Issue 1:
Issue Type:

Bug Report

Ansible Version:

1.6.2

Environment:

Ansible running on Fedora 20. EC2 API is the target.

Summary:

If you have a wide open security rule for a group (-1 for proto, from_port and to_port with a cidr of 0.0.0.0/0) it can only be run once. Subsequent run will fail.

Steps To Reproduce:

I have the following as part of a playbook that makes sure we have the

appropriate security groups setup and all of them work just fine

except this one:

- name: Create wide-open testing security group
local_action:
module: ec2_group
name: 'WIDE OPEN'
description: 'WIDE OPEN for TESTING ONLY!'
vpc_id: "{{ vpc_id }}"
region: "{{ aws_region }}"
state: present
rules:
# everything from anywhere
- proto: -1
from_port: -1
to_port: -1
cidr_ip: 0.0.0.0/0

The first time I run the playbook with this task it works just fine.

But every time it's run after that it fails. Other rules in other ec2_group tasks in this same playbook execute as expected when run multiple times.

Expected Results:

It should recognize that the rule already exists like it does every other rule and just skip it.

Actual Results:

It fails with the following error:

failed: [localhost] => {"failed": true, "parsed": false}
invalid output was: Traceback (most recent call last):
File "/home/mpeters/.ansible/tmp/ansible-tmp-1403183990.17-2723736991339/ec2_group", line 1754, in <module>
main()
File "/home/mpeters/.ansible/tmp/ansible-tmp-1403183990.17-2723736991339/ec2_group", line 268, in main
group.authorize(rule['proto'], rule['from_port'], rule['to_port'], ip, grantGroup)
File "/usr/lib/python2.7/site-packages/boto/ec2/securitygroup.py", line 204, in authorize
dry_run=dry_run)
File "/usr/lib/python2.7/site-packages/boto/ec2/connection.py", line 3144, in authorize_security_group
params, verb='POST')
File "/usr/lib/python2.7/site-packages/boto/connection.py", line 1196, in get_status
raise self.ResponseError(response.status, response.reason, body)

boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request

InvalidPermission.Duplicatethe specified rule "peer: 0.0.0.0/0, ALL, ALLOW" already exists40ddc890-fa3a-4528-9cf8-10cf47f3e4d6

Issue 2:
From @rlpowell on 2015-04-03T18:39:16Z

I apologize that I don't have the background with Ansible or Python to give any useful debugging info here, but:

Trying to run a shell command and get the output presented to me. This

version:

- name: run the script the rails way
register: scriptrun
shell: 'uname -a'

- name: get the result back
fetch: src=/tmp/mismatch_visne.csv dest=/tmp/mismatch_visne/

# Print the shell task's stdout.
- debug: msg={{ scriptrun.stdout }}

Works fine:

TASK: [run the script the rails way] ******************************************
changed: [perf-sedna_tomcat-1-tomcat]
changed: [qa-rhea_tomcat-1-tomcat]
changed: [qa-ariel_tomcat-1-tomcat]
changed: [perf-dione_tomcat-1-tomcat]

TASK: [get the result back] ***************************************************
ok: [perf-sedna_tomcat-1-tomcat]
ok: [qa-rhea_tomcat-1-tomcat]
ok: [qa-ariel_tomcat-1-tomcat]
ok: [perf-dione_tomcat-1-tomcat]

TASK: [debug msg={{ scriptrun.stdout }}] **************************************
ok: [perf-sedna_tomcat-1-tomcat] => {
"msg": "Linux"
}
ok: [qa-ariel_tomcat-1-tomcat] => {
"msg": "Linux"
}
ok: [qa-rhea_tomcat-1-tomcat] => {
"msg": "Linux"
}
ok: [perf-dione_tomcat-1-tomcat] => {
"msg": "Linux"
}

PLAY RECAP ********************************************************************
to retry, use: --limit @/home/rlpowell/cyt_2407.yaml.retry

perf-dione_tomcat-1-tomcat : ok=6 changed=1 unreachable=0 failed=0
perf-sedna_tomcat-1-tomcat : ok=6 changed=1 unreachable=0 failed=0
qa-ariel_tomcat-1-tomcat : ok=6 changed=1 unreachable=0 failed=0
qa-janus_tomcat-1-tomcat : ok=0 changed=0 unreachable=1 failed=0
qa-rhea_tomcat-1-tomcat : ok=6 changed=1 unreachable=0 failed=0

OTOH, this one (the only change is to the "shell:" param):

- name: run the script the rails way
register: scriptrun
shell: '/usr/local/bin/cytobank_rails runner /tmp/cyt_2407.rb'

- name: get the result back
fetch: src=/tmp/mismatch_visne.csv dest=/tmp/mismatch_visne/

# Print the shell task's stdout.
- debug: msg={{ scriptrun.stdout }}

Gives this output:

TASK: [run the script the rails way] ******************************************
changed: [perf-sedna_tomcat-1-tomcat]
changed: [qa-ariel_tomcat-1-tomcat]
changed: [perf-dione_tomcat-1-tomcat]
changed: [qa-rhea_tomcat-1-tomcat]

TASK: [get the result back] ***************************************************
ok: [qa-rhea_tomcat-1-tomcat]
ok: [qa-ariel_tomcat-1-tomcat]
ok: [perf-sedna_tomcat-1-tomcat]
ok: [perf-dione_tomcat-1-tomcat]

TASK: [debug msg={{ scriptrun.stdout }}] **************************************
fatal: [perf-dione_tomcat-1-tomcat] => a duplicate parameter was found in the argument string ()
fatal: [qa-ariel_tomcat-1-tomcat] => a duplicate parameter was found in the argument string ()
fatal: [perf-sedna_tomcat-1-tomcat] => a duplicate parameter was found in the argument string ()
fatal: [qa-rhea_tomcat-1-tomcat] => a duplicate parameter was found in the argument string ()

FATAL: all hosts have already failed -- aborting

PLAY RECAP ********************************************************************
to retry, use: --limit @/home/rlpowell/cyt_2407.yaml.retry

perf-dione_tomcat-1-tomcat : ok=5 changed=1 unreachable=1 failed=0
perf-sedna_tomcat-1-tomcat : ok=5 changed=2 unreachable=1 failed=0
qa-ariel_tomcat-1-tomcat : ok=5 changed=1 unreachable=1 failed=0
qa-janus_tomcat-1-tomcat : ok=0 changed=0 unreachable=1 failed=0
qa-rhea_tomcat-1-tomcat : ok=5 changed=1 unreachable=1 failed=0

Copied from original issue: ansible/ansible-modules-core#1077