# ec2\_group removed egress rules for internal IPs

**URL:** <https://forum.ansible.com/t/ec2-group-removed-egress-rules-for-internal-ips/18702>\
**Category:** Ansible Project\
**Tags:** aws\
**Created:** [July 7, 2015, 3:18pm UTC](https://forum.ansible.com/t/ec2-group-removed-egress-rules-for-internal-ips/18702 "2015-07-07T15:18:35Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gregory\_Spranger](https://avatars.discourse-cdn.com/v4/letter/g/258eb7/32.png) [@Gregory\_Spranger](https://forum.ansible.com/u/Gregory_Spranger)\
**Post date:** [July 7, 2015, 3:18pm UTC](https://forum.ansible.com/t/ec2-group-removed-egress-rules-for-internal-ips/18702/1 "2015-07-07T15:18:35Z")

</div>

hi there,

so we had something odd happen to us and i figured i would reach out to the community for help … so the background:

1. ansible 1.9.1
2. we have a YML data set that contains “normal” info for SGs like ingress and egress rules
3. this data rarely changes
4. we execute the ec2\_group command on a regular basis since it is part of our “normal ansible runs” (4 times a day)

so this is where it starts to get “weird” … our SGs show “changed” on a regular basis, since we do NOT allow ALL to cidr\_ip 0.0.0.0/0 for egress rules … in the ansible code, i _THINK_ you will see that this is part of the default data: [https://github.com/ansible/ansible-modules-core/blob/devel/cloud/amazon/ec2\_group.py](https://github.com/ansible/ansible-modules-core/blob/devel/cloud/amazon/ec2_group.py) (lines ~305 ?? possibly 409ish ??)… so since we don’t allow this egress rule, ansible thinks the SG has “changed” when in fact it has not – and issues a “changed” command on every run … for example:

changed: [localhost] =\> (item={‘rules’: [{‘to\_port’: 5666, ‘from\_port’: 5666, ‘group\_name’: ‘1-admin’, ‘proto’: ‘tcp’}, …], ‘rules\_egress’: [{‘to\_port’: ‘all’, ‘from\_port’: ‘all’, ‘cidr\_ip’: ‘10.137.0.0/16’, ‘proto’: ‘all’}, …], ‘name’: ‘1-base-zero’, ‘description’: ‘Default global SG to be attached to all EC2 instances’})

this is kind of not cool since it shows as changed when it has not … but since no real change happened, “AWS Config” does not view it as a change … i think there is a feature idea out there for this: [https://github.com/ansible/ansible/issues/11249](https://github.com/ansible/ansible/issues/11249)

so then … here is what happened … we were minding our own business ansible ran at 10AM, it did it’s normal “SG business” – no issues … it ran again at 12PM, and BAM !! egress rules from an important SG (\<\< prolly our most important SG) were removed … what is even more odd is that the output of the run that was successful at 10AM was identical to the output of the run at 12PM … the same “changed” output i alluded to earlier …

but “AWS Config” revealed all kinds of nastiness … it showed that we did this:

[![](https://lh3.googleusercontent.com/-s6bethAkASA/VZvs7yCKvJI/AAAAAAAAAMI/LOcW7O0Pu90/s320/egress.png)](https://lh3.googleusercontent.com/-s6bethAkASA/VZvs7yCKvJI/AAAAAAAAAMI/LOcW7O0Pu90/s1600/egress.png)

i will say the one “odd” thing we do that stands out in my mind is we do this as part of our data set for egress rules:

- proto: icmp

from\_port: -1

to\_port: -1

cidr\_ip: “0.0.0.0/0”

other than a few comments we add in to the array, it all is pretty normal …

sooooo … any ideas about WTF happened ?? we are reaching out to AWS for support as well but no info to share there yet …

thanks for any help you can offer …

NOTE: this has only happened once like in 50+ executions … we re-ran the exact same ansible play to fix what was broken … so that even adds more weirdness to it

---

<div class="post-metadata">

**Author:** ![Gregory\_Spranger](https://avatars.discourse-cdn.com/v4/letter/g/258eb7/32.png) [@Gregory\_Spranger](https://forum.ansible.com/u/Gregory_Spranger)\
**Post date:** [July 7, 2015, 3:32pm UTC](https://forum.ansible.com/t/ec2-group-removed-egress-rules-for-internal-ips/18702/2 "2015-07-07T15:32:43Z")

</div>

> just some more info … for the SG that “failed” – we have 15 ingress rules and 20 egress rules … not sure if that matters …

thanks !!