<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">EC2_GROUP</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="  ansible 2.2.0.0
  config file = 
  configured module search path = Default w/o overrides
"><pre class="notranslate"><code class="notranslate">  ansible 2.2.0.0
  config file = 
  configured module search path = Default w/o overrides

</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<h5 dir="auto">OS / ENVIRONMENT</h5>

<p dir="auto">Amazon Linux 2016.09</p>
<h5 dir="auto">SUMMARY</h5>

<p dir="auto">"msg": "group referenced_group will be automatically created by rule {'to_port': 65535, 'from_port': 0, 'proto': 'tcp', 'group_name': 'referenced_group'} and no description was provided"</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>

<p dir="auto">pip install ansible<br>
attempt to apply group with a reference to another group</p>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="---
- name: new_group
  hosts: localhost
  gather_facts: no
  tasks:
  - name: new_group
    local_action:
      module: ec2_group
      name: new_group
      description: new security group for some service
      vpc_id: &quot;{{ vpc }}&quot;
      region: &quot;{{ region }}&quot;
      profile: &quot;{{ profile }}&quot;
      rules:
        - proto: tcp
          from_port: 0
          to_port: 65535
          group_name: referenced_group

        - proto: tcp
          from_port: 22
          to_port: 22
          cidr_ip:  &quot;{{ access_cidr }}&quot;

"><pre class="notranslate"><code class="notranslate">---
- name: new_group
  hosts: localhost
  gather_facts: no
  tasks:
  - name: new_group
    local_action:
      module: ec2_group
      name: new_group
      description: new security group for some service
      vpc_id: "{{ vpc }}"
      region: "{{ region }}"
      profile: "{{ profile }}"
      rules:
        - proto: tcp
          from_port: 0
          to_port: 65535
          group_name: referenced_group

        - proto: tcp
          from_port: 22
          to_port: 22
          cidr_ip:  "{{ access_cidr }}"


</code></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<p dir="auto">Application of security group(s)</p>
<h5 dir="auto">ACTUAL RESULTS</h5>

<p dir="auto">fatal: [localhost -&gt; localhost]: FAILED! =&gt; {<br>
"changed": false,<br>
"failed": true,</p>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content=" &quot;msg&quot;: &quot;group referenced_group will be automatically created by rule {'to_port': 65535, 'from_port': 0, 'proto': 'tcp', 'group_name': 'referenced_group'} and no description was provided&quot;"><pre class="notranslate"><code class="notranslate"> "msg": "group referenced_group will be automatically created by rule {'to_port': 65535, 'from_port': 0, 'proto': 'tcp', 'group_name': 'referenced_group'} and no description was provided"
</code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>

<p dir="auto">ec2_group</p>
<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.2.1.0
  config file = 
  configured module search path = Default w/o overrides"><pre class="notranslate"><code class="notranslate">ansible 2.2.1.0
  config file = 
  configured module search path = Default w/o overrides
</code></pre></div>
<p dir="auto">install: sudo pip install -U git+<a href="https://github.com/ansible/ansible.git@v2.2.1.0-0.2.rc2">https://github.com/ansible/ansible.git@v2.2.1.0-0.2.rc2</a> --upgrade --ignore-installed six</p>
<h5 dir="auto">CONFIGURATION</h5>

<p dir="auto">default ansible.cfg</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>

<p dir="auto">OS X El Capitan 10.11.6<br>
Multi VPC AWS environment.  Peers between VPC's w/appropriate routing between them</p>
<h5 dir="auto">SUMMARY</h5>

<p dir="auto">ec2_group does not allow group_name to use groups via group name from other peered VPC's.  This worked in v1.9.6 and v2.0.2.  It appears to be due to some additional conditions that were added on 7/27/16.  If I revert this change, it works as expected.</p>
<p dir="auto"><a class="commit-link" data-hovercard-type="commit" data-hovercard-url="https://github.com/ansible/ansible/commit/04199140c5f089db8215aee4842d5987cf12e28d/hovercard" href="https://github.com/ansible/ansible/commit/04199140c5f089db8215aee4842d5987cf12e28d"><tt>0419914</tt></a></p>
<p dir="auto">Using group_id with the name of the security group in a different VPC works but is not idempotent.  It will create the rule if it's new but will fail if it already exists.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>

<p dir="auto">Attempt to use a AWS security group name from another VPC with required peering present using group_name:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- name: Provision Security Groups
  ec2_group:
    name: MyGroup
    description: MyDesc
    region: us-east-1
    vpc_id: vpc-xxxxxxxx
    rules:
       - proto: tcp
          from_port: 22
          to_port: 22
          group_name: &lt;Other_VPC_SG_NAME&gt;"><pre class="notranslate"><code class="notranslate">- name: Provision Security Groups
  ec2_group:
    name: MyGroup
    description: MyDesc
    region: us-east-1
    vpc_id: vpc-xxxxxxxx
    rules:
       - proto: tcp
          from_port: 22
          to_port: 22
          group_name: &lt;Other_VPC_SG_NAME&gt;
</code></pre></div>
<p dir="auto">Attempt to use a AWS security group name from another VPC with required peering present using group_id:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- name: Provision Security Groups
  ec2_group:
    name: MyGroup
    description: MyDesc
    region: us-east-1
    vpc_id: vpc-xxxxxxxx
    rules:
       - proto: tcp
          from_port: 22
          to_port: 22
          group_id: &lt;Other_VPC_SG_NAME&gt;"><pre class="notranslate"><code class="notranslate">- name: Provision Security Groups
  ec2_group:
    name: MyGroup
    description: MyDesc
    region: us-east-1
    vpc_id: vpc-xxxxxxxx
    rules:
       - proto: tcp
          from_port: 22
          to_port: 22
          group_id: &lt;Other_VPC_SG_NAME&gt;
</code></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>

