<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.1.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides"><pre class="notranslate"><code class="notranslate">ansible 2.1.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = Default w/o overrides
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">No changes to default ansible.cfg</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">Ubuntu</p>
<p dir="auto">Directory Structure:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="devops
  ansible
    farscape
      group_vars
        all
        qa
        qa-ui
      inventories
        ec2.ini
        ec2.py
        qa

security
  keys
    platform
      qa
        key.pem

qa-ui
  ansible
    site.yml
    roles
      qa-ui"><pre class="notranslate"><code class="notranslate">devops
  ansible
    farscape
      group_vars
        all
        qa
        qa-ui
      inventories
        ec2.ini
        ec2.py
        qa

security
  keys
    platform
      qa
        key.pem

qa-ui
  ansible
    site.yml
    roles
      qa-ui
</code></pre></div>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Ansible can't connect to host after upgrading from 2.1.0.0 to 2.1.2.0.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="site.yml:

- name: Test Ping
  hosts: &quot;{{ hosts }}&quot;
  gather_facts: no
  tags: test
  tasks:
    - name: Test Ping
      ping:

qa group var file:

ansible_ssh_user: ubuntu
ansible_ssh_private_key_file: ../../../security/keys/platform/qa/key.pem


Executed from the devops -&gt; ansible -&gt; farscape directory (see directory structure above):

ansible-playbook -i inventories/ ../../../qa-ui/ansible/site.yml -t test -e &quot;hosts=qa-ui&quot;"><pre class="notranslate"><code class="notranslate">site.yml:

- name: Test Ping
  hosts: "{{ hosts }}"
  gather_facts: no
  tags: test
  tasks:
    - name: Test Ping
      ping:

qa group var file:

ansible_ssh_user: ubuntu
ansible_ssh_private_key_file: ../../../security/keys/platform/qa/key.pem


Executed from the devops -&gt; ansible -&gt; farscape directory (see directory structure above):

ansible-playbook -i inventories/ ../../../qa-ui/ansible/site.yml -t test -e "hosts=qa-ui"
</code></pre></div>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">Successful connection and ping result.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Using /etc/ansible/ansible.cfg as config file
Loaded callback default of type stdout, v2.0

PLAYBOOK: site.yml *************************************************
2 plays in ../../../qa-ui/ansible/site.yml

PLAY [Test Ping] ***************************************************************

TASK [Test Ping] ***************************************************************
task path: /opt/teamcity-agent/work/56ef8995252d7315/qa-ui/ansible/site.yml:6
&lt;10.2.10.13&gt; ESTABLISH SSH CONNECTION FOR USER: None
&lt;10.2.10.12&gt; ESTABLISH SSH CONNECTION FOR USER: None
&lt;10.2.10.13&gt; SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r 10.2.10.13 '/bin/sh -c '&quot;'&quot;'( umask 77 &amp;&amp; mkdir -p &quot;` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-100845165082436 `&quot; &amp;&amp; echo ansible-tmp-1477325466.67-100845165082436=&quot;` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-100845165082436 `&quot; ) &amp;&amp; sleep 0'&quot;'&quot;''
&lt;10.2.10.12&gt; SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r 10.2.10.12 '/bin/sh -c '&quot;'&quot;'( umask 77 &amp;&amp; mkdir -p &quot;` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-37577927945882 `&quot; &amp;&amp; echo ansible-tmp-1477325466.67-37577927945882=&quot;` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-37577927945882 `&quot; ) &amp;&amp; sleep 0'&quot;'&quot;''
fatal: [10.2.10.13]: UNREACHABLE! =&gt; {&quot;changed&quot;: false, &quot;msg&quot;: &quot;Failed to connect to the host via ssh.&quot;, &quot;unreachable&quot;: true}
fatal: [10.2.10.12]: UNREACHABLE! =&gt; {&quot;changed&quot;: false, &quot;msg&quot;: &quot;Failed to connect to the host via ssh.&quot;, &quot;unreachable&quot;: true}


PLAY RECAP *********************************************************************
10.2.10.12                 : ok=0    changed=0    unreachable=1    failed=0   
10.2.10.13                 : ok=0    changed=0    unreachable=1    failed=0 "><pre class="notranslate"><code class="notranslate">Using /etc/ansible/ansible.cfg as config file
Loaded callback default of type stdout, v2.0

