# AWS VPC - subnets, routers, sg's and acl's **URL:** \ **Category:** Ansible Developer\ **Tags:** aws\ **Created:** [December 2, 2014, 10:31am UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935 "2014-12-02T10:31:17Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![polfilm](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@polfilm](https://forum.ansible.com/u/polfilm)\ **Post date:** [December 2, 2014, 10:31am UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935/1 "2014-12-02T10:31:17Z")
Hi All, Love Ansible. I have few questions as I’m creating a VPC with 800 subnets: 1. Does anyone know if there is a way to get list of routers without having to parse them with shell aws describe? Would I have to construct similar lists for ACL’s? 2. When using vpc mod Ansible is trying to re-create specified VPC as a new one. Attempt to update existing VPC tries to delete it first (state: present). How can I update existing VPC? Peter ---
**Author:** ![polfilm](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@polfilm](https://forum.ansible.com/u/polfilm)\ **Post date:** [December 2, 2014, 12:25pm UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935/2 "2014-12-02T12:25:22Z")
So far I found those to help. Split out route table and subnet functionality from VPC module. #322 [https://github.com/ansible/ansible-modules-core/pull/322/files](https://github.com/ansible/ansible-modules-core/pull/322/files) Add initial module for managing AWS VPC network ACLs #403 [https://github.com/ansible/ansible-modules-core/pull/403/files](https://github.com/ansible/ansible-modules-core/pull/403/files) Another question arose. Ansible will remove resources that are not in VPC script. But if I have 2 environment setups in the same VPC? I run the 1st env (one set of subnets). then run the second one (second set of subnets), Ansible thinks the subnets have changed and tries to remove subnets from the 1st env. Any way to overwrite this behavior? ---
**Author:** ![Robert\_Estelle](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@Robert\_Estelle](https://forum.ansible.com/u/Robert_Estelle)\ **Post date:** [December 2, 2014, 8:06pm UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935/3 "2014-12-02T20:06:28Z")
Interesting use-case. Perhaps it makes sense to add a `purge_subnets: False` option to that module? I’m the author of the first PR you linked to (#322). Would you mind leaving a comment on that pull request so I can keep track? Thanks, Robert ---
**Author:** ![polfilm](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@polfilm](https://forum.ansible.com/u/polfilm)\ **Post date:** [December 3, 2014, 2:06am UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935/4 "2014-12-03T02:06:08Z")
Hi Robert, I now spent about 24h with your module for isolated subnets. Tomorrow I continue with routers module. Works great with with\_items iterator and variables in separate envs file. I can just copy-paste my list of subnets and consume in the main script across AZ’s in the region. Its definitely way to go forward and I hope Ansible approves your request to merge. Important but not urgent: ability to update resource\_tags. Ansible detects changes locally but not pushing changes. Can you confirm this is working on your side? I will also attempt to reference created subnets by Name further in the main script. I’m trying to isolate all my variables into environment files so can’t have subnet-id nor cidr references in main script. For example when I’m associating routers, acls or instances. Can you confirm reference (to subnet) by name is possible? Many Thanks, Peter ---
**Author:** ![Robert\_Estelle](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@Robert\_Estelle](https://forum.ansible.com/u/Robert_Estelle)\ **Post date:** [December 3, 2014, 5:56pm UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935/5 "2014-12-03T17:56:03Z")
Unfortunately reference to subnet by name is not possible because subnets cannot currently be tagged in AWS. Thanks for pointing that out about `resource_tags`. That’s definitely a bug: my code searches for an exact tag match, which precludes providing tags to update. There are ways around this (selecting nearest match, allowing only superset updates of tags, etc.), but I think that at a fundamental level, conflating `resource_tags` for both search and update is a broken idea. I’ll make my PR’s behaviour match the original (search for subset match) as I intended, but I think that functionality needs to be looked at more closely. Perhaps remove searching by `resource_tags` entirely, which would more closely mimic other modules. (e.g., you search for files based on name, not its attributes). Robert ---
