<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="$ ansible --version
1.4.4
$ ansible-playbook ec2_security.yml -i hosts

PLAY [127.0.0.1] **************************************************************

GATHERING FACTS ***************************************************************
ok: [127.0.0.1]

TASK: [Create EC2 web group] **************************************************
failed: [127.0.0.1] =&gt; {&quot;failed&quot;: true, &quot;parsed&quot;: false}
invalid output was: Traceback (most recent call last):
  File &quot;/Users/user/.ansible/tmp/ansible-1390492978.4-106406911676238/ec2_group&quot;, line 1313, in &lt;module&gt;
    main()
  File &quot;/Users/user/.ansible/tmp/ansible-1390492978.4-106406911676238/ec2_group&quot;, line 192, in main
    group = ec2.create_security_group(name, description, vpc_id=vpc_id)
  File &quot;/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/boto/ec2/connection.py&quot;, line 2948, in create_security_group
    SecurityGroup, verb='POST')
  File &quot;/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/boto/connection.py&quot;, line 1151, in get_object
    raise self.ResponseError(response.status, response.reason, body)
boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request
&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
&lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidGroup.Duplicate&lt;/Code&gt;&lt;Message&gt;The security group 'web' already exists for VPC 'vpc-[REDACTED]'&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;[REDACTED]&lt;/RequestID&gt;&lt;/Response&gt;


FATAL: all hosts have already failed -- aborting

PLAY RECAP ********************************************************************
           to retry, use: --limit @/Users/user/ec2_security.retry

127.0.0.1                  : ok=1    changed=0    unreachable=0    failed=1"><pre class="notranslate"><code class="notranslate">$ ansible --version
1.4.4
$ ansible-playbook ec2_security.yml -i hosts

PLAY [127.0.0.1] **************************************************************

GATHERING FACTS ***************************************************************
ok: [127.0.0.1]

TASK: [Create EC2 web group] **************************************************
failed: [127.0.0.1] =&gt; {"failed": true, "parsed": false}
invalid output was: Traceback (most recent call last):
  File "/Users/user/.ansible/tmp/ansible-1390492978.4-106406911676238/ec2_group", line 1313, in &lt;module&gt;
    main()
  File "/Users/user/.ansible/tmp/ansible-1390492978.4-106406911676238/ec2_group", line 192, in main
    group = ec2.create_security_group(name, description, vpc_id=vpc_id)
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/boto/ec2/connection.py", line 2948, in create_security_group
    SecurityGroup, verb='POST')
  File "/usr/local/Cellar/python/2.7.6/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/boto/connection.py", line 1151, in get_object
    raise self.ResponseError(response.status, response.reason, body)
boto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request
&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidGroup.Duplicate&lt;/Code&gt;&lt;Message&gt;The security group 'web' already exists for VPC 'vpc-[REDACTED]'&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;[REDACTED]&lt;/RequestID&gt;&lt;/Response&gt;


FATAL: all hosts have already failed -- aborting

PLAY RECAP ********************************************************************
           to retry, use: --limit @/Users/user/ec2_security.retry

127.0.0.1                  : ok=1    changed=0    unreachable=0    failed=1
</code></pre></div>
<p dir="auto">Hosts file:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="[localhost]
127.0.0.1 ansible_python_interpreter=/usr/local/bin/python"><pre class="notranslate"><code class="notranslate">[localhost]
127.0.0.1 ansible_python_interpreter=/usr/local/bin/python
</code></pre></div>
<p dir="auto">ec2_security.yml:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- hosts: 127.0.0.1
  connection: local
  tasks:
    - name: Create EC2 web group
      local_action:
        module: ec2_group
        name: web
        description: HTTP and SSH ports
        region: eu-west-1
        rules:
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: 0.0.0.0/0"><pre class="notranslate"><code class="notranslate">- hosts: 127.0.0.1
  connection: local
  tasks:
    - name: Create EC2 web group
      local_action:
        module: ec2_group
        name: web
        description: HTTP and SSH ports
        region: eu-west-1
        rules:
          - proto: tcp
            from_port: 80
            to_port: 80
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: 0.0.0.0/0
</code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>

