# problems with with\_subelements

**URL:** <https://forum.ansible.com/t/problems-with-with-subelements/17316>\
**Category:** Ansible Project\
**Created:** [January 19, 2015, 11:51pm UTC](https://forum.ansible.com/t/problems-with-with-subelements/17316 "2015-01-19T23:51:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robb\_Wagoner](https://avatars.discourse-cdn.com/v4/letter/r/5e9695/32.png) [@Robb\_Wagoner](https://forum.ansible.com/u/Robb_Wagoner)\
**Post date:** [January 19, 2015, 11:51pm UTC](https://forum.ansible.com/t/problems-with-with-subelements/17316/1 "2015-01-19T23:51:19Z")

</div>

Hello,

I am attempting to make my EC2 VPC infrastructure indempotent. I have a list of VPC dictionaries for a region. Each VPC has a list of security\_groups. I am having problems using the **with\_subelements:** loop/lookup

My contrived playbook: Two VPCs, each has a sub-list of **security\_group** dictionaries:

`

- hosts: localhost  
vars:  
vpcs:
- name: my vpc 1  
cidr\_block: 10.0.0.0/16  
subnets:
- cidr: 10.0.0.0/24  
az: us-west-2a  
security\_groups:
- name: all  
description: all hosts  
rules:
- proto: tcp  
from\_port: 80  
to\_port: 80  
cidr\_ip: 0.0.0.0/0  
rules\_egress:
- proto: all  
from\_port: all  
to\_port: all  
cidr\_ip: 0.0.0.0/0
- name: my vpc 2  
cidr\_block: 10.10.0.0/16  
subnets:
- cidr: 10.10.0.0/24  
az: us-west-2a  
security\_groups:
- name: all  
description: all hosts  
rules:
- proto: tcp  
from\_port: 443  
to\_port: 443  
cidr\_ip: 0.0.0.0/0  
rules\_egress:
- proto: all  
from\_port: all  
to\_port: all  
cidr\_ip: 0.0.0.0/0

tasks:

- local\_action:  
module: ec2\_vpc  
resource\_tags: { Name: “{{ item.name }}” }  
cidr\_block: “{{ item.cidr\_block }}”  
subnets: “{{ item.subnets }}”  
state: present  
with\_items: vpcs  
register: result\_vpcs

- debug: var=result\_vpcs

- local\_action:  
module: ec2\_group  
name: “{{ item[1].name }}”  
description: “{{ item[1].description }}”  
rules: “{{ item[1].rules }}”  
rules\_egress: “{{ item[1].rules\_egress }}”  
  
**58 with\_subelements:  
59 - result\_vpcs.results  
60 - item**  
 

`

For each dictionary in the list **result\_vpcs.results** , I want to get the sub-element of the **item.security\_groups** list as the basis for creating my security groups. This is nuanced but really useful (i.e. idempotent).

`

“result\_vpcs”: {  
“changed”: false,  
“msg”: “All items completed”,  
**“results”** : [  
{  
“changed”: false,  
“invocation”: {  
“module\_args”: “”,  
“module\_name”: “ec2\_vpc”  
},  
**“item”** : {  
“cidr\_block”: “10.0.0.0/16”,  
“name”: “my vpc 1”,  
**“security\_groups”** : [  
{  
“description”: “all hosts”,  
“name”: “all”,  
“rules”: [  
{  
“cidr\_ip”: “0.0.0.0/0”,  
“from\_port”: 80,  
“proto”: “tcp”,  
“to\_port”: 80  
}  
],  
“rules\_egress”: [  
{  
“cidr\_ip”: “0.0.0.0/0”,  
“from\_port”: “all”,  
“proto”: “all”,  
“to\_port”: “all”  
}  
]  
}  
],  
“subnets”: [  
{  
“az”: “us-west-2a”,  
“cidr”: “10.0.0.0/24”  
}  
]  
},  
“subnets”: [  
{  
“az”: “us-west-2a”,  
“cidr”: “10.0.0.0/24”,  
“id”: “subnet-886eb6ff”,  
“resource\_tags”: {}  
}  
],  
“vpc”: {  
“cidr\_block”: “10.0.0.0/16”,  
“dhcp\_options\_id”: “dopt-0ee3056b”,  
“id”: “vpc-67f35302”,  
“region”: “us-west-2”,  
“state”: “available”  
},  
“vpc\_id”: “vpc-67f35302”  
},  
{  
“changed”: false,  
“invocation”: {  
“module\_args”: “”,  
“module\_name”: “ec2\_vpc”  
},  
**“item”** : {  
“cidr\_block”: “10.10.0.0/16”,  
“name”: “my vpc 2”,  
**“security\_groups”** : [  
{  
“description”: “all hosts”,  
“name”: “all”,  
“rules”: [  
{  
“cidr\_ip”: “0.0.0.0/0”,  
“from\_port”: 443,  
“proto”: “tcp”,  
“to\_port”: 443  
}  
],  
“rules\_egress”: [  
{  
“cidr\_ip”: “0.0.0.0/0”,  
“from\_port”: “all”,  
“proto”: “all”,  
“to\_port”: “all”  
}  
]  
}  
],  
“subnets”: [  
{  
“az”: “us-west-2a”,  
“cidr”: “10.10.0.0/24”  
}  
]  
},  
“subnets”: [  
{  
“az”: “us-west-2a”,  
“cidr”: “10.10.0.0/24”,  
“id”: “subnet-746fb703”,  
“resource\_tags”: {}  
}  
],  
“vpc”: {  
“cidr\_block”: “10.10.0.0/16”,  
“dhcp\_options\_id”: “dopt-0ee3056b”,  
“id”: “vpc-60f35305”,  
“region”: “us-west-2”,  
“state”: “available”  
},  
“vpc\_id”: “vpc-60f35305”  
}  
]  
}  
}

`

The error from using sub\_elements:

` `  
TASK: [ec2\_group] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*  
fatal: [localhost] =\> the key item should point to a list, got '{‘subnets’: [[{‘cidr’: ‘10.0.0.0/24’, ‘az’: ‘us-west-2a’}], ’  
`

`

No surprise there. I read the code and see that it expects a string as the key name to use. Is there a way I can traverse the **result\_vpcs** to create the **security\_groups** like I want? I’ve looked at using **with\_nested** , but that doesn’t do what I want.

Perhaps with\_subelements should be changed a bit to allow **either** a string **or** an arbitrary list. I.e. so one can use **item.security\_groups** as the second term instead of simply a string.

This seems like what I want: [https://github.com/ansible/ansible/pull/6370](https://github.com/ansible/ansible/pull/6370)

Am I overlooking some loop/filter capability in Ansible that can be used in my scenario?

Thanks,  
Robb