Repository: ansible/ansible

Issue:
ec2_group : local variable 'ip_permission' referenced before assignment


##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Bug Report


##### COMPONENT NAME
ec2_group

##### ANSIBLE VERSION
<!--- Paste verbatim output from “ansible --version” between quotes below -->
Can reproduce the issue on the stable-2.4 branch and on the develop branch on both Linux and Mac OS

```
ansible 2.4.0.0 (stable-2.4 a9d81ef3db) last updated 2017/09/07 15:35:08 (GMT -700)
  config file = None
  configured module search path = [u'/Users/me/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /Users/me/Development/Projects/ansible-bin-repo/lib/ansible
  executable location = /Users/me/Development/Projects/ansible-bin-repo/bin/ansible
  python version = 2.7.13 (default, Jul 18 2017, 09:17:00) [GCC 4.2.1 Compatible Apple LLVM 8.1.0 (clang-802.0.42)]
```

##### CONFIGURATION
<!---
Mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->

##### OS / ENVIRONMENT
<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say “N/A” for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.
-->

##### SUMMARY
<!--- Explain the problem briefly -->
Task fail with `UnboundLocalError: local variable 'ip_permission' referenced before assignment`
Was working a couple days ago

##### STEPS TO REPRODUCE

<!--- Paste example playbooks or commands between quotes below -->
vars.yml
```yaml
data_subnets:
  - "10.0.201.0/24"
  - "10.0.202.0/24"
  - "10.0.203.0/24"
```

task.yml
```yaml
- name: "Create security group"
  ec2_group:
    name: "my-security-group"
    description: "My Security Group"
    vpc_id: "{{vpc_id}}"
    region: "{{ aws_region }}"
    state: present
    rules_egress:
      - proto: tcp
        from_port: "{{from_port}}"
        to_port: "{{to_port}}"
        cidr_ip: "{{data_subnets}}"
      - proto: tcp
        from_port: "{{from_port2}}"
        to_port: "{{to_port2}}"
        cidr_ip: "{{data_subnets}}"
  register: security_group
```
<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
task work

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```
The full traceback is:
Traceback (most recent call last):
  File "/var/folders/y2/l4g6_6zn03s1mh34lkz1czjm0000gn/T/ansible_OwHGhF/ansible_module_ec2_group.py", line 884, in <module>
    main()
  File "/var/folders/y2/l4g6_6zn03s1mh34lkz1czjm0000gn/T/ansible_OwHGhF/ansible_module_ec2_group.py", line 826, in main
    ip_permission, module, rule, "ipv4")
UnboundLocalError: local variable 'ip_permission' referenced before assignment

fatal: [localhost]: FAILED! => {
    "changed": false,
    "failed": true,
    "module_stderr": "Traceback (most recent call last):\n  File \"/var/folders/y2/l4g6_6zn03s1mh34lkz1czjm0000gn/T/ansible_OwHGhF/ansible_module_ec2_group.py\", line 884, in <module>\n    main()\n  File \"/var/folders/y2/l4g6_6zn03s1mh34lkz1czjm0000gn/T/ansible_OwHGhF/ansible_module_ec2_group.py\", line 826, in main\n    ip_permission, module, rule, \"ipv4\")\nUnboundLocalError: local variable 'ip_permission' referenced before assignment\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE",
    "rc": 0
}
```

ec2_group : local variable 'ip_permission' referenced before assignment


##### ISSUE TYPE
<!--- Pick one below and delete the rest: -->
 - Bug Report


##### COMPONENT NAME
ec2_group

##### ANSIBLE VERSION
<!--- Paste verbatim output from “ansible --version” between quotes below -->
Can reproduce the issue on the stable-2.4 branch and on the develop branch on both Linux and Mac OS

