<h5 dir="auto">Issue Type:</h5>
<p dir="auto">Bug Report</p>
<h5 dir="auto">Ansible Version:</h5>
<p dir="auto">1.6.2</p>
<h5 dir="auto">Environment:</h5>
<p dir="auto">Ansible running on Fedora 20. EC2 API is the target.</p>
<h5 dir="auto">Summary:</h5>
<p dir="auto">If you have a wide open security rule for a group (-1 for proto, from_port and to_port with a cidr of 0.0.0.0/0) it can only be run once. Subsequent run will fail.</p>
<h5 dir="auto">Steps To Reproduce:</h5>
<p dir="auto">I have the following as part of a playbook that makes sure we have the<br>
appropriate security groups setup and all of them work just fine<br>
except this one:</p>
<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="- name: Create wide-open testing security group
  local_action:
    module: ec2_group
    name: 'WIDE OPEN'
    description: 'WIDE OPEN for TESTING ONLY!'
    vpc_id: &quot;{{ vpc_id }}&quot;
    region: &quot;{{ aws_region }}&quot;
    state: present
    rules:
      # everything from anywhere
      - proto: -1
        from_port: -1
        to_port: -1
        cidr_ip: 0.0.0.0/0"><pre class="notranslate">- <span class="pl-ent">name</span>: <span class="pl-s">Create wide-open testing security group</span>
  <span class="pl-ent">local_action</span>:
    <span class="pl-ent">module</span>: <span class="pl-s">ec2_group</span>
    <span class="pl-ent">name</span>: <span class="pl-s"><span class="pl-pds">'</span>WIDE OPEN<span class="pl-pds">'</span></span>
    <span class="pl-ent">description</span>: <span class="pl-s"><span class="pl-pds">'</span>WIDE OPEN for TESTING ONLY!<span class="pl-pds">'</span></span>
    <span class="pl-ent">vpc_id</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ vpc_id }}<span class="pl-pds">"</span></span>
    <span class="pl-ent">region</span>: <span class="pl-s"><span class="pl-pds">"</span>{{ aws_region }}<span class="pl-pds">"</span></span>
    <span class="pl-ent">state</span>: <span class="pl-s">present</span>
    <span class="pl-ent">rules</span>:
      <span class="pl-c"><span class="pl-c">#</span> everything from anywhere</span>
      - <span class="pl-ent">proto</span>: <span class="pl-c1">-1</span>
        <span class="pl-ent">from_port</span>: <span class="pl-c1">-1</span>
        <span class="pl-ent">to_port</span>: <span class="pl-c1">-1</span>
        <span class="pl-ent">cidr_ip</span>: <span class="pl-s">0.0.0.0/0</span></pre></div>
<p dir="auto">The first time I run the playbook with this task it works just fine.<br>
But every time it's run after that it fails. Other rules in other ec2_group tasks in this same playbook execute as expected when run multiple times.</p>
<h5 dir="auto">Expected Results:</h5>
<p dir="auto">It should recognize that the rule already exists like it does every other rule and just skip it.</p>
<h5 dir="auto">Actual Results:</h5>
<p dir="auto">It fails with the following error:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="failed: [localhost] =&gt; {&quot;failed&quot;: true, &quot;parsed&quot;: false}
invalid output was: Traceback (most recent call last):
  File &quot;/home/mpeters/.ansible/tmp/ansible-tmp-1403183990.17-2723736991339/ec2_group&quot;, line 1754, in &lt;module&gt;
    main()
  File &quot;/home/mpeters/.ansible/tmp/ansible-tmp-1403183990.17-2723736991339/ec2_group&quot;, line 268, in main
    group.authorize(rule['proto'], rule['from_port'], rule['to_port'], ip, grantGroup)
  File &quot;/usr/lib/python2.7/site-packages/boto/ec2/securitygroup.py&quot;, line 204, in authorize
    dry_run=dry_run)
  File &quot;/usr/lib/python2.7/site-packages/boto/ec2/connection.py&quot;, line 3144, in authorize_security_group
    params, verb='POST')
   File &quot;/usr/lib/python2.7/site-packages/boto/connection.py&quot;, line 1196, in get_status
    raise self.ResponseError(response.status, response.reason, body)"><pre class="notranslate"><code class="notranslate">failed: [localhost] =&gt; {"failed": true, "parsed": false}
invalid output was: Traceback (most recent call last):
  File "/home/mpeters/.ansible/tmp/ansible-tmp-1403183990.17-2723736991339/ec2_group", line 1754, in &lt;module&gt;
    main()
  File "/home/mpeters/.ansible/tmp/ansible-tmp-1403183990.17-2723736991339/ec2_group", line 268, in main
    group.authorize(rule['proto'], rule['from_port'], rule['to_port'], ip, grantGroup)
  File "/usr/lib/python2.7/site-packages/boto/ec2/securitygroup.py", line 204, in authorize
    dry_run=dry_run)
  File "/usr/lib/python2.7/site-packages/boto/ec2/connection.py", line 3144, in authorize_security_group
    params, verb='POST')
   File "/usr/lib/python2.7/site-packages/boto/connection.py", line 1196, in get_status
    raise self.ResponseError(response.status, response.reason, body)
</code></pre></div>
<p dir="auto">boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request<br>
<br>
<code class="notranslate">InvalidPermission.Duplicate</code>the specified rule "peer: 0.0.0.0/0, ALL, ALLOW" already exists40ddc890-fa3a-4528-9cf8-10cf47f3e4d6</p>
<p dir="auto">From <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/rlpowell/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/rlpowell">@rlpowell</a> on 2015-04-03T18:39:16Z<br>
I apologize that I don't have the background with Ansible or Python to give any useful debugging info here, but:</p>
<p dir="auto">Trying to run a shell command and get the output presented to me.  This<br>
version:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- name: run the script the rails way
  register: scriptrun
  shell: 'uname -a'

- name: get the result back
  fetch: src=/tmp/mismatch_visne.csv dest=/tmp/mismatch_visne/

# Print the shell task's stdout.
- debug: msg={{ scriptrun.stdout }}"><pre class="notranslate"><code class="notranslate">- name: run the script the rails way
  register: scriptrun
  shell: 'uname -a'

- name: get the result back
  fetch: src=/tmp/mismatch_visne.csv dest=/tmp/mismatch_visne/

# Print the shell task's stdout.
- debug: msg={{ scriptrun.stdout }}
</code></pre></div>
<p dir="auto">Works fine:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="TASK: [run the script the rails way] ******************************************
changed: [perf-sedna_tomcat-1-tomcat]
changed: [qa-rhea_tomcat-1-tomcat]
changed: [qa-ariel_tomcat-1-tomcat]
changed: [perf-dione_tomcat-1-tomcat]

TASK: [get the result back] ***************************************************
ok: [perf-sedna_tomcat-1-tomcat]
ok: [qa-rhea_tomcat-1-tomcat]
ok: [qa-ariel_tomcat-1-tomcat]
ok: [perf-dione_tomcat-1-tomcat]

TASK: [debug msg={{ scriptrun.stdout }}] **************************************
ok: [perf-sedna_tomcat-1-tomcat] =&gt; {
    &quot;msg&quot;: &quot;Linux&quot;
}
ok: [qa-ariel_tomcat-1-tomcat] =&gt; {
    &quot;msg&quot;: &quot;Linux&quot;
}
ok: [qa-rhea_tomcat-1-tomcat] =&gt; {
    &quot;msg&quot;: &quot;Linux&quot;
}
ok: [perf-dione_tomcat-1-tomcat] =&gt; {
    &quot;msg&quot;: &quot;Linux&quot;
}

PLAY RECAP ********************************************************************
           to retry, use: --limit @/home/rlpowell/cyt_2407.yaml.retry

perf-dione_tomcat-1-tomcat : ok=6    changed=1    unreachable=0    failed=0
perf-sedna_tomcat-1-tomcat : ok=6    changed=1    unreachable=0    failed=0
qa-ariel_tomcat-1-tomcat   : ok=6    changed=1    unreachable=0    failed=0
qa-janus_tomcat-1-tomcat   : ok=0    changed=0    unreachable=1    failed=0
qa-rhea_tomcat-1-tomcat    : ok=6    changed=1    unreachable=0    failed=0"><pre class="notranslate"><code class="notranslate">TASK: [run the script the rails way] ******************************************
changed: [perf-sedna_tomcat-1-tomcat]
changed: [qa-rhea_tomcat-1-tomcat]
changed: [qa-ariel_tomcat-1-tomcat]
changed: [perf-dione_tomcat-1-tomcat]

TASK: [get the result back] ***************************************************
ok: [perf-sedna_tomcat-1-tomcat]
ok: [qa-rhea_tomcat-1-tomcat]
ok: [qa-ariel_tomcat-1-tomcat]
ok: [perf-dione_tomcat-1-tomcat]

TASK: [debug msg={{ scriptrun.stdout }}] **************************************
ok: [perf-sedna_tomcat-1-tomcat] =&gt; {
    "msg": "Linux"
}
ok: [qa-ariel_tomcat-1-tomcat] =&gt; {
    "msg": "Linux"
}
ok: [qa-rhea_tomcat-1-tomcat] =&gt; {
    "msg": "Linux"
}
ok: [perf-dione_tomcat-1-tomcat] =&gt; {
    "msg": "Linux"
}

PLAY RECAP ********************************************************************
           to retry, use: --limit @/home/rlpowell/cyt_2407.yaml.retry

perf-dione_tomcat-1-tomcat : ok=6    changed=1    unreachable=0    failed=0
perf-sedna_tomcat-1-tomcat : ok=6    changed=1    unreachable=0    failed=0
qa-ariel_tomcat-1-tomcat   : ok=6    changed=1    unreachable=0    failed=0
qa-janus_tomcat-1-tomcat   : ok=0    changed=0    unreachable=1    failed=0
qa-rhea_tomcat-1-tomcat    : ok=6    changed=1    unreachable=0    failed=0
</code></pre></div>
<p dir="auto">OTOH, this one (the only change is to the "shell:" param):</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- name: run the script the rails way
  register: scriptrun
  shell: '/usr/local/bin/cytobank_rails runner /tmp/cyt_2407.rb'

