<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">ec2_group</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.4.2.0
  config file = /home/jwitkowski/throtle-ansible/ansible.cfg
  configured module search path = [u'/home/jwitkowski/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/ansible
  executable location = /home/jwitkowski/throtle-ansible-venv/bin/ansible
  python version = 2.7.5 (default, Aug  4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]"><pre class="notranslate"><code class="notranslate">ansible 2.4.2.0
  config file = /home/jwitkowski/throtle-ansible/ansible.cfg
  configured module search path = [u'/home/jwitkowski/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/ansible
  executable location = /home/jwitkowski/throtle-ansible-venv/bin/ansible
  python version = 2.7.5 (default, Aug  4 2017, 00:39:18) [GCC 4.8.5 20150623 (Red Hat 4.8.5-16)]
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="(throtle-ansible-venv) [jwitkowski@dmpprod-ss1 throtle-ansible]$ ansible-config dump --only-changed
ANSIBLE_PIPELINING(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/home/jwitkowski/throtle-ansible/ansible.cfg) = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ForwardAgent=yes
DEFAULT_CALLBACK_PLUGIN_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/library/callback']
DEFAULT_FILTER_PLUGIN_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/usr/share/ansible_plugins/filter_plugins', u'/home/jwitkowski/throtle-ansible/library/plugins']
DEFAULT_FORKS(/home/jwitkowski/throtle-ansible/ansible.cfg) = 15
DEFAULT_GATHERING(/home/jwitkowski/throtle-ansible/ansible.cfg) = smart
DEFAULT_GATHER_SUBSET(/home/jwitkowski/throtle-ansible/ansible.cfg) = !hardware,!ohai,!facter
DEFAULT_HOST_LIST(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/inventory']
DEFAULT_MANAGED_STR(/home/jwitkowski/throtle-ansible/ansible.cfg) = Created by Ansible
DEFAULT_PRIVATE_KEY_FILE(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/.ssh/throtle-ansible.key
DEFAULT_REMOTE_TMP(/home/jwitkowski/throtle-ansible/ansible.cfg) = /tmp/ansible-$USER/tmp
DEFAULT_ROLES_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/roles']
DEFAULT_SCP_IF_SSH(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
DEFAULT_VAULT_PASSWORD_FILE(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/throtle-ansible/.vault
DISPLAY_ARGS_TO_STDOUT(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
HOST_KEY_CHECKING(/home/jwitkowski/throtle-ansible/ansible.cfg) = False
RETRY_FILES_SAVE_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/.ansible/retry-files"><pre class="notranslate"><code class="notranslate">(throtle-ansible-venv) [jwitkowski@dmpprod-ss1 throtle-ansible]$ ansible-config dump --only-changed
ANSIBLE_PIPELINING(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/home/jwitkowski/throtle-ansible/ansible.cfg) = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ForwardAgent=yes
DEFAULT_CALLBACK_PLUGIN_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/library/callback']
DEFAULT_FILTER_PLUGIN_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/usr/share/ansible_plugins/filter_plugins', u'/home/jwitkowski/throtle-ansible/library/plugins']
DEFAULT_FORKS(/home/jwitkowski/throtle-ansible/ansible.cfg) = 15
DEFAULT_GATHERING(/home/jwitkowski/throtle-ansible/ansible.cfg) = smart
DEFAULT_GATHER_SUBSET(/home/jwitkowski/throtle-ansible/ansible.cfg) = !hardware,!ohai,!facter
DEFAULT_HOST_LIST(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/inventory']
DEFAULT_MANAGED_STR(/home/jwitkowski/throtle-ansible/ansible.cfg) = Created by Ansible
DEFAULT_PRIVATE_KEY_FILE(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/.ssh/throtle-ansible.key
DEFAULT_REMOTE_TMP(/home/jwitkowski/throtle-ansible/ansible.cfg) = /tmp/ansible-$USER/tmp
DEFAULT_ROLES_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = [u'/home/jwitkowski/throtle-ansible/roles']
DEFAULT_SCP_IF_SSH(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
DEFAULT_VAULT_PASSWORD_FILE(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/throtle-ansible/.vault
DISPLAY_ARGS_TO_STDOUT(/home/jwitkowski/throtle-ansible/ansible.cfg) = True
HOST_KEY_CHECKING(/home/jwitkowski/throtle-ansible/ansible.cfg) = False
RETRY_FILES_SAVE_PATH(/home/jwitkowski/throtle-ansible/ansible.cfg) = /home/jwitkowski/.ansible/retry-files
