Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

EC2_GROUP

ANSIBLE VERSION

ansible 2.2.0.0
config file =
configured module search path = Default w/o overrides

CONFIGURATION

OS / ENVIRONMENT

Amazon Linux 2016.09

SUMMARY

"msg": "group referenced_group will be automatically created by rule {'to_port': 65535, 'from_port': 0, 'proto': 'tcp', 'group_name': 'referenced_group'} and no description was provided"

STEPS TO REPRODUCE

pip install ansible

attempt to apply group with a reference to another group

---
- name: new_group
hosts: localhost
gather_facts: no
tasks:
- name: new_group
local_action:
module: ec2_group
name: new_group
description: new security group for some service
vpc_id: "{{ vpc }}"
region: "{{ region }}"
profile: "{{ profile }}"
rules:
- proto: tcp
from_port: 0
to_port: 65535
group_name: referenced_group

- proto: tcp
from_port: 22
to_port: 22
cidr_ip: "{{ access_cidr }}"

EXPECTED RESULTS

Application of security group(s)

ACTUAL RESULTS

fatal: [localhost -> localhost]: FAILED! => {

"changed": false,

"failed": true,

"msg": "group referenced_group will be automatically created by rule {'to_port': 65535, 'from_port': 0, 'proto': 'tcp', 'group_name': 'referenced_group'} and no description was provided"

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

ec2_group

ANSIBLE VERSION

ansible 2.2.1.0
config file =
configured module search path = Default w/o overrides

install: sudo pip install -U git+https://github.com/ansible/ansible.git@v2.2.1.0-0.2.rc2 --upgrade --ignore-installed six

CONFIGURATION

default ansible.cfg

OS / ENVIRONMENT

OS X El Capitan 10.11.6

Multi VPC AWS environment. Peers between VPC's w/appropriate routing between them

SUMMARY

ec2_group does not allow group_name to use groups via group name from other peered VPC's. This worked in v1.9.6 and v2.0.2. It appears to be due to some additional conditions that were added on 7/27/16. If I revert this change, it works as expected.

0419914

Using group_id with the name of the security group in a different VPC works but is not idempotent. It will create the rule if it's new but will fail if it already exists.

STEPS TO REPRODUCE

Attempt to use a AWS security group name from another VPC with required peering present using group_name:

- name: Provision Security Groups
ec2_group:
name: MyGroup
description: MyDesc
region: us-east-1
vpc_id: vpc-xxxxxxxx
rules:
- proto: tcp
from_port: 22
to_port: 22
group_name: <Other_VPC_SG_NAME>

Attempt to use a AWS security group name from another VPC with required peering present using group_id:

- name: Provision Security Groups
ec2_group:
name: MyGroup
description: MyDesc
region: us-east-1
vpc_id: vpc-xxxxxxxx
rules:
- proto: tcp
from_port: 22
to_port: 22
group_id: <Other_VPC_SG_NAME>

EXPECTED RESULTS

Translate group name to group ID (sg-xxxxxxxx) and update rule with the security group ID of the other VPC's security group.

ACTUAL RESULTS

The group in the peered VPC is not found and an attempt to create a new group in the current VPC is executed. In my case, this fails due to "no description"

Message using group_name with security group name from a different VPC

"msg": "group <PeeredVPCGroupName> will be automatically created by rule {'to_port': 22, 'from_port': 22, 'group_name': '<PeeredVPCGroupName>', 'proto': 'tcp'} and no description was provided"

Message using group_id with security group name from a different VPC if the rule exists. If the rule does not exist, it is added as expected.

"module_stderr": "Traceback (most recent call last):\n File \"/var/folders/t8/vdrxm90s1ps41pghp7wxn8n80000gp/T/ansible_pJu0pZ/ansible_module_ec2_group.py\", line 479, in <module>\n main()\n File \"/var/folders/t8/vdrxm90s1ps41pghp7wxn8n80000gp/T/ansible_pJu0pZ/ansible_module_ec2_group.py\", line 374, in main\n group.authorize(rule['proto'], rule['from_port'], rule['to_port'], thisip, grantGroup)\n File \"/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/ec2/securitygroup.py\", line 203, in authorize\n dry_run=dry_run)\n File \"/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/ec2/connection.py\", line 3191, in authorize_security_group\n params, verb='POST')\n File \"/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/connection.py\", line 1227, in get_status\n raise self.ResponseError(response.status, response.reason, body)\nboto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Response><Errors><Error><Code>InvalidPermission.Duplicate</Code><Message>the specified rule \"peer: sg-xxxxxxxx, TCP, from port: 22, to port: 22, ALLOW\" already exists</Message></Error></Errors><RequestID>b9ec5eee-4a86-49d7-90b8-86bfbf2ba21b</RequestID></Response>\n",
"module_stdout": "",
"msg": "MODULE FAILURE"