**Author:** ![Robert\_Estelle](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@Robert\_Estelle](https://forum.ansible.com/u/Robert_Estelle)\ **Post date:** [December 3, 2014, 6:14pm UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935/6 "2014-12-03T18:14:27Z")
The tag update regression’s now fixed in the pull request and should behave the same as the original module: It will attempt to match VPCs whose tags are a subset of the provided tags, and will add new tags as necessary. It is not possible to update or remove existing tags; the only way to do that would be to remove search functionality or have separate parameters for matching/updating tags. As for your subnet-id question, what I’ve been doing is something roughly like this, if that helps: - name: Ensure VPC exists local\_action: module: ec2\_vpc state: present cidr\_block: 10.0.0.0/16 resource\_tags: Name: ‘{{vpc\_env}} VPC’ VPCEnv: ‘{{vpc\_env}}’ region: ‘{{ec2\_region}}’ register: vpc\_res - name: Ensure Internet Gateway exists local\_action: module: ec2\_vpc\_igw state: present vpc\_id: ‘{{vpc\_res.vpc\_id}}’ region: ‘{{vpc\_res.vpc.region}}’ register: ‘igw’ - name: Jumpbox subnet local\_action: module: ec2\_vpc\_subnet vpc\_id: ‘{{vpc\_res.vpc\_id}}’ region: ‘{{vpc\_res.vpc.region}}’ resource\_tags: Name: Jumpbox Subnet cidr: 10.0.0.0/28 state: present register: jumpbox\_subnet - name: Public subnet route table local\_action: module: ec2\_vpc\_route\_table vpc\_id: ‘{{vpc\_res.vpc\_id}}’ region: ‘{{vpc\_res.vpc.region}}’ resource\_tags: Name: Public subnets: - ‘{{jumpbox\_subnet.subnet\_id}}’ routes: - dest: 0.0.0.0/0 gateway\_id: ‘{{igw.gateway\_id}}’ register: public\_route\_table - name: Ensure only desired subnets and route tables exist local\_action: module: ec2\_vpc vpc\_id: ‘{{vpc\_res.vpc\_id}}’ region: ‘{{vpc\_res.vpc.region}}’ subnet\_ids: - ‘{{jumpbox\_subnet.subnet\_id}}’ route\_table\_ids: - ‘{{public\_route\_table.route\_table\_id}}’ ---
**Author:** ![Robert\_Estelle](https://avatars.discourse-cdn.com/v4/letter/r/48db29/32.png) [@Robert\_Estelle](https://forum.ansible.com/u/Robert_Estelle)\ **Post date:** [December 3, 2014, 6:21pm UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935/7 "2014-12-03T18:21:02Z")
Argh. Sorry for the line noise, I was thinking of IGWs which cannot be tagged. Subnets can be. However they is no current support for reference-by-tag in these changes. Not sure if that’s better to add to this PR versus add as a later enhancement? I haven’t heard any input on this yet from the core devs. Robert ---
**Author:** ![polfilm](https://avatars.discourse-cdn.com/v4/letter/p/bc8723/32.png) [@polfilm](https://forum.ansible.com/u/polfilm)\ **Post date:** [December 9, 2014, 9:38am UTC](https://forum.ansible.com/t/aws-vpc-subnets-routers-sgs-and-acls/16935/8 "2014-12-09T09:38:45Z")
Hi Robert, Subnet and Routers module is great and proper separation speeds up my work a lot. I found a bug in Routers or omission rather. I need to be able to create Router with no entires (as AWS is always adding default LOCAL route for VPC) and that’s what missing in one of the cases. ` - name: Create/Update Route Table \>\> ElbRouteTable\_KeyApi local\_action: module: ec2\_vpc\_route\_table vpc\_id: “{{ vpc\_id }}” region: “{{ ec2\_region }}” resource\_tags: { “Name”:“{{ env }}-ElbRouteTable\_KeyApi” } subnets: - ‘{{ref\_subnet\_AccessDmzA.subnet\_id}}’ - ‘{{ref\_subnet\_AccessDmzB.subnet\_id}}’ - ‘{{ref\_subnet\_AccessDmzC.subnet\_id}}’ register: reg\_ElbRouteTable\_KeyApi ` Would be really cool if you could allow this perhaps next time you do an update. Working example below works great (example). Same thing requires about 100 lines in CloudFormation ` - name: Create/Update Route Table \>\> ElbRouteTable\_Ui\_CoreApi local\_action: module: ec2\_vpc\_route\_table vpc\_id: “{{ vpc\_id }}” region: “{{ ec2\_region }}” resource\_tags: { “Name”:“{{ env }}-ElbRouteTable\_Ui\_CoreApi” } subnets: - ‘{{ref\_subnet\_ElbUiA.subnet\_id}}’ - ‘{{ref\_subnet\_ElbUiB.subnet\_id}}’ - ‘{{ref\_subnet\_ElbUiC.subnet\_id}}’ - ‘{{ref\_subnet\_CoreApiA.subnet\_id}}’ - ‘{{ref\_subnet\_CoreApiB.subnet\_id}}’ - ‘{{ref\_subnet\_CoreApiC.subnet\_id}}’ routes: - dest: 10.0.0.0/8 gateway\_id: ‘{{vgw\_id}}’ - dest: 172.16.0.0/12 gateway\_id: ‘{{vgw\_id}}’ - dest: 192.168.0.0/16 gateway\_id: ‘{{vgw\_id}}’ register: reg\_ElbRouteTable\_Ui\_CoreApi ` Best, Peter