# ec2\_group, are circular dependencies possible

**URL:** <https://forum.ansible.com/t/ec2-group-are-circular-dependencies-possible/18207>\
**Category:** Ansible Project\
**Created:** [May 12, 2015, 7:53am UTC](https://forum.ansible.com/t/ec2-group-are-circular-dependencies-possible/18207 "2015-05-12T07:53:43Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Barry\_Kaplan](https://avatars.discourse-cdn.com/v4/letter/b/48db29/32.png) [@Barry\_Kaplan](https://forum.ansible.com/u/Barry_Kaplan)\
**Post date:** [May 12, 2015, 7:53am UTC](https://forum.ansible.com/t/ec2-group-are-circular-dependencies-possible/18207/1 "2015-05-12T07:53:43Z")

</div>

I am trying to recreate some SGs (that were created manually) that have circular dependencies.

eg,

sg1: out sg2  
sg2: in sg1

I can’t see how this is possible with ansible.

---

<div class="post-metadata">

**Author:** ![Barry\_Kaplan](https://avatars.discourse-cdn.com/v4/letter/b/48db29/32.png) [@Barry\_Kaplan](https://forum.ansible.com/u/Barry_Kaplan)\
**Post date:** [May 12, 2015, 8:59am UTC](https://forum.ansible.com/t/ec2-group-are-circular-dependencies-possible/18207/2 "2015-05-12T08:59:03Z")

</div>

Answer: Yes, it is possible. First you must “declare” the group using purge\_rules\*=false and then add the actual rules.

For example:

- name: Declare api-service ELB security group  
ec2\_group:  
name: “{{env\_prefix}}api-service-elb”  
description: API Service ELB security group  
vpc\_id: “{{ec2\_vpc\_id}}”  
purge\_rules: false  
purge\_rules\_egress: false

- name: Declare api-service security group  
ec2\_group:  
name: “{{env\_prefix}}api-service”  
description: API Service security group  
vpc\_id: “{{ec2\_vpc\_id}}”  
purge\_rules: false  
purge\_rules\_egress: false

- name: Define api-service ELB security group  
ec2\_group:  
name: “{{env\_prefix}}api-service-elb”  
description: API Service ELB security group  
vpc\_id: “{{ec2\_vpc\_id}}”  
rules:

- proto: tcp  
from\_port: 443  
to\_port: 443  
cidr\_ip: 0.0.0.0/0  
rules\_egress:

- proto: tcp  
from\_port: 443  
to\_port: 443  
group\_name: “{{env\_prefix}}api-service”

- name: Define api-service security group rules  
ec2\_group:  
name: “{{env\_prefix}}api-service”  
description: API Service security group  
vpc\_id: “{{ec2\_vpc\_id}}”  
rules:

- proto: tcp  
from\_port: 443  
to\_port: 443  
group\_name: “{{env\_prefix}}api-service-elb”

But while this works, the declare are always marked as changed so I needed to add ‘changed\_when: false’ to those. Still I get changed every time for “Define api-service ELB security group” – not sure why yet.

---

<div class="post-metadata">

**Author:** ![Barry\_Kaplan](https://avatars.discourse-cdn.com/v4/letter/b/48db29/32.png) [@Barry\_Kaplan](https://forum.ansible.com/u/Barry_Kaplan)\
**Post date:** [May 12, 2015, 10:04am UTC](https://forum.ansible.com/t/ec2-group-are-circular-dependencies-possible/18207/3 "2015-05-12T10:04:52Z")

</div>

Much better answer:

Digging thru the code I notice an option ‘group\_desc’. It is used when creating a rule to a not yet created security group, where ansible will auto-create the security group. Then you can follow up and fill in the details.

So the above is greatly simplified to:

- name: Declare api-service ELB security group  
ec2\_group:  
name: “{{env\_prefix}}api-service-elb”  
description: API Service ELB security group  
vpc\_id: “{{ec2\_vpc\_id}}”  
rules:

- proto: tcp  
from\_port: 443  
to\_port: 443  
cidr\_ip: 0.0.0.0/0  
rules\_egress:

- proto: tcp  
from\_port: 443  
to\_port: 443  
group\_name: “{{env\_prefix}}api-service”  
group\_desc: “{{api\_sg\_desc}}”

- name: Declare api-service security group  
ec2\_group:  
name: “{{env\_prefix}}api-service”  
description: “{{api\_sg\_desc}}”  
vpc\_id: “{{ec2\_vpc\_id}}”  
rules:

- proto: tcp

from\_port: 443  
to\_port: 443  
group\_name: “{{env\_prefix}}api-service-elb”