PLAYBOOK: site.yml *************************************************
2 plays in ../../../qa-ui/ansible/site.yml

PLAY [Test Ping] ***************************************************************

TASK [Test Ping] ***************************************************************
task path: /opt/teamcity-agent/work/56ef8995252d7315/qa-ui/ansible/site.yml:6
&lt;10.2.10.13&gt; ESTABLISH SSH CONNECTION FOR USER: None
&lt;10.2.10.12&gt; ESTABLISH SSH CONNECTION FOR USER: None
&lt;10.2.10.13&gt; SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r 10.2.10.13 '/bin/sh -c '"'"'( umask 77 &amp;&amp; mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-100845165082436 `" &amp;&amp; echo ansible-tmp-1477325466.67-100845165082436="` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-100845165082436 `" ) &amp;&amp; sleep 0'"'"''
&lt;10.2.10.12&gt; SSH: EXEC ssh -C -vvv -o ControlMaster=auto -o ControlPersist=60s -o KbdInteractiveAuthentication=no -o PreferredAuthentications=gssapi-with-mic,gssapi-keyex,hostbased,publickey -o PasswordAuthentication=no -o ConnectTimeout=10 -o ControlPath=/home/ubuntu/.ansible/cp/ansible-ssh-%h-%p-%r 10.2.10.12 '/bin/sh -c '"'"'( umask 77 &amp;&amp; mkdir -p "` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-37577927945882 `" &amp;&amp; echo ansible-tmp-1477325466.67-37577927945882="` echo $HOME/.ansible/tmp/ansible-tmp-1477325466.67-37577927945882 `" ) &amp;&amp; sleep 0'"'"''
fatal: [10.2.10.13]: UNREACHABLE! =&gt; {"changed": false, "msg": "Failed to connect to the host via ssh.", "unreachable": true}
fatal: [10.2.10.12]: UNREACHABLE! =&gt; {"changed": false, "msg": "Failed to connect to the host via ssh.", "unreachable": true}


PLAY RECAP *********************************************************************
10.2.10.12                 : ok=0    changed=0    unreachable=1    failed=0   
10.2.10.13                 : ok=0    changed=0    unreachable=1    failed=0 
</code></pre></div>
<p dir="auto">This error happens across all our ansible tasks after upgrading from 2.1.0.0 to 2.1.2.0.</p>
<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">ec2_group</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.3.0.0
  config file = /home/con5cience/git/Ansible/ansible.cfg
  configured module search path = [u'/usr/share/ansible', u'library']
  python version = 2.7.13 (default, Jan 12 2017, 17:59:37) [GCC 6.3.1 20161221 (Red Hat 6.3.1-1)]"><pre class="notranslate"><code class="notranslate">ansible 2.3.0.0
  config file = /home/con5cience/git/Ansible/ansible.cfg
  configured module search path = [u'/usr/share/ansible', u'library']
  python version = 2.7.13 (default, Jan 12 2017, 17:59:37) [GCC 6.3.1 20161221 (Red Hat 6.3.1-1)]
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="[defaults]
inventory=inventory
library=/usr/share/ansible:library
roles_path=roles
vault_password_file = vault_pass
forks=20
ask_sudo_pass=yes
nocows=0
cow_selection = random
host_key_checking = False

[ssh_connection]
pipelining=True
ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=30m
control_path = ~/.ssh/ansible-%%r@%%h:%%p"><pre class="notranslate"><code class="notranslate">[defaults]
inventory=inventory
library=/usr/share/ansible:library
roles_path=roles
vault_password_file = vault_pass
forks=20
ask_sudo_pass=yes
nocows=0
cow_selection = random
host_key_checking = False

[ssh_connection]
pipelining=True
ssh_args = -o ForwardAgent=yes -o ControlMaster=auto -o ControlPersist=30m
control_path = ~/.ssh/ansible-%%r@%%h:%%p
</code></pre></div>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">From: Fedora 25<br>
To: Amazon EC2 API</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Managing the rules of EC2 security groups using the <code class="notranslate">ec2_group</code> module is not idempotent.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<ol dir="auto">
<li>Use Ansible to configure a security group and add rules to the group.</li>
<li>Run Ansible again.</li>
</ol>

