# Explain ec2\_group module rules section? **URL:** \ **Category:** Ansible Project\ **Created:** [August 10, 2018, 2:57pm UTC](https://forum.ansible.com/t/explain-ec2-group-module-rules-section/28312 "2018-08-10T14:57:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ttwalto](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@ttwalto](https://forum.ansible.com/u/ttwalto)\ **Post date:** [August 10, 2018, 2:57pm UTC](https://forum.ansible.com/t/explain-ec2-group-module-rules-section/28312/1 "2018-08-10T14:57:21Z")
I don’t understand the rules section of the ec2\_group module. I wish the documentation explained it, but it doesn’t. I says “see example”. The description right now, Ansible 2.6, is: `List of firewall inbound rules to enforce in this group (see example). If none are supplied, no inbound rules will be enabled. Rules list may include its own name in`group\_name`. This allows idempotent loopback additions (e.g. allow group to access itself). Rule sources list support was added in version 2.4. This allows to define multiple sources per source type as well as multiple source types per rule. Prior to 2.4 an individual source is allowed. In version 2.5 support for rule descriptions was added. ` And there are several examples shown. An example example is: ` - name: example ec2 group ec2\_group: name: example description: an example EC2 group vpc\_id: 12345 region: eu-west-1 aws\_secret\_key: SECRET aws\_access\_key: ACCESS rules: - proto: tcp from\_port: 80 to\_port: 80 cidr\_ip: 0.0.0.0/0 - proto: tcp from\_port: 22 to\_port: 22 cidr\_ip: 10.0.0.0/8 - proto: tcp from\_port: 443 to\_port: 443 # this should only be needed for EC2 Classic security group rules # because in a VPC an ELB will use a user-account security group group\_id: amazon-elb/sg-87654321/amazon-elb-sg - proto: tcp from\_port: 3306 to\_port: 3306 group\_id: 123412341234/sg-87654321/exact-name-of-sg - proto: udp from\_port: 10050 to\_port: 10050 cidr\_ip: 10.0.0.0/8 - proto: udp from\_port: 10051 to\_port: 10051 group\_id: sg-12345678 - proto: icmp from\_port: 8 # icmp type, -1 = any type to\_port: -1 # icmp subtype, -1 = any subtype cidr\_ip: 10.0.0.0/8 - proto: all # the containing group name may be specified here group\_name: example - proto: all # in the ‘proto’ attribute, if you specify -1, all, or a number other than tcp, udp, icmp, or 58 (ICMPv6), # traffic on all ports is allowed, regardless of any ports you specify from\_port: 10050 # this value is ignored to\_port: 10050 # this value is ignored cidr\_ip: 10.0.0.0/8 ` So… I know what proto is for. I know what from\_port, to\_port, and cidr\_ip are for. Also rule\_desc. But what are group\_id, group\_name, and group\_desc for? (To be clear, I’m asking what they are inside the rules: block. If they were under ec2\_group: I would know what they were for.) ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [August 10, 2018, 11:03pm UTC](https://forum.ansible.com/t/explain-ec2-group-module-rules-section/28312/2 "2018-08-10T23:03:26Z")
In a rule, you can specify a group by id or name, just as you can specify a cidr\_ip. Anything with the specified group attached to it will be allowed. Dunno about group\_desc, haven’t used it. Regards, K. ---
**Author:** ![ttwalto](https://avatars.discourse-cdn.com/v4/letter/t/ecb155/32.png) [@ttwalto](https://forum.ansible.com/u/ttwalto)\ **Post date:** [August 14, 2018, 3:22pm UTC](https://forum.ansible.com/t/explain-ec2-group-module-rules-section/28312/3 "2018-08-14T15:22:41Z")
Awesome. Thank you, Karl. ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [August 14, 2018, 9:47pm UTC](https://forum.ansible.com/t/explain-ec2-group-module-rules-section/28312/4 "2018-08-14T21:47:50Z")
Should’ve also said that using a group id or name this way just treats the group as a source or destination. For AWS-based interfaces, it’s a much better way to refer to an interface, because it doesn’t rely on (possibly changing) interface IP addresses. But if you want the actual rules in a security group to have any effect, that security group must be attached to an interface, not just referenced in another group. Regards, K.