<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">ssh</p>

<h5 dir="auto">ANSIBLE VERSION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible --version
ansible 2.4.0.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/jenkins/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/dist-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]"><pre class="notranslate"><code class="notranslate">ansible --version
ansible 2.4.0.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = [u'/home/jenkins/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/lib/python2.7/dist-packages/ansible
  executable location = /usr/bin/ansible
  python version = 2.7.12 (default, Nov 19 2016, 06:48:10) [GCC 5.4.0 20160609]
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>

<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ALLOW_WORLD_READABLE_TMPFILES(/etc/ansible/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/etc/ansible/ansible.cfg) = -C -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes
ANSIBLE_SSH_CONTROL_PATH(/etc/ansible/ansible.cfg) = %(directory)s/%%h-%%r
ANSIBLE_SSH_PIPELINING(/etc/ansible/ansible.cfg) = True
DEFAULT_FORKS(/etc/ansible/ansible.cfg) = 50
DEFAULT_TIMEOUT(/etc/ansible/ansible.cfg) = 30"><pre class="notranslate"><code class="notranslate">ALLOW_WORLD_READABLE_TMPFILES(/etc/ansible/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/etc/ansible/ansible.cfg) = -C -o ControlMaster=auto -o ControlPersist=60s -o ForwardAgent=yes
ANSIBLE_SSH_CONTROL_PATH(/etc/ansible/ansible.cfg) = %(directory)s/%%h-%%r
ANSIBLE_SSH_PIPELINING(/etc/ansible/ansible.cfg) = True
DEFAULT_FORKS(/etc/ansible/ansible.cfg) = 50
DEFAULT_TIMEOUT(/etc/ansible/ansible.cfg) = 30
</code></pre></div>
<h5 dir="auto">OS / ENVIRONMENT</h5>

<p dir="auto">Ubuntu 16.04 -&gt; Ubuntu 16.04</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">I used to use <code class="notranslate">ansible $target -m setup --ssh-common-args="-O exit" </code> to terminate a ControlPersist connection.   This stops working in ansible 2.4</p>
<p dir="auto">I'm doing this so I can switch ssh agents in a deployment script.</p>

<h5 dir="auto">STEPS TO REPRODUCE</h5>

<p dir="auto">This has very different behaviour between 2.3 &amp; 2.4:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ssh-agent bash -c &quot;ssh-add ~/.ssh/id_ed25519 &amp;&amp; ansible myhost -m shell -a 'ssh-add -l'&quot;
ansible myhost -m setup  --ssh-common-args=&quot;-O exit&quot;
ssh-agent bash -c &quot;ssh-add ~/.ssh/id_rsa &amp;&amp; ansible myhost -m shell -a 'ssh-add -l'&quot;"><pre class="notranslate"><code class="notranslate">ssh-agent bash -c "ssh-add ~/.ssh/id_ed25519 &amp;&amp; ansible myhost -m shell -a 'ssh-add -l'"
ansible myhost -m setup  --ssh-common-args="-O exit"
ssh-agent bash -c "ssh-add ~/.ssh/id_rsa &amp;&amp; ansible myhost -m shell -a 'ssh-add -l'"
</code></pre></div>
<h5 dir="auto">EXPECTED RESULTS</h5>

<p dir="auto">In 2.3, the second command fails with UNREACHABLE, which is expected because we asked it to close the connection.   The first line and the third line report signatures of different keys.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">In ansible 2.4, the second command succeeds, surprisingly, and then the third command fails with "error fetching identities" because the <code class="notranslate">ssh-add -l</code> is trying to connect to the ssh-agent in the first line, which has exited.</p>