Remove a rule from AWS EC2 Security group using Ansible

Archives Ansible Project
1

I have an Ansible script to create EC2 security group. It looks like this

- name: Create HTTP Security Group
  local_action:
    module: ec2_group
    region: "{{ region }}"
    vpc_id: "{{ vpc }}"
    name: sg_http
    description: Security group for HTTP access
    rules:
      - proto: tcp
        from_port: 80
        to_port: 80
        cidr_ip: 0.0.0.0/0
  register: sg_http

I would like to write a task which deletes the rule but not security group. I tried using the state as present, but it doesn’t work

- name: Delete HTTP Rule
  local_action:
    module: ec2_group
    region: "{{ region }}"
    vpc_id: "{{ vpc }}"
    name: sg_http
    description: Security group for HTTP access
    rules:
      - proto: tcp
        from_port: 80
        to_port: 80
        cidr_ip: 0.0.0.0/0
        state: absent
  register: sg_http

What would be the better way to do this. Regards

2

remove the rule from the list.

rules:

3

Hi,
Can you please provide an example. I am specifically interested in removing
egress rules allowing everything automatically added by AWS when security
groups are created. Thank you

4

the security group module will just make your list of rules look like whatever you have currently defined in yml. If you remove a rule from the list, and run the task again, the rule will be removed from the security group at aws. This hold true for both ingress and egress.

In other words, for this module don’t think “state: present” or “state: absent” – that is determined by the rule being defined or not.

5

Thanks Brent that does explain a good detail about how security groups are handled by Ansible.
I would still appreciate if you can answer this question.

I am creating a security group using

- name: Create HTTP Security Group
  local_action:
    module: ec2_group
    region: "{{ region }}"
    vpc_id: "{{ vpc }}"
    name: sg_http
    description: Security group for HTTP access
    rules:
      - proto: tcp
        from_port: 80
        to_port: 80
        cidr_ip: [0.0.0.0/0](http://0.0.0.0/0)
  register: sg_http

However this created a security group with inbound http access but also full outbound (egress) access automatically. I do not want those egress rules to be present, how should I remove them.

6

Create an egress_rules: list that is empty.

7

Hi,
I have tried your suggestion of having an empty egress_rules list. However for some reason an all access egress rules are always enabled in all the security groups.

8

I think removing the global rule is broken:

https://groups.google.com/forum/#!topic/ansible-project/9FiCbvUR_Cs

9

Seems to work fine in the devel branch, could you please give it a try