# ec2\_group - passing a list to a rule fails on subsequent runs. **URL:** \ **Category:** Ansible Project\ **Created:** [September 4, 2014, 11:46pm UTC](https://forum.ansible.com/t/ec2-group-passing-a-list-to-a-rule-fails-on-subsequent-runs/16124 "2014-09-04T23:46:24Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Aaron\_Mills](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Aaron\_Mills](https://forum.ansible.com/u/Aaron_Mills)\ **Post date:** [September 4, 2014, 11:46pm UTC](https://forum.ansible.com/t/ec2-group-passing-a-list-to-a-rule-fails-on-subsequent-runs/16124/1 "2014-09-04T23:46:24Z")
Hi all, I’m using Ansible 1.7 and trying to populate an ec2\_group with a list of allowed IPs inbound. My playbook looks like so: ` ---
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [September 5, 2014, 3:30am UTC](https://forum.ansible.com/t/ec2-group-passing-a-list-to-a-rule-fails-on-subsequent-runs/16124/2 "2014-09-05T03:30:46Z")
Hi Aaron, is it valid to specify a list of IPs for the cidr\_ip value in the rules (or was this a cut/paste mistake)? ---
**Author:** ![Aaron\_Mills](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Aaron\_Mills](https://forum.ansible.com/u/Aaron_Mills)\ **Post date:** [September 5, 2014, 3:38pm UTC](https://forum.ansible.com/t/ec2-group-passing-a-list-to-a-rule-fails-on-subsequent-runs/16124/3 "2014-09-05T15:38:06Z")
It’s valid. When you run a playbook that passes a list of IPs, it’ll generate a rule for each IP in the list. However, when you run the playbook a second time, AWS throw’s an error that those SG entries already exist. I was cribbing from Michael DeHaan’s solution [here](https://groups.google.com/forum/#!searchin/ansible-project/ec2_group/ansible-project/5wvplmni_-A/bSqml4aNx0YJ). Looks like others have solved this with a [template](https://groups.google.com/forum/#!searchin/ansible-project/ec2_group$20template/ansible-project/a8y1v2-R8Zw/DJY1J4XaZpAJ). ---
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [September 5, 2014, 7:36pm UTC](https://forum.ansible.com/t/ec2-group-passing-a-list-to-a-rule-fails-on-subsequent-runs/16124/4 "2014-09-05T19:36:22Z")
I ask, because as far as I can tell from looking at the source code, we do not check that the cidr\_ip may be a list of IPs rather than a single item. That means for things like this (where ip is the cidr\_ip from the parsed rule data structure): ruleId = “%s-%s-%s-%s-%s-%s” % (‘out’, rule[‘proto’], rule[‘from\_port’], rule[‘to\_port’], group\_id, ip) ---
**Author:** ![Aaron\_Mills](https://avatars.discourse-cdn.com/v4/letter/a/cdc98d/32.png) [@Aaron\_Mills](https://forum.ansible.com/u/Aaron_Mills)\ **Post date:** [September 5, 2014, 7:50pm UTC](https://forum.ansible.com/t/ec2-group-passing-a-list-to-a-rule-fails-on-subsequent-runs/16124/5 "2014-09-05T19:50:05Z")
The purge functionality is actually quite nice for my use case, however. I’m dynamically gathering a list of hosts with a particular tag, then creating security group ingress rules to allow only those IPs (oh, the joys of VPC / public cloud inter-networking). So if a host is stopped/started, I need to get rid of the old IP and replace it with the new one when I run my playbook. I solved this problem via the template method linked to previously. I’m not sure if updated Ansible code to loop through a list and create individual rules would be appropriate or not (I’m guessing not), so this may be the best method anyway. Thanks for your help. -Aaron ---
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [September 5, 2014, 8:05pm UTC](https://forum.ansible.com/t/ec2-group-passing-a-list-to-a-rule-fails-on-subsequent-runs/16124/6 "2014-09-05T20:05:44Z")
No problem, feel free to open an issue on github for this too, as I’m pretty sure the module was not designed to work with a list of IPs natively like that (though maybe the AWS API will work the way we’re stuffing those in there). Thanks!