Thanks for replying Benno. I did exactly that with debugging and can see where the problem is.
First let me say I haven’t been completely honest about the way I’ve been invoking the ec2_module. I have simplified the call for readability but from the debug output I can see I shouldn’t have since it covers the problem. In case I do:
- ec2_group:
name: group-{{ ec2_env }}
description: “firewall”
vpc_id: “vpc-xxxxxxxx”
region: “eu-west-1”
…
register: group_sg
then all is fine. The debug message is simple:
ok: [localhost] => {
“msg”: “group_id – {‘invocation’: {‘module_name’: u’ec2_group’, ‘module_args’: ‘’}, ‘changed’: True, ‘group_id’: ‘sg-xxxxxxxx’}”
}
However my case I’m invoking ec2_group via with_dict loop as given below:
- hosts: localhost
connection: local
gather_facts: false
vars_files:
- group_vars/app_servers
- group_vars/vpcs
tasks:
- name: “Some group”
ec2_group:
name: group-{{ ec2_env }}
description: “group firewall”
vpc_id: “{{ item.key }}”
region: “{{ item.value.region }}”
purge_rules: false
purge_rules_egress: false
rules:
- proto: tcp
from_port: 22
to_port: 22
cidr_ip: 0.0.0.0/0
- proto: tcp
from_port: xxxxx
to_port: xxxxx
cidr_ip: “{{ item.value.cidr }}”
.
.
.
- proto: all
group_name: group-{{ ec2_env }}
rules_egress:
- proto: all
type: all
cidr_ip: 0.0.0.0/0
with_dict: vpc
when: item.value.name == ec2_env
register: group_sg
where the dictionary is a VPC mappings as follows:
vpc:
vpc-xxxxxxxx:
name: nameX
region: ap-southeast-2
cidr: “xxxxxxxx/16”
subnets:
- { zone: “ap-southeast-2a”, subnet: “subnet-xxxxxxxx” }
- { zone: “ap-southeast-2b”, subnet: “subnet-xxxxxxxx” }
subnets_app:
- { zone: “ap-southeast-2a”, subnet: “subnet-xxxxxxxx” }
- { zone: “ap-southeast-2b”, subnet: “subnet-xxxxxxxx” }
subnets_db:
- { zone: “ap-southeast-2a”, subnet: “subnet-xxxxxxxx” }
- { zone: “ap-southeast-2b”, subnet: “subnet-xxxxxxxx” }
.
.
.
vpc-yyyyyyyy:
name: nameY
region: eu-west-1
cidr: “xxxxxxxx/16”
subnets:
- { zone: “eu-west-1a”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1b”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1c”, subnet: “subnet-xxxxxxxx” }
subnets_app:
- { zone: “eu-west-1a”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1b”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1c”, subnet: “subnet-xxxxxxxx” }
subnets_db:
- { zone: “eu-west-1a”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1b”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1c”, subnet: “subnet-xxxxxxxx” }
in which case I get the following complex structure as outout:
TASK: [debug var=group_sg] ***************************************************
ok: [localhost] => {
“var”: {
“group_sg”: {
“changed”: true,
“msg”: “All items completed”,
“results”: [
{
“changed”: false,
“skipped”: true
},
{
“changed”: false,
“skipped”: true
},
{
“changed”: false,
“skipped”: true
},
{
“changed”: true,
“group_id”: “sg-xxxxxxxx”,
“invocation”: {
“module_args”: “”,
“module_name”: “ec2_group”
},
“item”: {
“key”: “vpc-xxxxxxxx”,
“value”: {
“cidr”: “xxxxxxxx/16”,
“name”: “xxxxxxxx”,
“region”: “eu-west-1”,
“subnets”: [
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1a”
},
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1b”
},
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1c”
}
],
“subnets_app”: [
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1a”
},
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1b”
},
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1c”
}
],
“subnets_db”: [
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1a”
},
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1b”
},
{
“subnet”: “subnet-xxxxxxxx”,
“zone”: “eu-west-1c”
}
]
}
}
},
{
“changed”: false,
“skipped”: true
}
]
}
}
}
Yeah, I’m trying to make the play generic and apply to any VPC/subnets in any region.
Thanks again for your help.
Igor