# Bug - RDS ansible module cannot change security\_group if rds instance within VPC **URL:** \ **Category:** Ansible Project\ **Tags:** aws\ **Created:** [December 22, 2013, 12:53pm UTC](https://forum.ansible.com/t/bug-rds-ansible-module-cannot-change-security-group-if-rds-instance-within-vpc/14204 "2013-12-22T12:53:02Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Mohan\_Krishnan](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@Mohan\_Krishnan](https://forum.ansible.com/u/Mohan_Krishnan)\ **Post date:** [December 22, 2013, 12:53pm UTC](https://forum.ansible.com/t/bug-rds-ansible-module-cannot-change-security-group-if-rds-instance-within-vpc/14204/1 "2013-12-22T12:53:02Z")
Hello, The code relies on the “subnet” argument being set to determine if the RDS instance is within a VPC. If it is, it switches the “security\_groups” argument (when provided) from security\_groups to vpc\_security\_groups in the underlying boto call. This works fine for the command=create case. However in the command=modify case, the “subnet” argument is considered invalid (As the AWS API does not allow for subnet modification of a provisioned instance). This results in the security\_groups parameter always being treated as a non-VPC security group, even when it is. The underlying boto library uses two separate arguments for when the security group is part of a vpc (vpc\_security\_groups) and for when it is not (security\_groups). I feel replicating this separation is probably the simplest and most explicit way of solving this issue. This pull request implements the separation - [https://github.com/ansible/ansible/pull/5389](https://github.com/ansible/ansible/pull/5389) The downside is it does introduce a backward incompatible change to the arguments if you use a VPC based rds. Instead of using security\_groups you will now need to use vpc\_security\_groups. What do you guys think ? Mohan ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [December 23, 2013, 4:58pm UTC](https://forum.ansible.com/t/bug-rds-ansible-module-cannot-change-security-group-if-rds-instance-within-vpc/14204/2 "2013-12-23T16:58:18Z")
Seems like the solution is to not send the “subnet” parameter when it’s going to be invalid? ---
**Author:** ![Mohan\_Krishnan](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@Mohan\_Krishnan](https://forum.ansible.com/u/Mohan_Krishnan)\ **Post date:** [December 26, 2013, 2:47am UTC](https://forum.ansible.com/t/bug-rds-ansible-module-cannot-change-security-group-if-rds-instance-within-vpc/14204/3 "2013-12-26T02:47:49Z")
Although that would work, it might lead to folks setting the subnet argument and expecting to actually have an effect, but if we are just dropping it off - you would have successful runs without the expected result. We could probably add a warning message, but this also changes how invalid arguments are dealt with in all other cases (It errors out). Having said that, I am keen on getting this fixed soon, so if we are ok with the above concerns, I’ll make the necessary changes to the pull request and resubmit. ---
**Author:** ![Mohan\_Krishnan](https://avatars.discourse-cdn.com/v4/letter/m/ea666f/32.png) [@Mohan\_Krishnan](https://forum.ansible.com/u/Mohan_Krishnan)\ **Post date:** [December 31, 2013, 1:27am UTC](https://forum.ansible.com/t/bug-rds-ansible-module-cannot-change-security-group-if-rds-instance-within-vpc/14204/4 "2013-12-31T01:27:41Z")
Don’t mean to bug (pun intended) - but I am pretty keen on getting a fix for this in. What do you think would be the best way forward ? If you feel the concern I raise is not really valid, I am fine creating a pull request for a diff that solely supresses any subnet value when doing a command=“modify” Thanks! Mohan ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [December 31, 2013, 1:43am UTC](https://forum.ansible.com/t/bug-rds-ansible-module-cannot-change-security-group-if-rds-instance-within-vpc/14204/5 "2013-12-31T01:43:49Z")
I’m not an active user of RDS, so it’s better if users who are using the RDS module weigh in with their thoughts on how this might or might not affect them. I know you are out there 🙂