- name: get the result back
  fetch: src=/tmp/mismatch_visne.csv dest=/tmp/mismatch_visne/

# Print the shell task's stdout.
- debug: msg={{ scriptrun.stdout }}"><pre class="notranslate"><code class="notranslate">- name: run the script the rails way
  register: scriptrun
  shell: '/usr/local/bin/cytobank_rails runner /tmp/cyt_2407.rb'

- name: get the result back
  fetch: src=/tmp/mismatch_visne.csv dest=/tmp/mismatch_visne/

# Print the shell task's stdout.
- debug: msg={{ scriptrun.stdout }}
</code></pre></div>
<p dir="auto">Gives this output:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="TASK: [run the script the rails way] ******************************************
changed: [perf-sedna_tomcat-1-tomcat]
changed: [qa-ariel_tomcat-1-tomcat]
changed: [perf-dione_tomcat-1-tomcat]
changed: [qa-rhea_tomcat-1-tomcat]

TASK: [get the result back] ***************************************************
ok: [qa-rhea_tomcat-1-tomcat]
ok: [qa-ariel_tomcat-1-tomcat]
ok: [perf-sedna_tomcat-1-tomcat]
ok: [perf-dione_tomcat-1-tomcat]

TASK: [debug msg={{ scriptrun.stdout }}] **************************************
fatal: [perf-dione_tomcat-1-tomcat] =&gt; a duplicate parameter was found in the argument string ()
fatal: [qa-ariel_tomcat-1-tomcat] =&gt; a duplicate parameter was found in the argument string ()
fatal: [perf-sedna_tomcat-1-tomcat] =&gt; a duplicate parameter was found in the argument string ()
fatal: [qa-rhea_tomcat-1-tomcat] =&gt; a duplicate parameter was found in the argument string ()

FATAL: all hosts have already failed -- aborting

PLAY RECAP ********************************************************************
           to retry, use: --limit @/home/rlpowell/cyt_2407.yaml.retry

perf-dione_tomcat-1-tomcat : ok=5    changed=1    unreachable=1    failed=0
perf-sedna_tomcat-1-tomcat : ok=5    changed=2    unreachable=1    failed=0
qa-ariel_tomcat-1-tomcat   : ok=5    changed=1    unreachable=1    failed=0
qa-janus_tomcat-1-tomcat   : ok=0    changed=0    unreachable=1    failed=0
qa-rhea_tomcat-1-tomcat    : ok=5    changed=1    unreachable=1    failed=0"><pre class="notranslate"><code class="notranslate">TASK: [run the script the rails way] ******************************************
changed: [perf-sedna_tomcat-1-tomcat]
changed: [qa-ariel_tomcat-1-tomcat]
changed: [perf-dione_tomcat-1-tomcat]
changed: [qa-rhea_tomcat-1-tomcat]

TASK: [get the result back] ***************************************************
ok: [qa-rhea_tomcat-1-tomcat]
ok: [qa-ariel_tomcat-1-tomcat]
ok: [perf-sedna_tomcat-1-tomcat]
ok: [perf-dione_tomcat-1-tomcat]

TASK: [debug msg={{ scriptrun.stdout }}] **************************************
fatal: [perf-dione_tomcat-1-tomcat] =&gt; a duplicate parameter was found in the argument string ()
fatal: [qa-ariel_tomcat-1-tomcat] =&gt; a duplicate parameter was found in the argument string ()
fatal: [perf-sedna_tomcat-1-tomcat] =&gt; a duplicate parameter was found in the argument string ()
fatal: [qa-rhea_tomcat-1-tomcat] =&gt; a duplicate parameter was found in the argument string ()

FATAL: all hosts have already failed -- aborting

PLAY RECAP ********************************************************************
           to retry, use: --limit @/home/rlpowell/cyt_2407.yaml.retry

perf-dione_tomcat-1-tomcat : ok=5    changed=1    unreachable=1    failed=0
perf-sedna_tomcat-1-tomcat : ok=5    changed=2    unreachable=1    failed=0
qa-ariel_tomcat-1-tomcat   : ok=5    changed=1    unreachable=1    failed=0
qa-janus_tomcat-1-tomcat   : ok=0    changed=0    unreachable=1    failed=0
qa-rhea_tomcat-1-tomcat    : ok=5    changed=1    unreachable=1    failed=0
</code></pre></div>
<p dir="auto">Copied from original issue: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="66205564" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible-modules-core/issues/1077" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible-modules-core/issues/1077/hovercard" href="https://github.com/ansible/ansible-modules-core/issues/1077">ansible/ansible-modules-core#1077</a></p>