<p dir="auto">Translate group name to group ID (sg-xxxxxxxx) and update rule with the security group ID of the other VPC's security group.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>

<p dir="auto">The group in the peered VPC is not found and an attempt to create a new group in the current VPC is executed.  In my case, this fails due to "no description"</p>

<p dir="auto">Message using group_name with security group name from a different VPC</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="&quot;msg&quot;: &quot;group &lt;PeeredVPCGroupName&gt; will be automatically created by rule {'to_port': 22, 'from_port': 22, 'group_name': '&lt;PeeredVPCGroupName&gt;', 'proto': 'tcp'} and no description was provided&quot;"><pre class="notranslate"><code class="notranslate">"msg": "group &lt;PeeredVPCGroupName&gt; will be automatically created by rule {'to_port': 22, 'from_port': 22, 'group_name': '&lt;PeeredVPCGroupName&gt;', 'proto': 'tcp'} and no description was provided"
</code></pre></div>
<p dir="auto">Message using group_id with security group name from a different VPC if the rule exists.  If the rule does not exist, it is added as expected.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="    &quot;module_stderr&quot;: &quot;Traceback (most recent call last):\n  File \&quot;/var/folders/t8/vdrxm90s1ps41pghp7wxn8n80000gp/T/ansible_pJu0pZ/ansible_module_ec2_group.py\&quot;, line 479, in &lt;module&gt;\n    main()\n  File \&quot;/var/folders/t8/vdrxm90s1ps41pghp7wxn8n80000gp/T/ansible_pJu0pZ/ansible_module_ec2_group.py\&quot;, line 374, in main\n    group.authorize(rule['proto'], rule['from_port'], rule['to_port'], thisip, grantGroup)\n  File \&quot;/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/ec2/securitygroup.py\&quot;, line 203, in authorize\n    dry_run=dry_run)\n  File \&quot;/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/ec2/connection.py\&quot;, line 3191, in authorize_security_group\n    params, verb='POST')\n  File \&quot;/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/connection.py\&quot;, line 1227, in get_status\n    raise self.ResponseError(response.status, response.reason, body)\nboto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request\n&lt;?xml version=\&quot;1.0\&quot; encoding=\&quot;UTF-8\&quot;?&gt;\n&lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidPermission.Duplicate&lt;/Code&gt;&lt;Message&gt;the specified rule \&quot;peer: sg-xxxxxxxx, TCP, from port: 22, to port: 22, ALLOW\&quot; already exists&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;b9ec5eee-4a86-49d7-90b8-86bfbf2ba21b&lt;/RequestID&gt;&lt;/Response&gt;\n&quot;, 
    &quot;module_stdout&quot;: &quot;&quot;, 
    &quot;msg&quot;: &quot;MODULE FAILURE&quot;"><pre class="notranslate"><code class="notranslate">    "module_stderr": "Traceback (most recent call last):\n  File \"/var/folders/t8/vdrxm90s1ps41pghp7wxn8n80000gp/T/ansible_pJu0pZ/ansible_module_ec2_group.py\", line 479, in &lt;module&gt;\n    main()\n  File \"/var/folders/t8/vdrxm90s1ps41pghp7wxn8n80000gp/T/ansible_pJu0pZ/ansible_module_ec2_group.py\", line 374, in main\n    group.authorize(rule['proto'], rule['from_port'], rule['to_port'], thisip, grantGroup)\n  File \"/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/ec2/securitygroup.py\", line 203, in authorize\n    dry_run=dry_run)\n  File \"/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/ec2/connection.py\", line 3191, in authorize_security_group\n    params, verb='POST')\n  File \"/Library/Python/2.7/site-packages/boto-2.38.0-py2.7.egg/boto/connection.py\", line 1227, in get_status\n    raise self.ResponseError(response.status, response.reason, body)\nboto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request\n&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt;\n&lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidPermission.Duplicate&lt;/Code&gt;&lt;Message&gt;the specified rule \"peer: sg-xxxxxxxx, TCP, from port: 22, to port: 22, ALLOW\" already exists&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;b9ec5eee-4a86-49d7-90b8-86bfbf2ba21b&lt;/RequestID&gt;&lt;/Response&gt;\n", 
    "module_stdout": "", 
    "msg": "MODULE FAILURE"
</code></pre></div>