# Populating an EC2 Security Group rules (using ec2\_group modules) with IPs (Pingdom probe servers) gathered dynamically at playbook runtime **URL:** \ **Category:** Ansible Project\ **Created:** [June 9, 2014, 8:50pm UTC](https://forum.ansible.com/t/populating-an-ec2-security-group-rules-using-ec2-group-modules-with-ips-pingdom-probe-servers-gathered-dynamically-at-playbook-runtime/15431 "2014-06-09T20:50:32Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Jaime\_Gago](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jaime\_Gago](https://forum.ansible.com/u/Jaime_Gago)\ **Post date:** [June 9, 2014, 8:50pm UTC](https://forum.ansible.com/t/populating-an-ec2-security-group-rules-using-ec2-group-modules-with-ips-pingdom-probe-servers-gathered-dynamically-at-playbook-runtime/15431/1 "2014-06-09T20:50:32Z")
Hey there, I’m trying to write a playbook that gets the latest Pingdom probe servers IPs and add updates an EC2 Security groups rules with those IPs, but I’m failing are iterating the IPs in the rule and only the latest IPs is added (I’m replacing instead of appending). I opened an ticket on github (1) but because I hadn’t detailed out the whole use case it got closed without really answering the issue; so I thought I’d post here see what others are thinking. I’m not sure whether I’m trying to hard to fit this into a playbook as I have this working via a script, now of course I could call the script itself but that IMHO would defeat the purpose of using Ansible in the first place. I understand why the playbook fails to append the rules but I haven’t been able to figure out a way around other than modifying the ec2\_group module itself. J. (1) [https://github.com/ansible/ansible/issues/7584](https://github.com/ansible/ansible/issues/7584) ---
**Author:** ![andreub](https://avatars.discourse-cdn.com/v4/letter/a/58f4c7/32.png) [@andreub](https://forum.ansible.com/u/andreub)\ **Post date:** [June 11, 2014, 3:32pm UTC](https://forum.ansible.com/t/populating-an-ec2-security-group-rules-using-ec2-group-modules-with-ips-pingdom-probe-servers-gathered-dynamically-at-playbook-runtime/15431/2 "2014-06-11T15:32:23Z")
Hi Jaime, I had the exact same problem. ec2\_group modules recreates the rules every time you use the it, so if you’re running it in a loop, it will create the group the rule for the last item only. A workaround that I implemented is to generate a var.yml with a var defined with the rules out of a template, and then source it dynamically: ---
**Author:** ![Jaime\_Gago](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Jaime\_Gago](https://forum.ansible.com/u/Jaime_Gago)\ **Post date:** [June 12, 2014, 5:31am UTC](https://forum.ansible.com/t/populating-an-ec2-security-group-rules-using-ec2-group-modules-with-ips-pingdom-probe-servers-gathered-dynamically-at-playbook-runtime/15431/3 "2014-06-12T05:31:02Z")
Nice work around, thanks a lot for sharing, for the record I am doing something similar in other AWS oriented playbooks (e.g. to create mappings of the AWS random subnets IDs to the actual subnet CIDR I’ve defined in my var files) but I didn’t think about using it here. It seems the template/include var is a common trick for AWS playbooks but maybe that’s just my experience, meh. Thanks again! J. ---
**Author:** ![Le\_Van1](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@Le\_Van1](https://forum.ansible.com/u/Le_Van1)\ **Post date:** [February 27, 2015, 7:36am UTC](https://forum.ansible.com/t/populating-an-ec2-security-group-rules-using-ec2-group-modules-with-ips-pingdom-probe-servers-gathered-dynamically-at-playbook-runtime/15431/4 "2015-02-27T07:36:36Z")
Many thanks for this tip. It’s clever ---
**Author:** ![Steven\_Truong](https://avatars.discourse-cdn.com/v4/letter/s/df705f/32.png) [@Steven\_Truong](https://forum.ansible.com/u/Steven_Truong)\ **Post date:** [March 23, 2015, 11:41pm UTC](https://forum.ansible.com/t/populating-an-ec2-security-group-rules-using-ec2-group-modules-with-ips-pingdom-probe-servers-gathered-dynamically-at-playbook-runtime/15431/5 "2015-03-23T23:41:24Z")
Thanks for the tips. I tried this and this worked but to only some extents. What do I meant by that and here are the steps that you can repeat to see the potential issue of this ec2\_group module. 1. I started out with a vars yml file that has about 9 different IP addresses/32 ---
**Author:** ![senorsmile](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/senorsmile/32/9024_2.png) [@senorsmile](https://forum.ansible.com/u/senorsmile)\ **Post date:** [May 16, 2015, 1:31am UTC](https://forum.ansible.com/t/populating-an-ec2-security-group-rules-using-ec2-group-modules-with-ips-pingdom-probe-servers-gathered-dynamically-at-playbook-runtime/15431/6 "2015-05-16T01:31:02Z")
Has anyone made any further progress on this yet? ---
**Author:** ![Kimmo\_Koskinen](https://avatars.discourse-cdn.com/v4/letter/k/74df32/32.png) [@Kimmo\_Koskinen](https://forum.ansible.com/u/Kimmo_Koskinen)\ **Post date:** [September 17, 2015, 5:48pm UTC](https://forum.ansible.com/t/populating-an-ec2-security-group-rules-using-ec2-group-modules-with-ips-pingdom-probe-servers-gathered-dynamically-at-playbook-runtime/15431/7 "2015-09-17T17:48:04Z")
I ran into this problem, and found a workaround by creating a jinja2 filter module: [https://gist.github.com/viesti/1febe79938c09cc29501](https://gist.github.com/viesti/1febe79938c09cc29501) - Kimmo lauantai 16. toukokuuta 2015 4.31.02 UTC+3 senorsmile kirjoitti: