# Possible bug in repeated runs of ec2\_group module with wide-open rule **URL:** \ **Category:** Ansible Project\ **Tags:** aws\ **Created:** [June 18, 2014, 9:58pm UTC](https://forum.ansible.com/t/possible-bug-in-repeated-runs-of-ec2-group-module-with-wide-open-rule/15497 "2014-06-18T21:58:42Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Michael\_Peters](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Michael\_Peters](https://forum.ansible.com/u/Michael_Peters)\ **Post date:** [June 18, 2014, 9:58pm UTC](https://forum.ansible.com/t/possible-bug-in-repeated-runs-of-ec2-group-module-with-wide-open-rule/15497/1 "2014-06-18T21:58:42Z")
I have the following as part of a playbook that makes sure we have the appropriate security groups setup and all of them work just fine except this one:     - name: Create wide-open testing security group       local\_action:         module: ec2\_group         name: 'WIDE OPEN'         description: 'WIDE OPEN for TESTING ONLY!'         vpc\_id: "{{ vpc\_id }}"         region: "{{ aws\_region }}"         state: present         rules:           # everything from anywhere           - proto: -1             from\_port: -1             to\_port: -1             cidr\_ip: 0.0.0.0/0 The first time I run the playbook with this task it works just fine. But every time it's run after that I get this error: failed: [localhost] =\> {"failed": true, "parsed": false} invalid output was: Traceback (most recent call last):   File "/home/mpeters/.ansible/tmp/ansible-tmp-1403128269.19-243664471754105/ec2\_group", line 1754, in \     main()   File "/home/mpeters/.ansible/tmp/ansible-tmp-1403128269.19-243664471754105/ec2\_group", line 268, in main     group.authorize(rule['proto'], rule['from\_port'], rule['to\_port'], ip, grantGroup)   File "/usr/lib/python2.7/site-packages/boto/ec2/securitygroup.py", line 204, in authorize     dry\_run=dry\_run)   File "/usr/lib/python2.7/site-packages/boto/ec2/connection.py", line 3144, in authorize\_security\_group     params, verb='POST')   File "/usr/lib/python2.7/site-packages/boto/connection.py", line 1196, in get\_status     raise self.ResponseError(response.status, response.reason, body) boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request \ \\\\InvalidPermission.Duplicate\\the specified rule "peer: 0.0.0.0/0, ALL, ALLOW" already exists\\\\d5f91251-0cbb-478c-86ce-bb371fcf0361\\ Firstly, I've heard several times on this list that anytime there's a Traceback thrown to the screen it's a bug in the sense that it needs better error handling, right? But before I create a ticket for InvalidPermission.Duplicate error on repeated runs I wanted to make sure that I wasn't doing anything wrong. Using "-1" for proto, from\_port and to\_port is a little unusual, but it should still be supported for multiple runs right? Thanks, Michael ---
**Author:** ![James\_Cammarata](https://avatars.discourse-cdn.com/v4/letter/j/7c8e57/32.png) [@James\_Cammarata](https://forum.ansible.com/u/James_Cammarata)\ **Post date:** [June 19, 2014, 2:12am UTC](https://forum.ansible.com/t/possible-bug-in-repeated-runs-of-ec2-group-module-with-wide-open-rule/15497/2 "2014-06-19T02:12:14Z")
Yes, definitely a bug, so please open an issue for this. And the “-1” is used by the AWS API to indicate “any”, so for the error above it’s trying to create a default ingress rule which will also use -1’s for the same fields, but for some reason it’s not seeing you adding that rule yourself. ---
**Author:** ![Michael\_Peters](https://avatars.discourse-cdn.com/v4/letter/m/c2a13f/32.png) [@Michael\_Peters](https://forum.ansible.com/u/Michael_Peters)\ **Post date:** [June 19, 2014, 1:22pm UTC](https://forum.ansible.com/t/possible-bug-in-repeated-runs-of-ec2-group-module-with-wide-open-rule/15497/3 "2014-06-19T13:22:24Z")
Thanks for the confirmation. Filed as [https://github.com/ansible/ansible/issues/7832](https://github.com/ansible/ansible/issues/7832)