# Cannot get with\_Items working with ec2group

**URL:** <https://forum.ansible.com/t/cannot-get-with-items-working-with-ec2group/15854>\
**Category:** Ansible Project\
**Created:** [August 4, 2014, 6:45pm UTC](https://forum.ansible.com/t/cannot-get-with-items-working-with-ec2group/15854 "2014-08-04T18:45:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Chuzzy](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@Chuzzy](https://forum.ansible.com/u/Chuzzy)\
**Post date:** [August 4, 2014, 6:45pm UTC](https://forum.ansible.com/t/cannot-get-with-items-working-with-ec2group/15854/1 "2014-08-04T18:45:11Z")

</div>

Ansible 1.7

I am trying to use either with\_items or with\_nested (if including a list of ports as well) to traverse a list of cidr addresses and create sec group rules from that …

Basically, this is failing repeatedly … and I guess its down to confusion around the correct scope to apply the with\_items keyword …

I have something like this …

`

- name: Create security group  
ec2\_group:  
name: “some-name”  
description: “some description”  
vpc\_id: “vpc-blahblah”  
region: “eu-north-4”  
rules:
- proto: tcp  
from\_port: 443  
to\_port: 443  
cidr\_ip: “{{ item }}”  
with\_items:
- addr1/32
- addr2/32
- etc/32  
`

In the above scope of usage, ansible is not able to see the variable … it’s exactly the same below when the with\_items is nested in-line with and the following also does not work …

`

- name: Create security group  
ec2\_group:  
name: “some-name”  
description: “some description”  
vpc\_id: “vpc-blahblah”  
region: “eu-north-4”  
rules:
- proto: tcp  
from\_port: 443  
to\_port: 443  
cidr\_ip: “{{ item }}”  
with\_items:
- addr1/32
- addr2/32
- etc/32  
`

The only variant that works is when it’s aligned with the ec2group line (see immediately below) … but it does not iterate and create several security groups … it iteratively, replaces a single entry with the latest value in the loop …  
`

- name: Create security group  
ec2\_group:  
name: “some-name”  
description: “some description”  
vpc\_id: “vpc-blahblah”  
region: “eu-north-4”  
rules:
- proto: tcp  
from\_port: 443  
to\_port: 443  
cidr\_ip: “{{ item }}”  
with\_items:
- addr1/32
- addr2/32
- etc/32  
`

I have looked at the docs for both ec2group and with\_items, and it’s not obvious how this is supposed to be used … I suspect I may be making some basic mistake/omission … Any suggestions? thanks in advance.

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 4, 2014, 8:22pm UTC](https://forum.ansible.com/t/cannot-get-with-items-working-with-ec2group/15854/2 "2014-08-04T20:22:04Z")

</div>

You have an indentation error here for starters:

- name: Create security group  
ec2\_group:  
name: “some-name”  
description: “some description”  
vpc\_id: “vpc-blahblah”  
region: “eu-north-4”  
rules:
- proto: tcp  
from\_port: 443  
to\_port: 443  
cidr\_ip: “{{ item }}”  
with\_items:
- addr1/32
- addr2/32
- etc/32

with\_items should be at the same level as “ec2\_group”.

---

<div class="post-metadata">

**Author:** ![Chuzzy](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@Chuzzy](https://forum.ansible.com/u/Chuzzy)\
**Post date:** [August 4, 2014, 10:42pm UTC](https://forum.ansible.com/t/cannot-get-with-items-working-with-ec2group/15854/3 "2014-08-04T22:42:31Z")

</div>

Thanks for the response … much appreciated.

And yes, I have seen that’s the only way it works , I do ponder what I have to do to have it create a security group per item element(s) … or is this an incorrect usage?

Thanks again …

---

<div class="post-metadata">

**Author:** ![Tomasz\_Kontusz](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@Tomasz\_Kontusz](https://forum.ansible.com/u/Tomasz_Kontusz)\
**Post date:** [August 5, 2014, 5:42am UTC](https://forum.ansible.com/t/cannot-get-with-items-working-with-ec2group/15854/4 "2014-08-05T05:42:16Z")

</div>

Try to give the groups different names.  
You can use:

with\_items:

- ip: addr1/32  
name: group1

And then access that data with {{ item.ip }} and {{ [item.name](http://item.name) }}.

Chuzzy [chuxuzoeto@gmail.com](mailto:chuxuzoeto@gmail.com) napisał:

---

<div class="post-metadata">

**Author:** ![Chuzzy](https://avatars.discourse-cdn.com/v4/letter/c/e95f7d/32.png) [@Chuzzy](https://forum.ansible.com/u/Chuzzy)\
**Post date:** [August 5, 2014, 9:32am UTC](https://forum.ansible.com/t/cannot-get-with-items-working-with-ec2group/15854/5 "2014-08-05T09:32:33Z")

</div>

Thanks, Tomasz …

But this will result in my creating a huge number of security groups … the intention is to create a list of rules for a security group …

the ideal solution would be to have the loop work on a ‘rule’ level … and not at the SG level, so that each iteration points to a new rule instead of a new SG …

Without such a change, using with\_items or any other loop for managing rules is not really useful …

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan1](https://avatars.discourse-cdn.com/v4/letter/m/5e9695/32.png) [@Michael\_DeHaan1](https://forum.ansible.com/u/Michael_DeHaan1)\
**Post date:** [August 5, 2014, 4:20pm UTC](https://forum.ansible.com/t/cannot-get-with-items-working-with-ec2group/15854/6 "2014-08-05T16:20:45Z")

</div>

You may wish to just define the list as a variable and do

attribute: “{{ listvar }}”

To plug in the list from your variable file