# ec2\_group is not idempotent **URL:** \ **Category:** Ansible Project\ **Created:** [September 1, 2017, 6:44pm UTC](https://forum.ansible.com/t/ec2-group-is-not-idempotent/25396 "2017-09-01T18:44:04Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Stephen\_Nelson-Smith](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@Stephen\_Nelson-Smith](https://forum.ansible.com/u/Stephen_Nelson-Smith)\ **Post date:** [September 1, 2017, 6:44pm UTC](https://forum.ansible.com/t/ec2-group-is-not-idempotent/25396/1 "2017-09-01T18:44:04Z")
I have a task which creates a security group: - name: Create Production Security Group ec2\_group: name: “Production Security Group” description: “Allow access on ssh and 8080” vpc\_id: “{{ prd\_vpc\_id }}” rules: - proto: “tcp” from\_port: “22” to\_port: “22” cidr\_ip: “{{ lookup(‘env’, ‘ATTACK\_IP’) }}” - proto: “tcp” from\_port: “8080” to\_port: “8080” cidr\_ip: “{{ lookup(‘env’, ‘ATTACK\_IP’) }}” register: prd\_sg This works fine, the first time I run it. If I run it again, I get: TASK [vpc : Create Production Security Group] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* An exception occurred during task execution. To see the full traceback, use -vvv. The error was: botocore.exceptions.ClientError: An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule “peer: 138.68.160.0/20, TCP, from port: 22, to port: 22, ALLOW” already exists fatal: [localhost]: FAILED! =\> {“changed”: false, “error”: {“code”: “InvalidPermission.Duplicate”, “message”: “the specified rule "peer: 138.68.160.0/20, TCP, from port: 22, to port: 22, ALLOW" already exists”}, “failed”: true, “msg”: “Unable to authorize in for ip 138.68.174.135/20 security group ‘Production Security Group’ - An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule "peer: 138.68.160.0/20, TCP, from port: 22, to port: 22, ALLOW" already exists”, “response\_metadata”: {“http\_headers”: {“connection”: “close”, “date”: “Fri, 01 Sep 2017 18:32:20 GMT”, “server”: “AmazonEC2”, “transfer-encoding”: “chunked”}, “http\_status\_code”: 400, “request\_id”: “c79c01db-78d8-43aa-b779-b204f4685052”, “retry\_attempts”: 0}} to retry, use: --limit @/home/ansible/playbook.retry I looked into this, and it seemed to be the same issue describe in: [https://github.com/ansible/ansible/issues/24476](https://github.com/ansible/ansible/issues/24476) which is fixed in [https://github.com/ansible/ansible/pull/24528](https://github.com/ansible/ansible/pull/24528) With that in mind, I installed the devel branch of ansible: $ ansible --version ansible 2.4.0 config file = None configured module search path = [‘/home/ansible/.ansible/plugins/modules’, ‘/usr/share/ansible/plugins/modules’] ansible python module location = /usr/lib/python3.6/site-packages/ansible executable location = /usr/bin/ansible python version = 3.6.2 (default, Aug 11 2017, 11:59:59) [GCC 7.1.1 20170622 (Red Hat 7.1.1-3)] And tried again… But I am having the same issue. I know that ansible is the 2.4.0 version because I added an assert especially to stop if not \>=2.4.0, and the assert passes. Am I missing something here? Is there a simpler way to solve this? S. ---
**Author:** ![Josh\_Smift1](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@Josh\_Smift1](https://forum.ansible.com/u/Josh_Smift1)\ **Post date:** [September 3, 2017, 12:29pm UTC](https://forum.ansible.com/t/ec2-group-is-not-idempotent/25396/2 "2017-09-03T12:29:54Z")
Is this the same problem as [https://github.com/ansible/ansible-modules-core/issues/1068](https://github.com/ansible/ansible-modules-core/issues/1068) ? It looks from your output like it might be:   138.68.160.0/20, TCP, from port: 22, to port: 22, ALLOW" already exists   fatal: [localhost]: FAILED! =\> {"changed": false, "error": {"code":   "InvalidPermission.Duplicate", "message": "the specified rule \"peer:   138.68.160.0/20, TCP, from port: 22, to port: 22, ALLOW\" already exists"},   "failed": true, "msg": "Unable to authorize in for ip 138.68.174.135/20 When you specify 138.68.174.135/20, that gets translated to the arguably more correct 138.68.160.0/20 when AWS creates the rule, but then Ansible doesn't do that translation when it checks if the rule already exists -- it looks for 138.68.174.135/20, sees 138.68.160.0/20, doesn't realize they're equivalent, tries to add the rule, and gets the error. You might be able to work around this by just canonicalizing the ATTACK\_IP you're trying to allow, before you run Ansible, if that's easy to do.                                       -Josh (jbs@care.com) (apologies for the automatic corporate disclaimer that follows) This email is intended for the person(s) to whom it is addressed and may contain information that is PRIVILEGED or CONFIDENTIAL. Any unauthorized use, distribution, copying, or disclosure by any person other than the addressee(s) is strictly prohibited. If you have received this email in error, please notify the sender immediately by return email and delete the message and any attachments from your system. ---
**Author:** ![Stephen\_Nelson-Smith](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@Stephen\_Nelson-Smith](https://forum.ansible.com/u/Stephen_Nelson-Smith)\ **Post date:** [September 5, 2017, 5:29am UTC](https://forum.ansible.com/t/ec2-group-is-not-idempotent/25396/3 "2017-09-05T05:29:34Z")
Hi Josh,