# How to correctly specify AnsibleModule sub specs

**URL:** <https://forum.ansible.com/t/how-to-correctly-specify-ansiblemodule-sub-specs/25101>\
**Category:** Ansible Developer\
**Created:** [July 26, 2017, 11:12pm UTC](https://forum.ansible.com/t/how-to-correctly-specify-ansiblemodule-sub-specs/25101 "2017-07-26T23:12:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Will\_Wagner](https://avatars.discourse-cdn.com/v4/letter/w/ac8455/32.png) [@Will\_Wagner](https://forum.ansible.com/u/Will_Wagner)\
**Post date:** [July 26, 2017, 11:12pm UTC](https://forum.ansible.com/t/how-to-correctly-specify-ansiblemodule-sub-specs/25101/1 "2017-07-26T23:12:44Z")

</div>

I’m trying to define my argument\_spec to AnsibleModule such that it will validate a nested list of dictionaries. I am supplying a series of firewall policy configurations, for which order matters, and I need access to the entire list of policies to ensure they are ordered correctly in the final configuration.

Here is an example YAML:

`

- name: update firewall policies  
fortios\_firewall\_policy:  
rules:
- srcintf:
- {name: “port4”}  
dstintf:
- {name: “port3”,}  
srcaddr:
- {name: “”,}  
dstaddr:
- {name: “all”}  
action: “accept”  
schedule: “always”  
service: “ALL\_ICMP”  
comments: “internet\_outbound\_nat”  
name: “ICMP\_out”  
nat: “enable”
- srcintf:
- {name: “port3”}  
dstintf:
- {name: “port4”}  
srcaddr:
- {name: “all”}  
dstaddr:
- {name: “all”}  
action: “accept”  
schedule: “always”  
service: “ALL\_ICMP”  
comments: “allow\_icmp\_in”  
name: “icmp\_in”  
`

And my attempt at defining argument\_spec:

`  
rule\_spec = {  
‘action’: dict(type=‘str’, options=[‘accept’, ‘deny’, ‘ipsec’, ‘ssl-vpn’]), ‘comments’: dict(type=‘str’),  
‘dstaddr’: dict(type=‘list’),  
‘dstaddr-negate’: dict(type=‘str’, options=[‘enable’, ‘disable’]),  
‘dstintf’: dict(type=‘list’),

‘name’: dict(type=‘str’), ‘nat’: dict(type=‘str’, options=[‘enable’, ‘disable’]),  
‘schedule’: dict(type=‘str’),  
‘service’: dict(type=‘list’),  
‘srcaddr’: dict(type=‘list’),  
‘srcaddr-negate’: dict(type=‘str’, options=[‘enable’, ‘disable’]),  
‘srcintf’: dict(type=‘list’),

}

firewall\_argument\_spec = arg\_spec = {  
‘rules’: dict(type=‘list’, elements=‘dict’, options=rule\_spec)  
}  
`

```auto

```

This doesn’t work. At the correct level of the spec, \_check\_argument\_types iterates over the entire list of dictionaries, and since none of the spec keys exist in that list, it doesn’t check any of them.

Is there a way to structure my argument spec so I can specify an entire list of resources in the YAML and have them validated by AnsibleModule. **init** , or am I going to have to write my own validation for this circumstance?

Thanks!  
Will

---

<div class="post-metadata">

**Author:** ![ganeshrn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ganeshrn/32/1021_2.png) [@ganeshrn](https://forum.ansible.com/u/ganeshrn)\
**Post date:** [July 28, 2017, 7:01am UTC](https://forum.ansible.com/t/how-to-correctly-specify-ansiblemodule-sub-specs/25101/2 "2017-07-28T07:01:36Z")

</div>

Please take a look at this PR  
[https://github.com/ansible/ansible/pull/27119/files](https://github.com/ansible/ansible/pull/27119/files)

It intends to do validation on sub spec.  
So in your case, ‘rule\_spec’ will be validated for different conditions mentioned for sub spec.

Regards,  
Ganesh