```
ansible 2.4.0.0 (stable-2.4 a9d81ef3db) last updated 2017/09/07 15:35:08 (GMT -700)
  config file = None
  configured module search path = [u'/Users/me/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /Users/me/Development/Projects/ansible-bin-repo/lib/ansible
  executable location = /Users/me/Development/Projects/ansible-bin-repo/bin/ansible
  python version = 2.7.13 (default, Jul 18 2017, 09:17:00) [GCC 4.2.1 Compatible Apple LLVM 8.1.0 (clang-802.0.42)]
```

##### CONFIGURATION
<!---
Mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).
-->

##### OS / ENVIRONMENT
<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say “N/A” for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.
-->

##### SUMMARY
<!--- Explain the problem briefly -->
Task fail with `UnboundLocalError: local variable 'ip_permission' referenced before assignment`
Was working a couple days ago

##### STEPS TO REPRODUCE

<!--- Paste example playbooks or commands between quotes below -->
vars.yml
```yaml
data_subnets:
  - "10.0.201.0/24"
  - "10.0.202.0/24"
  - "10.0.203.0/24"
```

task.yml
```yaml
- name: "Create security group"
  ec2_group:
    name: "my-security-group"
    description: "My Security Group"
    vpc_id: "{{vpc_id}}"
    region: "{{ aws_region }}"
    state: present
    rules_egress:
      - proto: tcp
        from_port: "{{from_port}}"
        to_port: "{{to_port}}"
        cidr_ip: "{{data_subnets}}"
      - proto: tcp
        from_port: "{{from_port2}}"
        to_port: "{{to_port2}}"
        cidr_ip: "{{data_subnets}}"
  register: security_group
```
<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- What did you expect to happen when running the steps above? -->
task work

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes below -->
```
The full traceback is:
Traceback (most recent call last):
  File "/var/folders/y2/l4g6_6zn03s1mh34lkz1czjm0000gn/T/ansible_OwHGhF/ansible_module_ec2_group.py", line 884, in <module>
    main()
  File "/var/folders/y2/l4g6_6zn03s1mh34lkz1czjm0000gn/T/ansible_OwHGhF/ansible_module_ec2_group.py", line 826, in main
    ip_permission, module, rule, "ipv4")
UnboundLocalError: local variable 'ip_permission' referenced before assignment

fatal: [localhost]: FAILED! => {
    "changed": false,
    "failed": true,
    "module_stderr": "Traceback (most recent call last):\n  File \"/var/folders/y2/l4g6_6zn03s1mh34lkz1czjm0000gn/T/ansible_OwHGhF/ansible_module_ec2_group.py\", line 884, in <module>\n    main()\n  File \"/var/folders/y2/l4g6_6zn03s1mh34lkz1czjm0000gn/T/ansible_OwHGhF/ansible_module_ec2_group.py\", line 826, in main\n    ip_permission, module, rule, \"ipv4\")\nUnboundLocalError: local variable 'ip_permission' referenced before assignment\n",
    "module_stdout": "",
    "msg": "MODULE FAILURE",
    "rc": 0
}
```



Discussion:
cc @adq
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->
cc @adq
[click here for bot help](https://github.com/ansible/ansibullbot/blob/master/ISSUE_HELP.md)
<!--- boilerplate: notify --->

Resolving patch:
diff --git a/lib/ansible/modules/cloud/amazon/ec2_group.py b/lib/ansible/modules/cloud/amazon/ec2_group.py
--- a/lib/ansible/modules/cloud/amazon/ec2_group.py
+++ b/lib/ansible/modules/cloud/amazon/ec2_group.py
@@ -714,13 +714,13 @@ def main():
         module.fail_json(msg="Unsupported state requested: %s" % state)
 
     # create a lookup for all existing rules on the group
+    ip_permission = []
     if group:
         # Manage ingress rules
         groupRules = {}
         add_rules_to_lookup(group['IpPermissions'], group['GroupId'], 'in', groupRules)
         # Now, go through all provided rules and ensure they are there.
         if rules is not None:
-            ip_permission = []
             for rule in rules:
                 validate_rule(module, rule)
                 group_id, ip, ipv6, target_group_created = get_target_from_rule(module, client, rule, name,


Test patch: