<p dir="auto">Version: 1.9 but also devel as the file handling code does not changed.<br>
Server/Client OS: Ubuntu</p>
<p dir="auto">This is not a duplicate of <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="12949540" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible/issues/2618" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible/issues/2618/hovercard" href="https://github.com/ansible/ansible/issues/2618">#2618</a>. When defining a caching path for the jsonfile caching plugin that is not writable by Ansible. Ansible fails with the following message:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="fatal: [my-host] =&gt; Traceback (most recent call last):
  File &quot;/home/david/.pip/ansible/lib/ansible/runner/__init__.py&quot;, line 586, in _executor
    exec_rc = self._executor_internal(host, new_stdin)
  File &quot;/home/david/.pip/ansible/lib/ansible/runner/__init__.py&quot;, line 668, in _executor_internal
    inject = self.get_inject_vars(host)
  File &quot;/home/david/.pip/ansible/lib/ansible/runner/__init__.py&quot;, line 611, in get_inject_vars
    combined_cache = self.get_combined_cache()
  File &quot;/home/david/.pip/ansible/lib/ansible/runner/__init__.py&quot;, line 606, in get_combined_cache
    combined_cache = self.setup_cache.copy()
  File &quot;/home/david/.pip/ansible/lib/ansible/cache/__init__.py&quot;, line 54, in copy
    return dict([(k, v) for (k, v) in self.iteritems()])
  File &quot;/usr/lib/python2.7/_abcoll.py&quot;, line 406, in iteritems
    yield (key, self[key])
  File &quot;/home/david/.pip/ansible/lib/ansible/cache/__init__.py&quot;, line 35, in __getitem__
    return self._plugin.get(key)
  File &quot;/home/david/.pip/ansible/lib/ansible/cache/jsonfile.py&quot;, line 69, in get
    f.close()
UnboundLocalError: local variable 'f' referenced before assignment"><pre class="notranslate"><code class="notranslate">fatal: [my-host] =&gt; Traceback (most recent call last):
  File "/home/david/.pip/ansible/lib/ansible/runner/__init__.py", line 586, in _executor
    exec_rc = self._executor_internal(host, new_stdin)
  File "/home/david/.pip/ansible/lib/ansible/runner/__init__.py", line 668, in _executor_internal
    inject = self.get_inject_vars(host)
  File "/home/david/.pip/ansible/lib/ansible/runner/__init__.py", line 611, in get_inject_vars
    combined_cache = self.get_combined_cache()
  File "/home/david/.pip/ansible/lib/ansible/runner/__init__.py", line 606, in get_combined_cache
    combined_cache = self.setup_cache.copy()
  File "/home/david/.pip/ansible/lib/ansible/cache/__init__.py", line 54, in copy
    return dict([(k, v) for (k, v) in self.iteritems()])
  File "/usr/lib/python2.7/_abcoll.py", line 406, in iteritems
    yield (key, self[key])
  File "/home/david/.pip/ansible/lib/ansible/cache/__init__.py", line 35, in __getitem__
    return self._plugin.get(key)
  File "/home/david/.pip/ansible/lib/ansible/cache/jsonfile.py", line 69, in get
    f.close()
UnboundLocalError: local variable 'f' referenced before assignment
</code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">ec2_group</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.4.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/kclausen/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.12 (default, Nov  2 2017, 19:20:38) [GCC 4.8.5 20150623 (Red Hat 4.8.5-11)]
"><pre class="notranslate"><code class="notranslate">ansible 2.4.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/kclausen/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python2.7/site-packages/ansible
  executable location = /usr/local/bin/ansible
  python version = 2.7.12 (default, Nov  2 2017, 19:20:38) [GCC 4.8.5 20150623 (Red Hat 4.8.5-11)]

</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<p dir="auto">$ ansible-config dump --only-changed<br>
$</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>

<p dir="auto">n/a</p>
<h5 dir="auto">SUMMARY</h5>

<p dir="auto">I have a group_vars file that defines my VPC and when I try to create a new VPC it fails to create my edge security group with the correct permissions.</p>
<p dir="auto">It's supposed to create a group that gives public access to port 443 and port 80, but instead creates a security group with access to ALL ports!</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>


<p dir="auto">From group_vars/all</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="# VPC Security Groups list
vpc_security_group_all:
  - &quot;{{ vpc_security_group['public_edge_sg'] }}&quot;
# and a bunch more security groups

# VPC Security Groups definitions
vpc_security_group:
  public_edge_sg:
    - name: '{{ vpc_name }} - Public Edge SG'
      description: 'Security Group for {{ vpc_name }} Public Edge Loadbalancers'
      rules:
        - &quot;{{ vpc_sg_access_rule['all_tcp_443'] }}&quot;
        - &quot;{{ vpc_sg_access_rule['all_tcp_80'] }}&quot;

# VPC Security Group access rules
vpc_sg_access_rule:
# Full access
  all:
    cidr_ip: 0.0.0.0/0
    from_port: all
    proto: all
    to_port: all

# Public access port 443
  all_tcp_443:
    cidr_ip: 0.0.0.0/0
    from_port: 443
    proto: all
    to_port: 443

# Public access port 80
  all_tcp_80:
    cidr_ip: 0.0.0.0/0
    from_port: 80
    proto: all
    to_port: 80
"><pre class="notranslate"><code class="notranslate"># VPC Security Groups list
vpc_security_group_all:
  - "{{ vpc_security_group['public_edge_sg'] }}"
# and a bunch more security groups

# VPC Security Groups definitions
vpc_security_group:
  public_edge_sg:
    - name: '{{ vpc_name }} - Public Edge SG'
      description: 'Security Group for {{ vpc_name }} Public Edge Loadbalancers'
      rules:
        - "{{ vpc_sg_access_rule['all_tcp_443'] }}"
        - "{{ vpc_sg_access_rule['all_tcp_80'] }}"

# VPC Security Group access rules
vpc_sg_access_rule:
# Full access
  all:
    cidr_ip: 0.0.0.0/0
    from_port: all
    proto: all
    to_port: all

# Public access port 443
  all_tcp_443:
    cidr_ip: 0.0.0.0/0
    from_port: 443
    proto: all
    to_port: 443

# Public access port 80
  all_tcp_80:
    cidr_ip: 0.0.0.0/0
    from_port: 80
    proto: all
    to_port: 80

</code></pre></div>
<p dir="auto">From the playbook:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- name: Create Security Groups
  ec2_group:
    description: '{{ item.description }}'
    name: '{{ item.name }}'
    region: '{{ vpc_region }}'
    rules: '{{ item.rules }}'
    vpc_id: '{{ vpc_id }}'
  with_items: '{{ vpc_security_group_all }}'"><pre class="notranslate"><code class="notranslate">- name: Create Security Groups
  ec2_group:
    description: '{{ item.description }}'
    name: '{{ item.name }}'
    region: '{{ vpc_region }}'
    rules: '{{ item.rules }}'
    vpc_id: '{{ vpc_id }}'
  with_items: '{{ vpc_security_group_all }}'
</code></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<p dir="auto">A security group gets created with public access to port 80 and port 443 over TCP</p>
<h5 dir="auto">ACTUAL RESULTS</h5>

<p dir="auto">A security group gets created with public access to ALL ports, ALL protocols</p>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ClientError: An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule &quot;peer: 0.0.0.0/0, ALL, ALLOW&quot; already exists
failed: [localhost] (item={u'rules': [{u'to_port': 443, u'from_port': 443, u'cidr_ip': u'0.0.0.0/0', u'proto': u'all'}, {u'to_port': 80, u'from_port': 80, u'cidr_ip': u'0.0.0.0/0', u'proto': u'all'}], u'name': u'XXXXXXX  - Public Edge SG', u'description': u'Security Group for XXXXXXX  Public Edge Loadbalancers'}) =&gt; {&quot;changed&quot;: false, &quot;error&quot;: {&quot;code&quot;: &quot;InvalidPermission.Duplicate&quot;, &quot;message&quot;: &quot;the specified rule \&quot;peer: 0.0.0.0/0, ALL, ALLOW\&quot; already exists&quot;}, &quot;item&quot;: {&quot;description&quot;: &quot;Security Group for XXXXXXX  Public Edge Loadbalancers&quot;, &quot;name&quot;: &quot;XXXXXXX  - Public Edge SG&quot;, &quot;rules&quot;: [{&quot;cidr_ip&quot;: &quot;0.0.0.0/0&quot;, &quot;from_port&quot;: 443, &quot;proto&quot;: &quot;all&quot;, &quot;to_port&quot;: 443}, {&quot;cidr_ip&quot;: &quot;0.0.0.0/0&quot;, &quot;from_port&quot;: 80, &quot;proto&quot;: &quot;all&quot;, &quot;to_port&quot;: 80}]}, &quot;msg&quot;: &quot;Unable to authorize in for ip 0.0.0.0/0 security group 'XXXXXXX - Public Edge SG' - An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule \&quot;peer: 0.0.0.0/0, ALL, ALLOW\&quot; already exists&quot;, &quot;response_metadata&quot;: {&quot;http_headers&quot;: {&quot;connection&quot;: &quot;close&quot;, &quot;date&quot;: &quot;Tue, 06 Feb 2018 21:15:45 GMT&quot;, &quot;server&quot;: &quot;AmazonEC2&quot;, &quot;transfer-encoding&quot;: &quot;chunked&quot;}, &quot;http_status_code&quot;: 400, &quot;request_id&quot;: &quot;4cb58287-f6ee-43ee-bf8c-c17c3eb27294&quot;, &quot;retry_attempts&quot;: 0}}"><pre class="notranslate"><code class="notranslate">An exception occurred during task execution. To see the full traceback, use -vvv. The error was: ClientError: An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule "peer: 0.0.0.0/0, ALL, ALLOW" already exists
failed: [localhost] (item={u'rules': [{u'to_port': 443, u'from_port': 443, u'cidr_ip': u'0.0.0.0/0', u'proto': u'all'}, {u'to_port': 80, u'from_port': 80, u'cidr_ip': u'0.0.0.0/0', u'proto': u'all'}], u'name': u'XXXXXXX  - Public Edge SG', u'description': u'Security Group for XXXXXXX  Public Edge Loadbalancers'}) =&gt; {"changed": false, "error": {"code": "InvalidPermission.Duplicate", "message": "the specified rule \"peer: 0.0.0.0/0, ALL, ALLOW\" already exists"}, "item": {"description": "Security Group for XXXXXXX  Public Edge Loadbalancers", "name": "XXXXXXX  - Public Edge SG", "rules": [{"cidr_ip": "0.0.0.0/0", "from_port": 443, "proto": "all", "to_port": 443}, {"cidr_ip": "0.0.0.0/0", "from_port": 80, "proto": "all", "to_port": 80}]}, "msg": "Unable to authorize in for ip 0.0.0.0/0 security group 'XXXXXXX - Public Edge SG' - An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule \"peer: 0.0.0.0/0, ALL, ALLOW\" already exists", "response_metadata": {"http_headers": {"connection": "close", "date": "Tue, 06 Feb 2018 21:15:45 GMT", "server": "AmazonEC2", "transfer-encoding": "chunked"}, "http_status_code": 400, "request_id": "4cb58287-f6ee-43ee-bf8c-c17c3eb27294", "retry_attempts": 0}}
</code></pre></div>