# Modifying CIDR of an existing EC2 Security Groups using Ansible **URL:** \ **Category:** Ansible Project\ **Created:** [April 26, 2021, 5:33am UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052 "2021-04-26T05:33:55Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Naveen\_NK](https://avatars.discourse-cdn.com/v4/letter/n/45deac/32.png) [@Naveen\_NK](https://forum.ansible.com/u/Naveen_NK)\ **Post date:** [April 26, 2021, 5:33am UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052/1 "2021-04-26T05:33:55Z")
Can we modify existing EC2 Security group using Ansible by accepting new input parameter through jenkins job? Scenario - I have to update users public IP to Ec2 security groups everyday Whenever their Public ip changes. This become repetitive tasks as Public IP is dynamic and changes everyday. I tried to automate this by creating ansible playbook with jenkins job by passing input parameter **“{{ newpublicip }}”** for new public ip and let user provide his IP and run the job and it updates the security groups. Below is the code - hosts: localhost connection: local gather\_facts: false vars: - newpublicip: “{{ newpublicip }}” - name: “{{ name }}” tasks: - name: boto3 pip: name: “boto3” state: present - name: modiying security group ec2\_group: name: “{{ name }}” description: An example ec2 group vpc\_id: xxxx region: “{{ region }}” aws\_access\_key: “{{ access\_key }}” aws\_secret\_key: “{{ secret\_key }}” rules: - proto: tcp from\_port: 80 to\_port: 80 cidr\_ip: “0.0.0.0/0” - proto: tcp from\_port: 22 to\_port: 22 cidr\_ip: “{{ newpublicip }}” rule\_desc: user1 - proto: tcp from\_port: 22 to\_port: 22 cidr\_ip: “{{ newpublicip }}” rule\_desc: user2 But the problem here is it updates whole existing security group with passed value, Here we will have different users assigned same port numbers with their public IP as source to access, so based on matching the rule\_desc ex., user1 it should update the CIDR ip with input value provided **“{{ newpublicip }}”** Or please suggest some options to improvise this? Thank you ! ---
**Author:** ![Komal\_Suthar](https://avatars.discourse-cdn.com/v4/letter/k/919ad9/32.png) [@Komal\_Suthar](https://forum.ansible.com/u/Komal_Suthar)\ **Post date:** [April 26, 2021, 9:59am UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052/2 "2021-04-26T09:59:10Z")
In this ec2\_group module i don’t think that we can solve this use case ---
**Author:** ![Naveen\_NK](https://avatars.discourse-cdn.com/v4/letter/n/45deac/32.png) [@Naveen\_NK](https://forum.ansible.com/u/Naveen_NK)\ **Post date:** [April 27, 2021, 3:41am UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052/3 "2021-04-27T03:41:16Z")
Is there any other options to achieve this ? I have been stuck here since week ☹ ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [April 27, 2021, 6:01am UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052/4 "2021-04-27T06:01:27Z")
Hi ---
**Author:** ![Naveen\_NK](https://avatars.discourse-cdn.com/v4/letter/n/45deac/32.png) [@Naveen\_NK](https://forum.ansible.com/u/Naveen_NK)\ **Post date:** [April 27, 2021, 10:41am UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052/5 "2021-04-27T10:41:25Z")
Yes right ! ---
**Author:** ![Dick\_Visser](https://avatars.discourse-cdn.com/v4/letter/d/d9b06d/32.png) [@Dick\_Visser](https://forum.ansible.com/u/Dick_Visser)\ **Post date:** [April 27, 2021, 5:42pm UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052/6 "2021-04-27T17:42:56Z")
> Yes right ! Ok, but this updating by those users, is that done through the publicly accessible api. I’m not sure about the security benefits of this setup. What about setting up some vpn or something if you insist on IP acls ---
**Author:** ![Naveen\_NK](https://avatars.discourse-cdn.com/v4/letter/n/45deac/32.png) [@Naveen\_NK](https://forum.ansible.com/u/Naveen_NK)\ **Post date:** [April 28, 2021, 2:45am UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052/7 "2021-04-28T02:45:28Z")
We couldn’t go for VPN due to high pricing. So trying some workaround This updating IP would go through jenkins job so there shouldn’t be security problems. ---
**Author:** ![Naveen\_NK](https://avatars.discourse-cdn.com/v4/letter/n/45deac/32.png) [@Naveen\_NK](https://forum.ansible.com/u/Naveen_NK)\ **Post date:** [May 3, 2021, 7:53am UTC](https://forum.ansible.com/t/modifying-cidr-of-an-existing-ec2-security-groups-using-ansible/35052/8 "2021-05-03T07:53:45Z")
Does anyone got some idea on this?