</code></pre></div>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">N/A</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">I have a large YAML file that defines lists of dictionaries that contain my AWS security groups.  I also have a playbook which loops over these lists and creates security groups from them.  Sometimes when running the playbook I will receive the following error:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="An exception occurred during task execution. To see the full traceback,
use -vvv. The error was:botocore.exceptions.ClientError:An error occurred (InvalidGroup.Duplicate) when calling the CreateSecurityGroup operation:The security group 'prod-sftp-instance' already exists for VPC 'vpc-39c8235f' 
failed:[  
   localhost
](item=nsq) =&gt;{  
   &quot;changed&quot;:false,
   &quot;item&quot;:&quot;nsq&quot;,
   &quot;module_stderr&quot;:&quot;Traceback (most recent call last):
  File \&quot;/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\&quot;, line 899, in &lt;module&gt;
    main()
  File \&quot;/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\&quot;, line 742, in main
    group, groups, vpc_id)
  File \&quot;/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\&quot;, line 406, in get_target_from_rule
    auto_group = client.create_security_group(**params)
 File \&quot;/home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/botocore/client.py\&quot;, line 317, in _api_call
    return self._make_api_call(operation_name, kwargs)\n  File \&quot;/home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/botocore/client.py\&quot;, line 615, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (InvalidGroup.Duplicate) when calling the CreateSecurityGroup operation: The security group 'prod-sftp-instance' already exists for VPC 'vpc-39c8235f'&quot;,
   &quot;module_stdout&quot;:&quot;&quot;,
   &quot;msg&quot;:&quot;MODULE FAILURE&quot;,
   &quot;rc&quot;:1
}"><pre class="notranslate"><code class="notranslate">An exception occurred during task execution. To see the full traceback,
use -vvv. The error was:botocore.exceptions.ClientError:An error occurred (InvalidGroup.Duplicate) when calling the CreateSecurityGroup operation:The security group 'prod-sftp-instance' already exists for VPC 'vpc-39c8235f' 
failed:[  
   localhost
](item=nsq) =&gt;{  
   "changed":false,
   "item":"nsq",
   "module_stderr":"Traceback (most recent call last):
  File \"/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\", line 899, in &lt;module&gt;
    main()
  File \"/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\", line 742, in main
    group, groups, vpc_id)
  File \"/tmp/ansible_2VDh2N/ansible_module_ec2_group.py\", line 406, in get_target_from_rule
    auto_group = client.create_security_group(**params)
 File \"/home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/botocore/client.py\", line 317, in _api_call
    return self._make_api_call(operation_name, kwargs)\n  File \"/home/jwitkowski/throtle-ansible-venv/lib/python2.7/site-packages/botocore/client.py\", line 615, in _make_api_call
    raise error_class(parsed_response, operation_name)
botocore.exceptions.ClientError: An error occurred (InvalidGroup.Duplicate) when calling the CreateSecurityGroup operation: The security group 'prod-sftp-instance' already exists for VPC 'vpc-39c8235f'",
   "module_stdout":"",
   "msg":"MODULE FAILURE",
   "rc":1
}
</code></pre></div>
<p dir="auto">This typically happens when a ec2_group module is attempting to create an "empty" group from the <code class="notranslate">group_name:</code> parameter when fed a list of groups.  The above is an example of just that where the group being created is "prod-nsq-instance" but it has a <code class="notranslate">group_name:</code> dependency on "prod-sftp-instance", which already exists.  If I run the playbook a second time with no modifications it typically passes no problem.</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">vars/security_groups.yml:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="sg_nsq_rules:
  - proto: tcp
    ports:
      - 4150
      - 4160
      - 4170-4171
    group_name:
      - &quot;{{ deploy_env }}-nsq-instance&quot;
      - &quot;{{ deploy_env }}-sftp-instance&quot;
    group_desc: &quot;{{ ansible_managed }}&quot;
  - proto: tcp
    ports:
      - 9117-9118 #NSQ and CAdvisor exporters
    group_name: &quot;{{ deploy_env }}-prometheus-instance&quot;
    group_desc: &quot;{{ ansible_managed }}&quot;

