXXXXXXXXXXXXXXXX
<localhost> EXEC /bin/sh -c '( umask 77 && mkdir -p "` echo /tmp/ansible-$USER `"&& mkdir "` echo /tmp/ansible-$USER/ansible-tmp-1769587412.8616185-65-95039801714455 `" && echo ansible-tmp-1769587412.8616185-65-95039801714455="` echo /tmp/ansible-$USER/ansible-tmp-1769587412.8616185-65-95039801714455 `" ) && sleep 0'
Using module file /usr/local/lib/python3.12/site-packages/ansible/modules/uri.py
<localhost> PUT /runner/.ansible/tmp/ansible-local-17sirs7opx/tmplxl73bnp TO /tmp/ansible-/ansible-tmp-1769587412.8616185-65-95039801714455/AnsiballZ_uri.py
<localhost> EXEC /bin/sh -c 'chmod u+rwx /tmp/ansible-/ansible-tmp-1769587412.8616185-65-95039801714455/ /tmp/ansible-/ansible-tmp-1769587412.8616185-65-95039801714455/AnsiballZ_uri.py && sleep 0'
<localhost> EXEC /bin/sh -c '/usr/bin/python3.12 /tmp/ansible-/ansible-tmp-1769587412.8616185-65-95039801714455/AnsiballZ_uri.py && sleep 0'
<localhost> EXEC /bin/sh -c 'rm -f -r /tmp/ansible-/ansible-tmp-1769587412.8616185-65-95039801714455/ > /dev/null 2>&1 && sleep 0'
ok: [s3c -> localhost] => {
    "censored": "the output has been hidden due to the fact that 'no_log: true' was specified for this result",
    "changed": false
}

PLAY RECAP *********************************************************************
s3c                        : ok=5    changed=2    unreachable=0    failed=0    skipped=0    rescued=0    ignored=0   

[vinay-ksingh]

We've story 8323 open for this bug.