<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="      ec2_group:
        name: &quot;{{ security_group_name|default( inventory_hostname ~ '-' ~ env ~ '-security-group' ) }}&quot;
        description: &quot;{{ security_group_name|default( inventory_hostname ~ '-' ~ env ~ 'Security Group' ) }}&quot;
        vpc_id: &quot;{{ ec2_vpc_id }}&quot;
        region: &quot;{{ ec2_region }}&quot;
        rules: &quot;{{ common_rules_ingress + rules_ingress }}&quot;
        rules_egress: &quot;{{ common_rules_egress + rules_egress }}&quot;
      delegate_to: localhost"><pre class="notranslate">      <span class="pl-ent">ec2_group</span>:
        <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ security_group_name|default( inventory_hostname ~ '-' ~ env ~ '-security-group' ) }}<span class="pl-pds">"</span></span>
        <span class="pl-ent">description</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ security_group_name|default( inventory_hostname ~ '-' ~ env ~ 'Security Group' ) }}<span class="pl-pds">"</span></span>
        <span class="pl-ent">vpc_id</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ ec2_vpc_id }}<span class="pl-pds">"</span></span>
        <span class="pl-ent">region</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ ec2_region }}<span class="pl-pds">"</span></span>
        <span class="pl-ent">rules</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ common_rules_ingress + rules_ingress }}<span class="pl-pds">"</span></span>
        <span class="pl-ent">rules_egress</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ common_rules_egress + rules_egress }}<span class="pl-pds">"</span></span>
      <span class="pl-ent">delegate_to</span>: <span class="pl-s">localhost</span></pre></div>
<p dir="auto">Where <code class="notranslate">common_rules_ingress</code>, <code class="notranslate">common_rules_egress</code>, <code class="notranslate">rules_ingress</code>, and <code class="notranslate">rules_egress</code> are lists of port rules in the style of:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="  - proto: tcp
    from_port: 443
    to_port: 443
    cidr_ip: 0.0.0.0/0

  - proto: tcp
    from_port: 80
    to_port: 80
    cidr_ip: 0.0.0.0/0"><pre class="notranslate">  - <span class="pl-ent">proto</span>: <span class="pl-s">tcp</span>
    <span class="pl-ent">from_port</span>: <span class="pl-c1">443</span>
    <span class="pl-ent">to_port</span>: <span class="pl-c1">443</span>
    <span class="pl-ent">cidr_ip</span>: <span class="pl-s">0.0.0.0/0</span>

  - <span class="pl-ent">proto</span>: <span class="pl-s">tcp</span>
    <span class="pl-ent">from_port</span>: <span class="pl-c1">80</span>
    <span class="pl-ent">to_port</span>: <span class="pl-c1">80</span>
    <span class="pl-ent">cidr_ip</span>: <span class="pl-s">0.0.0.0/0</span></pre></div>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">Task exits with 0 and playbook continues if the rule already exists and no changes are made.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">Task exits with 1 (or 2, not entirely sure) and playbook run immediately bails when a rule already exists and no changes are made.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="The full traceback is:
Traceback (most recent call last):
  File &quot;/tmp/ansible_em0SmM/ansible_module_ec2_group.py&quot;, line 487, in &lt;module&gt;
    main()
  File &quot;/tmp/ansible_em0SmM/ansible_module_ec2_group.py&quot;, line 439, in main
    cidr_ip=thisip)
  File &quot;/usr/lib/python2.7/site-packages/boto/ec2/connection.py&quot;, line 3245, in authorize_security_group_egress
    params, verb='POST')
  File &quot;/usr/lib/python2.7/site-packages/boto/connection.py&quot;, line 1227, in get_status
    raise self.ResponseError(response.status, response.reason, body)
boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request
&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
&lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidPermission.Duplicate&lt;/Code&gt;&lt;Message&gt;the specified rule &quot;peer: 0.0.0.0/0, TCP, from port: 443, to port: 443, ALLOW&quot; already exists&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;871be7ab-957c-4c41-8982-706e7a5dc64c&lt;/RequestID&gt;&lt;/Response&gt;