sg_sftp_rules:
  - proto: tcp
    ports: 22 #Global SFTP Allow
    cidr_ip: 0.0.0.0/0
  - proto: tcp
    ports:
      - 8301 #Consul Port
      - 8400 #Consul Port
      - 8500 #Consul Port
      - 8600 #Consul Port
    group_name:
      - &quot;{{ deploy_env }}-mongors-instance&quot;
      - &quot;{{ deploy_env }}-mongoconfig-instance&quot;
      - &quot;{{ deploy_env }}-uiapp-instance&quot;
    group_desc: &quot;{{ ansible_managed }}&quot;

sg_prometheus_rules:
  - proto: tcp
    ports:
      - 25 #SMTP
      - 80 #Webserver for nagios
      - 443 #Webserver for nagios
      - 6783 #Alert manager data port
      - 8081 #Grafana HTTP Server
      - 9090 #Query webserver for prometheus
      - 9093 #Alert Manager http port
    cidr_ip: &quot;{{vpc_cidr_block}}&quot;

sg_ec2_instances:
  sg_nsq_ec2: &quot;{{ sg_common }} + {{ sg_nsq_rules }}&quot;
  sg_sftp_ec2: &quot;{{ sg_common }} + {{ sg_sftp_rules }}&quot;"><pre class="notranslate"><code class="notranslate">sg_nsq_rules:
  - proto: tcp
    ports:
      - 4150
      - 4160
      - 4170-4171
    group_name:
      - "{{ deploy_env }}-nsq-instance"
      - "{{ deploy_env }}-sftp-instance"
    group_desc: "{{ ansible_managed }}"
  - proto: tcp
    ports:
      - 9117-9118 #NSQ and CAdvisor exporters
    group_name: "{{ deploy_env }}-prometheus-instance"
    group_desc: "{{ ansible_managed }}"

sg_sftp_rules:
  - proto: tcp
    ports: 22 #Global SFTP Allow
    cidr_ip: 0.0.0.0/0
  - proto: tcp
    ports:
      - 8301 #Consul Port
      - 8400 #Consul Port
      - 8500 #Consul Port
      - 8600 #Consul Port
    group_name:
      - "{{ deploy_env }}-mongors-instance"
      - "{{ deploy_env }}-mongoconfig-instance"
      - "{{ deploy_env }}-uiapp-instance"
    group_desc: "{{ ansible_managed }}"

sg_prometheus_rules:
  - proto: tcp
    ports:
      - 25 #SMTP
      - 80 #Webserver for nagios
      - 443 #Webserver for nagios
      - 6783 #Alert manager data port
      - 8081 #Grafana HTTP Server
      - 9090 #Query webserver for prometheus
      - 9093 #Alert Manager http port
    cidr_ip: "{{vpc_cidr_block}}"

sg_ec2_instances:
  sg_nsq_ec2: "{{ sg_common }} + {{ sg_nsq_rules }}"
  sg_sftp_ec2: "{{ sg_common }} + {{ sg_sftp_rules }}"
</code></pre></div>
<p dir="auto">vars/deploy_env/test.yml</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="sg_ec2s:
  - &quot;sftp&quot;
  - &quot;nsq&quot;"><pre class="notranslate"><code class="notranslate">sg_ec2s:
  - "sftp"
  - "nsq"
</code></pre></div>
<p dir="auto">build_sec_group.yml playbook:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="- hosts: localhost
  gather_facts: False
  vars_files:
    - &quot;vars/security_groups.yml&quot;
    - &quot;vars/deploy_envs/test.yml&quot;
  tasks:
    - name: Create EC2 Security groups
      ec2_group:
        name: &quot;{{ display_env|default(deploy_env) }}-{{ item }}-instance&quot;
        description: &quot;{{ ansible_managed }}&quot;
        vpc_id: &quot;{{ vpc_id }}&quot;
        region: &quot;{{ region }}&quot;
        rules: &quot;{{ sg_ec2_instances['sg_' + item + '_ec2'] }}&quot;
        tags:
          Name: &quot;{{ display_env|default(deploy_env) }}-{{ item }}-instance&quot;
          Environment: &quot;{{ display_env|default(deploy_env) }}&quot;
      with_items: &quot;{{ sg_ec2s }}&quot;
      when: group_tag is not defined or (group_tag is defined and group_tag == item)
      tags:
        - &quot;ec2_instance&quot;"><pre class="notranslate"><code class="notranslate">- hosts: localhost
  gather_facts: False
  vars_files:
    - "vars/security_groups.yml"
    - "vars/deploy_envs/test.yml"
  tasks:
    - name: Create EC2 Security groups
      ec2_group:
        name: "{{ display_env|default(deploy_env) }}-{{ item }}-instance"
        description: "{{ ansible_managed }}"
        vpc_id: "{{ vpc_id }}"
        region: "{{ region }}"
        rules: "{{ sg_ec2_instances['sg_' + item + '_ec2'] }}"
        tags:
          Name: "{{ display_env|default(deploy_env) }}-{{ item }}-instance"
          Environment: "{{ display_env|default(deploy_env) }}"
      with_items: "{{ sg_ec2s }}"
      when: group_tag is not defined or (group_tag is defined and group_tag == item)
      tags:
        - "ec2_instance"
</code></pre></div>
<p dir="auto">Run the above setup a few times and you'll eventually hit the error.</p>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">The playbook should run each time idempotently and never cause this error.</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<p dir="auto">The error above appears intermittently and works sometimes without changing any code.</p>
<p dir="auto">Trying to register multiple variables in YAML array syntax:</p>
<p dir="auto">kk:playbooks kris$ cat p.yml<br>
# vim:ft=ansible:<br>
- hosts: server<br>
user: root</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="  tasks:
    - name: test something
      command: echo test
      register:
        - a
        - b

