Issue 1:
Version: 1.9 but also devel as the file handling code does not changed.

Server/Client OS: Ubuntu

This is not a duplicate of #2618. When defining a caching path for the jsonfile caching plugin that is not writable by Ansible. Ansible fails with the following message:

fatal: [my-host] => Traceback (most recent call last):
File "/home/david/.pip/ansible/lib/ansible/runner/__init__.py", line 586, in _executor
exec_rc = self._executor_internal(host, new_stdin)
File "/home/david/.pip/ansible/lib/ansible/runner/__init__.py", line 668, in _executor_internal
inject = self.get_inject_vars(host)
File "/home/david/.pip/ansible/lib/ansible/runner/__init__.py", line 611, in get_inject_vars
combined_cache = self.get_combined_cache()
File "/home/david/.pip/ansible/lib/ansible/runner/__init__.py", line 606, in get_combined_cache
combined_cache = self.setup_cache.copy()
File "/home/david/.pip/ansible/lib/ansible/cache/__init__.py", line 54, in copy
return dict([(k, v) for (k, v) in self.iteritems()])
File "/usr/lib/python2.7/_abcoll.py", line 406, in iteritems
yield (key, self[key])
File "/home/david/.pip/ansible/lib/ansible/cache/__init__.py", line 35, in __getitem__
return self._plugin.get(key)
File "/home/david/.pip/ansible/lib/ansible/cache/jsonfile.py", line 69, in get
f.close()
UnboundLocalError: local variable 'f' referenced before assignment

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

ec2_group

ANSIBLE VERSION

ansible 2.4.2.0
config file = /etc/ansible/ansible.cfg
configured module search path = [u'/home/kclausen/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
ansible python module location = /usr/local/lib/python2.7/site-packages/ansible
executable location = /usr/local/bin/ansible
python version = 2.7.12 (default, Nov 2 2017, 19:20:38) [GCC 4.8.5 20150623 (Red Hat 4.8.5-11)]

CONFIGURATION

$ ansible-config dump --only-changed

$

OS / ENVIRONMENT

n/a

SUMMARY

I have a group_vars file that defines my VPC and when I try to create a new VPC it fails to create my edge security group with the correct permissions.

It's supposed to create a group that gives public access to port 443 and port 80, but instead creates a security group with access to ALL ports!

STEPS TO REPRODUCE

From group_vars/all

# VPC Security Groups list
vpc_security_group_all:
- "{{ vpc_security_group['public_edge_sg'] }}"
# and a bunch more security groups

# VPC Security Groups definitions
vpc_security_group:
public_edge_sg:
- name: '{{ vpc_name }} - Public Edge SG'
description: 'Security Group for {{ vpc_name }} Public Edge Loadbalancers'
rules:
- "{{ vpc_sg_access_rule['all_tcp_443'] }}"
- "{{ vpc_sg_access_rule['all_tcp_80'] }}"

# VPC Security Group access rules
vpc_sg_access_rule:
# Full access
all:
cidr_ip: 0.0.0.0/0
from_port: all
proto: all
to_port: all

# Public access port 443
all_tcp_443:
cidr_ip: 0.0.0.0/0
from_port: 443
proto: all
to_port: 443

# Public access port 80
all_tcp_80:
cidr_ip: 0.0.0.0/0
from_port: 80
proto: all
to_port: 80

From the playbook:

- name: Create Security Groups
ec2_group:
description: '{{ item.description }}'
name: '{{ item.name }}'
region: '{{ vpc_region }}'
rules: '{{ item.rules }}'
vpc_id: '{{ vpc_id }}'
with_items: '{{ vpc_security_group_all }}'

EXPECTED RESULTS

A security group gets created with public access to port 80 and port 443 over TCP

ACTUAL RESULTS

A security group gets created with public access to ALL ports, ALL protocols

An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ClientError: An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule "peer: 0.0.0.0/0, ALL, ALLOW" already exists
failed: [localhost] (item={u'rules': [{u'to_port': 443, u'from_port': 443, u'cidr_ip': u'0.0.0.0/0', u'proto': u'all'}, {u'to_port': 80, u'from_port': 80, u'cidr_ip': u'0.0.0.0/0', u'proto': u'all'}], u'name': u'XXXXXXX - Public Edge SG', u'description': u'Security Group for XXXXXXX Public Edge Loadbalancers'}) => {"changed": false, "error": {"code": "InvalidPermission.Duplicate", "message": "the specified rule \"peer: 0.0.0.0/0, ALL, ALLOW\" already exists"}, "item": {"description": "Security Group for XXXXXXX Public Edge Loadbalancers", "name": "XXXXXXX - Public Edge SG", "rules": [{"cidr_ip": "0.0.0.0/0", "from_port": 443, "proto": "all", "to_port": 443}, {"cidr_ip": "0.0.0.0/0", "from_port": 80, "proto": "all", "to_port": 80}]}, "msg": "Unable to authorize in for ip 0.0.0.0/0 security group 'XXXXXXX - Public Edge SG' - An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule \"peer: 0.0.0.0/0, ALL, ALLOW\" already exists", "response_metadata": {"http_headers": {"connection": "close", "date": "Tue, 06 Feb 2018 21:15:45 GMT", "server": "AmazonEC2", "transfer-encoding": "chunked"}, "http_status_code": 400, "request_id": "4cb58287-f6ee-43ee-bf8c-c17c3eb27294", "retry_attempts": 0}}