fatal: [remotehost -&gt; localhost]: FAILED! =&gt; {
    &quot;changed&quot;: false, 
    &quot;failed&quot;: true, 
    &quot;module_stderr&quot;: &quot;Traceback (most recent call last):\n  File \&quot;/tmp/ansible_em0SmM/ansible_module_ec2_group.py\&quot;, line 487, in &lt;module&gt;\n    main()\n  File \&quot;/tmp/ansible_em0SmM/ansible_module_ec2_group.py\&quot;, line 439, in main\n    cidr_ip=thisip)\n  File \&quot;/usr/lib/python2.7/site-packages/boto/ec2/connection.py\&quot;, line 3245, in authorize_security_group_egress\n    params, verb='POST')\n  File \&quot;/usr/lib/python2.7/site-packages/boto/connection.py\&quot;, line 1227, in get_status\n    raise self.ResponseError(response.status, response.reason, body)\nboto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request\n&lt;?xml version=\&quot;1.0\&quot; encoding=\&quot;UTF-8\&quot;?&gt;\n&lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidPermission.Duplicate&lt;/Code&gt;&lt;Message&gt;the specified rule \&quot;peer: 0.0.0.0/0, TCP, from port: 443, to port: 443, ALLOW\&quot; already exists&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;871be7ab-957c-4c41-8982-706e7a5dc64c&lt;/RequestID&gt;&lt;/Response&gt;\n&quot;, 
    &quot;module_stdout&quot;: &quot;&quot;, 
    &quot;msg&quot;: &quot;MODULE FAILURE&quot;, 
    &quot;rc&quot;: 1
}"><pre class="notranslate"><code class="notranslate">The full traceback is:
Traceback (most recent call last):
  File "/tmp/ansible_em0SmM/ansible_module_ec2_group.py", line 487, in &lt;module&gt;
    main()
  File "/tmp/ansible_em0SmM/ansible_module_ec2_group.py", line 439, in main
    cidr_ip=thisip)
  File "/usr/lib/python2.7/site-packages/boto/ec2/connection.py", line 3245, in authorize_security_group_egress
    params, verb='POST')
  File "/usr/lib/python2.7/site-packages/boto/connection.py", line 1227, in get_status
    raise self.ResponseError(response.status, response.reason, body)
boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request
&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidPermission.Duplicate&lt;/Code&gt;&lt;Message&gt;the specified rule "peer: 0.0.0.0/0, TCP, from port: 443, to port: 443, ALLOW" already exists&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;871be7ab-957c-4c41-8982-706e7a5dc64c&lt;/RequestID&gt;&lt;/Response&gt;

fatal: [remotehost -&gt; localhost]: FAILED! =&gt; {
    "changed": false, 
    "failed": true, 
    "module_stderr": "Traceback (most recent call last):\n  File \"/tmp/ansible_em0SmM/ansible_module_ec2_group.py\", line 487, in &lt;module&gt;\n    main()\n  File \"/tmp/ansible_em0SmM/ansible_module_ec2_group.py\", line 439, in main\n    cidr_ip=thisip)\n  File \"/usr/lib/python2.7/site-packages/boto/ec2/connection.py\", line 3245, in authorize_security_group_egress\n    params, verb='POST')\n  File \"/usr/lib/python2.7/site-packages/boto/connection.py\", line 1227, in get_status\n    raise self.ResponseError(response.status, response.reason, body)\nboto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request\n&lt;?xml version=\"1.0\" encoding=\"UTF-8\"?&gt;\n&lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidPermission.Duplicate&lt;/Code&gt;&lt;Message&gt;the specified rule \"peer: 0.0.0.0/0, TCP, from port: 443, to port: 443, ALLOW\" already exists&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;871be7ab-957c-4c41-8982-706e7a5dc64c&lt;/RequestID&gt;&lt;/Response&gt;\n", 
    "module_stdout": "", 
    "msg": "MODULE FAILURE", 
    "rc": 1
}
</code></pre></div>
<p dir="auto">See also:<br>
<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="25713612" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible/issues/5643" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible/issues/5643/hovercard" href="https://github.com/ansible/ansible/issues/5643">#5643</a> (arbitrarily closed)<br>
<a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="119304341" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-core/issues/2576" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-core/issues/2576/hovercard" href="https://github.com/ansible/ansible-modules-core/issues/2576">ansible/ansible-modules-core#2576</a> (open but in locked repo)</p>