# Script/How to export from ec2\_group\_facts and import into ec2\_group? AWS **URL:** \ **Category:** Ansible Project\ **Tags:** aws\ **Created:** [April 23, 2018, 3:03pm UTC](https://forum.ansible.com/t/script-how-to-export-from-ec2-group-facts-and-import-into-ec2-group-aws/27351 "2018-04-23T15:03:27Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\ **Post date:** [April 23, 2018, 3:03pm UTC](https://forum.ansible.com/t/script-how-to-export-from-ec2-group-facts-and-import-into-ec2-group-aws/27351/1 "2018-04-23T15:03:27Z")
Dear Citizens of Ansible Project, I may have a need to export large numbers of security groups from VPCs and import them into new VPCs; basically I want to clone all the security groups from one VPC, and import them to another. Naturally, I thought of doing this using Ansible. I have found scripts that dump ec2\_group\_facts or similar and migrate them to new regions for example: [https://github.com/Suncatcher/aws\_sg\_migrate](https://github.com/Suncatcher/aws_sg_migrate) To my mind, it would be preferable to have a copy of the security groups in ec2\_group format, so that I can use Ansible to make the changes. Going forward, people who edit the Ansible ec2\_group rules should commit changes to Git first, so we can track who makes changes to security rules for auditing purposes. It seems preferable to use Ansible as tool of choice, but maybe there is a better way? My initial impression is that it makes sense to maintain Ansible playbooks using ec2\_group to maintain Security Groups. There are a fairly large number of Security Groups that need to be maintained, so if there’s a script out there that exports from ec2\_group\_facts and imports into ec2\_group it would save a lot of time Ec2\_group\_facts output looks like this: ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [June 2, 2018, 11:59pm UTC](https://forum.ansible.com/t/script-how-to-export-from-ec2-group-facts-and-import-into-ec2-group-aws/27351/2 "2018-06-02T23:59:31Z")
Hullo Simon Did you ever figure this out? It’s a mystery to my why the writer of the ec2\_group\_facts module would generate output that could not be used as input for ec2\_group… Regards, K. ---
**Author:** ![Simon\_Tyler](https://avatars.discourse-cdn.com/v4/letter/s/54ee81/32.png) [@Simon\_Tyler](https://forum.ansible.com/u/Simon_Tyler)\ **Post date:** [June 4, 2018, 3:09pm UTC](https://forum.ansible.com/t/script-how-to-export-from-ec2-group-facts-and-import-into-ec2-group-aws/27351/3 "2018-06-04T15:09:08Z")
Hi Karl, It does seem a bit odd to me. I ended up using Vim search and replace functions to make the changes, and did some of the work manually. On a related note, I discovered two things that may be useful to people faced with a similar task: you can insert multiple ports in a rule, as a list, one after another instead of having a new rule for each port; when you export the rules, it exports each port as it’s own rule, which makes for a lot of unnecessary work when editing. Also, there is a clone option in AWS GUI which I didn’t realize; this might also come in handy. In the end what I noticed though is that once you get familiar with the Ansible ec2\_group syntax, it’s often faster to make the change to the script then through the GUI specifically because it is possible to insert multiple ports in one rule, it’s like you can collapse large numbers of rules into one rule with a list of ports; if you make changes to security groups through the GUI, it seems to me that you have to make a new rule for each port. Onwards, ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [June 4, 2018, 3:22pm UTC](https://forum.ansible.com/t/script-how-to-export-from-ec2-group-facts-and-import-into-ec2-group-aws/27351/4 "2018-06-04T15:22:19Z")
Yes - there’s a relatively new syntax in Ansible that allows source groups of ports, ranges and other groups. I need to do my changes dynamically - I can’t take code, edit it manually, then run something, I need to be able to grab what’s there, add a rule and write it back. Having looked at the two modules, it looks as if modifying ec2\_group\_facts to generate group-compatible output would be quite hard. It’s a very simple module that essentially returns what the AWS API returns. But it looks as if it would be less difficult to make ec2\_group accept that output, and it would be able to discriminate between the two formats quite easily. At the moment it validates one format; just validate that, if it fails validate the other, and if that fails, complain. I hope someone fixes this. Neither your nor my issues can be uncommon… Regards, K. . ---
**Author:** ![flowerysong1](https://avatars.discourse-cdn.com/v4/letter/f/ecae2f/32.png) [@flowerysong1](https://forum.ansible.com/u/flowerysong1)\ **Post date:** [June 4, 2018, 4:08pm UTC](https://forum.ansible.com/t/script-how-to-export-from-ec2-group-facts-and-import-into-ec2-group-aws/27351/5 "2018-06-04T16:08:53Z")
You don’t need to include the existing rules in your task; if you set purge\_rules to false the current rules will be preserved. ---
**Author:** ![Karl\_Auer](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Karl\_Auer](https://forum.ansible.com/u/Karl_Auer)\ **Post date:** [June 4, 2018, 4:23pm UTC](https://forum.ansible.com/t/script-how-to-export-from-ec2-group-facts-and-import-into-ec2-group-aws/27351/6 "2018-06-04T16:23:20Z")
Well - dang. If that’s all I need, you just saved me a whole heap of time. Thanks! But I still think that a facts module should provide facts that can be used as input fo create/modify modules 🙂 Regards, K.