ansible/ansible — pull request #6164 by codezerk (2014-02-25 17:54:05+00:00)
Title: Egress rules for ec2 security groups

This will have the ability of adding egress rules, here is an example:

- name: example ec2 group
local_action:
module: ec2_group
name: example
description: an example EC2 group
vpc_id: 12345
region: eu-west-1a
ec2_secret_key: SECRET
ec2_access_key: ACCESS
rules:
- proto: tcp
from_port: 80
to_port: 80
cidr_ip: 0.0.0.0/0
egress: yes <------------------ this will mark it as egress
- proto: tcp
from_port: 22
to_port: 22
cidr_ip: 10.0.0.0/8

When creating a security group on EC2, a default egress rule is always created, this rule gives unrestricted access to all protocols and all ports. This is unrelated to Ansible nor Boto.
When creating a security group using my changes, if no egress rules are configured then it will not change any egress rules that already exist on the group. If there are rules configured then similar to ingress rules it will remove the ones that are not configured.
I'm not sure if this is behavior is better for most users, but after contemplating I thought it is more reasonable.