# Can't get the group\_id value from register in ec2\_group on creation

**URL:** <https://forum.ansible.com/t/cant-get-the-group-id-value-from-register-in-ec2-group-on-creation/18326>\
**Category:** Ansible Project\
**Created:** [May 28, 2015, 4:33am UTC](https://forum.ansible.com/t/cant-get-the-group-id-value-from-register-in-ec2-group-on-creation/18326 "2015-05-28T04:33:51Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![igorc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/igorc/32/5491_2.png) [@igorc](https://forum.ansible.com/u/igorc)\
**Post date:** [May 28, 2015, 4:33am UTC](https://forum.ansible.com/t/cant-get-the-group-id-value-from-register-in-ec2-group-on-creation/18326/1 "2015-05-28T04:33:51Z")

</div>

I have the following as part of a play:

- ec2\_group:  
name: group-name  
description: “firewall”  
vpc\_id: “{{ vpc\_id }}”  
region: “{{ region }}”  
purge\_rules: false  
purge\_rules\_egress: false  
rules:
- proto: tcp  
from\_port: 22  
to\_port: 22  
cidr\_ip: 0.0.0.0/0  
…  
#- proto: all

# group\_name: group-name

register: group\_sg

- debug: msg=“group\_id – {{ group\_sg.group\_id }}”

which fails with the error:

TASK: [debug msg=“group\_id – {{ group\_sg.group\_id }}”] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
fatal: [localhost] =\> One or more undefined variables: ‘dict object’ has no attribute ‘group\_id’

Isn’t this the right way of getting this attribute? Or this is not an option for a SG created inside VPC? The SG is being created fine though for the specified VPC and region.

Another thing is that I’m anable to use:

- proto: all  
group\_name: group-name

as in the official Ansible page example in the rules since I’m getting the following error:

File “/usr/local/lib/python2.7/dist-packages/boto/connection.py”, line 1226, in get\_status  
raise self.ResponseError(response.status, response.reason, body)  
boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request

\<?xml version="1.0" encoding="UTF-8"?\>

`InvalidGroup.NotFound`You have specified two resources that belong to different networks.dee577be-…

Any ideas?

$ ansible --version  
ansible 1.9.1

Thanks,  
Igor

---

<div class="post-metadata">

**Author:** ![igorc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/igorc/32/5491_2.png) [@igorc](https://forum.ansible.com/u/igorc)\
**Post date:** [May 28, 2015, 4:56am UTC](https://forum.ansible.com/t/cant-get-the-group-id-value-from-register-in-ec2-group-on-creation/18326/2 "2015-05-28T04:56:54Z")

</div>

Replying to my self about the second part of my question re:

- proto: all  
group\_name: group-name

It came up that the group name has to unique in the region otherwise the call will fail. The AWS console on other hand allows creation of security groups with the same name in same region in case they belong to different VPC’s.

---

<div class="post-metadata">

**Author:** ![benno\_joy](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@benno\_joy](https://forum.ansible.com/u/benno_joy)\
**Post date:** [May 28, 2015, 5:35am UTC](https://forum.ansible.com/t/cant-get-the-group-id-value-from-register-in-ec2-group-on-creation/18326/3 "2015-05-28T05:35:00Z")

</div>

Hi Igor,

- debug: msg=“group\_id – {{ group\_sg.group\_id }}” should work, can you please try

- debug: var=group\_sg and see what are the keys that you are getting.

Also for question 2. there were a few fixes added to filter groups in the same vpc, can you please try the latest devel branch,

- Benno

---

<div class="post-metadata">

**Author:** ![igorc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/igorc/32/5491_2.png) [@igorc](https://forum.ansible.com/u/igorc)\
**Post date:** [May 28, 2015, 5:59am UTC](https://forum.ansible.com/t/cant-get-the-group-id-value-from-register-in-ec2-group-on-creation/18326/4 "2015-05-28T05:59:13Z")

</div>

Thanks for replying Benno. I did exactly that with debugging and can see where the problem is.

