# ec2\_group: rules can't reference containing group **URL:** \ **Category:** Ansible Developer\ **Created:** [December 16, 2013, 9:44pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166 "2013-12-16T21:44:19Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![David\_Hummel](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Hummel](https://forum.ansible.com/u/David_Hummel)\ **Post date:** [December 16, 2013, 9:44pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/1 "2013-12-16T21:44:19Z")
In order to reference the containing group in rules that specify the group\_id parameter, one must do the following: - ec2\_group: … rules: - proto: tcp from\_port: 22 to\_port: 22 cidr\_ip: 0.0.0.0/0 register: sg - ec2\_group: … rules: - proto: all group\_id: “{{ sg.group\_id }}” which is not idempotent. I propose that the rule group\_id parameter accept the special keyword “this” as a means of referencing the group that contains it. Thoughts? (I already created issue #5309 and pull request #5310 for this) ---
**Author:** ![tannerjc](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/tannerjc/32/985_2.png) [@tannerjc](https://forum.ansible.com/u/tannerjc)\ **Post date:** [December 17, 2013, 7:32pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/2 "2013-12-17T19:32:28Z")
Would it not be possible have a different parameter such as group\_append=True to achieve this same functionality? ---
**Author:** ![David\_Hummel](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Hummel](https://forum.ansible.com/u/David_Hummel)\ **Post date:** [December 17, 2013, 9:22pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/3 "2013-12-17T21:22:37Z")
Indeed it would. I’d thought of this as well but wasn’t sure which is better, a new parameter or overloading the group\_id parameter, and I was struggling with what a new parameter would be named. I’m not sure that group\_append describes the behavior that well, but it’s probably OK for lack of a better choice. I’m fine with whichever approach people would find most intuitive. ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [December 17, 2013, 9:46pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/4 "2013-12-17T21:46:59Z")
“which is not idempotent” That word again 🙂 Please translate your meaning here – does it mean it does not provide repeatable behavior if you re-run it, if so, how? ---
**Author:** ![David\_Hummel](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Hummel](https://forum.ansible.com/u/David_Hummel)\ **Post date:** [December 17, 2013, 9:49pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/5 "2013-12-17T21:49:47Z")
The AWS API action AuthorizeSecurityGroupIngress allows specifying a source group by id or by name, so perhaps another possibility is to add a new rule parameter group\_name, then you could do the following: - ec2\_group: name: mygroup rules: - proto: all group\_name: mygroup Or perhaps the new parameter isn’t necessary at all and the group\_id parameter could accept either an id or a name, but again this would be overloading the parameter. The AWS console actually allows specifying a source group by id or name. ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [December 17, 2013, 10:03pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/6 "2013-12-17T22:03:37Z")
Group\_name sounds like a good answer here. Generally speaking I’d like to see a lot of lookups for non-ID things where it makes sense, especially as IDs tend to hop around if removed and recreated, etc. ---
**Author:** ![David\_Hummel](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Hummel](https://forum.ansible.com/u/David_Hummel)\ **Post date:** [December 17, 2013, 10:05pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/7 "2013-12-17T22:05:39Z")
You currently need to execute the task twice. Once to capture the group in a register variable, then a second time to add the rule that references the group itself as a source by obtaining its id from the register variable. When you re-run the playbook, the first task destroys the rule setup in the previous execution of the second task (since all rules except those present in the task are removed), then the second task recreates it again. So the end result is the same and is repeatable, but state is unnecessarily being changed in the process. Hope that’s more clear 🙂 ---
**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\ **Post date:** [December 17, 2013, 10:08pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/8 "2013-12-17T22:08:34Z")
Yep, thanks! ---
**Author:** ![David\_Hummel](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Hummel](https://forum.ansible.com/u/David_Hummel)\ **Post date:** [December 18, 2013, 8:17pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/9 "2013-12-18T20:17:40Z")
OK, I’ll leave a bit more time for additional comments and in the mean time I’ll work on implementing new rule parameter group\_name. ---
**Author:** ![David\_Hummel](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Hummel](https://forum.ansible.com/u/David_Hummel)\ **Post date:** [December 20, 2013, 8:40pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/10 "2013-12-20T20:40:10Z")
[https://github.com/ansible/ansible/pull/5377](https://github.com/ansible/ansible/pull/5377) ---
**Author:** ![David\_Hummel](https://avatars.discourse-cdn.com/v4/letter/d/50afbb/32.png) [@David\_Hummel](https://forum.ansible.com/u/David_Hummel)\ **Post date:** [December 20, 2013, 9:13pm UTC](https://forum.ansible.com/t/ec2-group-rules-cant-reference-containing-group/14166/11 "2013-12-20T21:13:25Z")
[https://github.com/ansible/ansible/pull/5380](https://github.com/ansible/ansible/pull/5380)