# How to change the security groups of an existing ec2 instance

**URL:** <https://forum.ansible.com/t/how-to-change-the-security-groups-of-an-existing-ec2-instance/29942>\
**Category:** Ansible Project\
**Created:** [March 21, 2019, 8:32pm UTC](https://forum.ansible.com/t/how-to-change-the-security-groups-of-an-existing-ec2-instance/29942 "2019-03-21T20:32:03Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\
**Post date:** [March 21, 2019, 8:32pm UTC](https://forum.ansible.com/t/how-to-change-the-security-groups-of-an-existing-ec2-instance/29942/1 "2019-03-21T20:32:03Z")

</div>

Hi

I have a task to ensure that an instance is available and configured.  
But now I'd like make sure the instance has a few extra security  
groups, but I can't find the correct syntax to get this working.

My task look like this:

&nbsp;&nbsp;&nbsp;&nbsp;- name: Ensure jumphost is available  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ec2\_instance:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tags:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Name: Jumphost  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;filters:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;tag:Name: Jumphost  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;private-ip-address: 10.0.0.12  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;image\_id: ami-blah12121  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;vpc\_subnet\_id: 1234  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;network:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;source\_dest\_check: false  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;description: some\_description  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;private\_ip\_address: 10.0.0.12  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;security\_groups:  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- public\_ssh  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;- nat\_sg

The task runs OK without changes, but the instance does not get these  
security groups added.  
It just has the default security group.

I've tried a few things:

1. Use a list of group\_id's of each security group (as opposed to the names)  
2. Add those group names or group\_ids to a list called 'groups' as  
part of the 'network' parameter

But still no joy.  
Any ideas how to configure the security groups of an instance with the  
ec2\_module?

thx