First let me say I haven’t been completely honest about the way I’ve been invoking the ec2\_module. I have simplified the call for readability but from the debug output I can see I shouldn’t have since it covers the problem. In case I do:

- ec2\_group:  
name: group-{{ ec2\_env }}  
description: “firewall”  
vpc\_id: “vpc-xxxxxxxx”  
region: “eu-west-1”  
…  
register: group\_sg

then all is fine. The debug message is simple:

ok: [localhost] =\> {  
“msg”: “group\_id – {‘invocation’: {‘module\_name’: u’ec2\_group’, ‘module\_args’: ‘’}, ‘changed’: True, ‘group\_id’: ‘sg-xxxxxxxx’}”  
}

However my case I’m invoking ec2\_group via with\_dict loop as given below:

- hosts: localhost  
connection: local  
gather\_facts: false  
vars\_files:
- group\_vars/app\_servers
- group\_vars/vpcs  
tasks:
- name: “Some group”  
ec2\_group:  
name: group-{{ ec2\_env }}  
description: “group firewall”  
vpc\_id: “{{ item.key }}”  
region: “{{ item.value.region }}”  
purge\_rules: false  
purge\_rules\_egress: false  
rules:
- proto: tcp  
from\_port: 22  
to\_port: 22  
cidr\_ip: 0.0.0.0/0
- proto: tcp  
from\_port: xxxxx  
to\_port: xxxxx  
cidr\_ip: “{{ item.value.cidr }}”  
.  
.  
.
- proto: all  
group\_name: group-{{ ec2\_env }}  
rules\_egress:
- proto: all  
type: all  
cidr\_ip: 0.0.0.0/0  
with\_dict: vpc  
when: item.value.name == ec2\_env  
register: group\_sg

where the dictionary is a VPC mappings as follows:

vpc:  
vpc-xxxxxxxx:  
name: nameX  
region: ap-southeast-2  
cidr: “xxxxxxxx/16”  
subnets:

- { zone: “ap-southeast-2a”, subnet: “subnet-xxxxxxxx” }
- { zone: “ap-southeast-2b”, subnet: “subnet-xxxxxxxx” }  
subnets\_app:
- { zone: “ap-southeast-2a”, subnet: “subnet-xxxxxxxx” }
- { zone: “ap-southeast-2b”, subnet: “subnet-xxxxxxxx” }  
subnets\_db:
- { zone: “ap-southeast-2a”, subnet: “subnet-xxxxxxxx” }
- { zone: “ap-southeast-2b”, subnet: “subnet-xxxxxxxx” }  
.  
.  
.  
vpc-yyyyyyyy:  
name: nameY  
region: eu-west-1  
cidr: “xxxxxxxx/16”  
subnets:
- { zone: “eu-west-1a”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1b”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1c”, subnet: “subnet-xxxxxxxx” }  
subnets\_app:
- { zone: “eu-west-1a”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1b”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1c”, subnet: “subnet-xxxxxxxx” }  
subnets\_db:
- { zone: “eu-west-1a”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1b”, subnet: “subnet-xxxxxxxx” }
- { zone: “eu-west-1c”, subnet: “subnet-xxxxxxxx” }

in which case I get the following complex structure as outout:

TASK: [debug var=group\_sg] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
ok: [localhost] =\> {  
“var”: {  
“group\_sg”: {  
“changed”: true,  
“msg”: “All items completed”,  
“results”: [  
{  
“changed”: false,  
“skipped”: true  
},  
{  
“changed”: false,  
“skipped”: true  
},  
{  
“changed”: false,  
“skipped”: true  
},  
{  
“changed”: true,  
“group\_id”: “sg-xxxxxxxx”,  
“invocation”: {  
“module\_args”: “”,  
“module\_name”: “ec2\_group”  
},  
“item”: {  
“key”: “vpc-xxxxxxxx”,  
“value”: {  
“cidr”: “xxxxxxxx/16”,  
“name”: “xxxxxxxx”,  
“region”: “eu-west-1”,  
“subnets”: [  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1a”  
},  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1b”  
},  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1c”  
}  
],  
“subnets\_app”: [  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1a”  
},  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1b”  
},  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1c”  
}  
],  
“subnets\_db”: [  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1a”  
},  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1b”  
},  
{  
“subnet”: “subnet-xxxxxxxx”,  
“zone”: “eu-west-1c”  
}  
]  
}  
}  
},  
{  
“changed”: false,  
“skipped”: true  
}  
]  
}  
}  
}

Yeah, I’m trying to make the play generic and apply to any VPC/subnets in any region.

Thanks again for your help.

Igor

---

<div class="post-metadata">

**Author:** ![igorc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/igorc/32/5491_2.png) [@igorc](https://forum.ansible.com/u/igorc)\
**Post date:** [May 28, 2015, 11:56pm UTC](https://forum.ansible.com/t/cant-get-the-group-id-value-from-register-in-ec2-group-on-creation/18326/5 "2015-05-28T23:56:09Z")

</div>

Any idea how to dig out the sg id out of this? Maybe changing the module to not be so verbose and print only the needed info would be easier?