    - debug: var=a

    - debug: var=b"><pre class="notranslate"><code class="notranslate">  tasks:
    - name: test something
      command: echo test
      register:
        - a
        - b

    - debug: var=a

    - debug: var=b
</code></pre></div>
<p dir="auto">This explodes:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="kk:playbooks kris$ ansible-playbook  p.yml

PLAY [server] *****************************************************************

TASK: [test something] ********************************************************
changed: [server]
Traceback (most recent call last):
  File &quot;/usr/local/Cellar/ansible/1.9.3/libexec/bin/ansible-playbook&quot;, line 324, in &lt;module&gt;
    sys.exit(main(sys.argv[1:]))
  File &quot;/usr/local/Cellar/ansible/1.9.3/libexec/bin/ansible-playbook&quot;, line 264, in main
    pb.run()
  File &quot;/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py&quot;, line 348, in run
    if not self._run_play(play):
  File &quot;/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py&quot;, line 789, in _run_play
    if not self._run_task(play, task, False):
  File &quot;/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py&quot;, line 540, in _run_task
    _register_play_vars(host, result)
  File &quot;/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py&quot;, line 514, in _register_play_vars
    utils.update_hash(self.VARS_CACHE, host, {task.register: result})
TypeError: unhashable type: 'list'"><pre class="notranslate"><code class="notranslate">kk:playbooks kris$ ansible-playbook  p.yml

PLAY [server] *****************************************************************

TASK: [test something] ********************************************************
changed: [server]
Traceback (most recent call last):
  File "/usr/local/Cellar/ansible/1.9.3/libexec/bin/ansible-playbook", line 324, in &lt;module&gt;
    sys.exit(main(sys.argv[1:]))
  File "/usr/local/Cellar/ansible/1.9.3/libexec/bin/ansible-playbook", line 264, in main
    pb.run()
  File "/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py", line 348, in run
    if not self._run_play(play):
  File "/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py", line 789, in _run_play
    if not self._run_task(play, task, False):
  File "/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py", line 540, in _run_task
    _register_play_vars(host, result)
  File "/usr/local/Cellar/ansible/1.9.3/libexec/lib/python2.7/site-packages/ansible/playbook/__init__.py", line 514, in _register_play_vars
    utils.update_hash(self.VARS_CACHE, host, {task.register: result})
TypeError: unhashable type: 'list'
</code></pre></div>
<p dir="auto">It is the type that makes it explode, that is</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="register: [ a ]"><pre class="notranslate"><code class="notranslate">register: [ a ]
</code></pre></div>
<p dir="auto">is already sufficient to make it blow.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="kk:playbooks kris$ cat q.yml
# vim:ft=ansible:
- hosts: server
  user: root

  tasks:
    - name: test something
      command: echo test
      notify:
        - one
        - two

  handlers:
    - name: one
      command: echo one

    - name: two
      command: echo two"><pre class="notranslate"><code class="notranslate">kk:playbooks kris$ cat q.yml
# vim:ft=ansible:
- hosts: server
  user: root

  tasks:
    - name: test something
      command: echo test
      notify:
        - one
        - two

  handlers:
    - name: one
      command: echo one

    - name: two
      command: echo two
</code></pre></div>
<p dir="auto">works just as expected, so I'd expect duplicating the parameter handling from handlers in register would fix the problem.</p>
<p dir="auto">Related to <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="106444994" data-permission-text="Title is private" data-url="https://github.com/ansible/ansible/issues/12364" data-hovercard-type="issue" data-hovercard-url="/ansible/ansible/issues/12364/hovercard" href="https://github.com/ansible/ansible/issues/12364">#12364</a></p>