Ansible amazon.aws.ec2 模块在创建新实例时无法引用组

Question

I have the below playbook. It correctly creates a security group in step. I can check via the AWS console that this really happens and the security group looks exactly as expected and has the ID sg-0dcf7ca7899835648.

But in step 2 I get the below error message which essentially states that the just created security group does not exist: "The security group 'sg-0dcf7ca7899835648' does not exist."

The same happens when I manually create SGs or manually insert the ID. The same happens with the group name.

How can I use the just created security group when launching a new EC2 instance?

The playbook:

---
- name: Create AWS EC2 instances and start them
  hosts: localhost
  gather_facts: false
  vars:
    instances_count: 1
  tasks:
    - name: Setup test security group
      amazon.aws.ec2_group:
        name: sg_conzone_test_01
        description: "ConZone security group with access to several local ports. DONT USE FOR PRODUCTION!!!"
        vpc_id: vpc-6a3ebe00
        region: eu-central-1
        profile: conzone_root
        rules:
          - proto: tcp
            from_port: 3000
            to_port: 3000
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 22
            to_port: 22
            cidr_ip: 0.0.0.0/0
          - proto: tcp
            from_port: 8000
            to_port: 8000
          - proto: tcp
            from_port: 8983
            to_port: 8983
      register: security_group

    - name: Create AWS EC2 instance
      amazon.aws.ec2:
        profile: conzone_root
        region: eu-central-1
        key_name: ConZone-Testserver-Key01
        instance_type: t2.large
        image: ami-05f7491af5eef733a
        wait: yes
        group_id: "{{ security_group.group_id }}"
        count: "{{ instances_count }}"
        # vpc_subnet_id: vpc-6a3ebe00
        assign_public_ip: yes
        instance_tags:
          Environment: test
          os: ubuntu
          ansible_user: ubuntu
          db: postgres
          solr: yes
      register: ec2

The error message:

TASK [Create AWS EC2 instance] *************************************************************************************
task path: /Users/tkx/devel/conzone/conzone-config/playbooks/create_ec2.yml:32
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: <Response><Errors><Error><Code>InvalidGroup.NotFound</Code><Message>The security group 'sg-0dcf7ca7899835648' does not exist</Message></Error></Errors><RequestID>8241e3ea-5a59-4383-a5ac-f3a568f91960</RequestID></Response>
fatal: [localhost]: FAILED! => {"changed": false, "module_stderr": "Traceback (most recent call last):\n  File \"<stdin>\", line 100, in <module>\n  File \"<stdin>\", line 92, in _ansiballz_main\n  File \"<stdin>\", line 40, in invoke_module\n  File \"/usr/local/Caskroom/miniconda/base/lib/python3.9/runpy.py\", line 210, in run_module\n    return _run_module_code(code, init_globals, run_name, mod_spec)\n  File \"/usr/local/Caskroom/miniconda/base/lib/python3.9/runpy.py\", line 97, in _run_module_code\n    _run_code(code, mod_globals, init_globals,\n  File \"/usr/local/Caskroom/miniconda/base/lib/python3.9/runpy.py\", line 87, in _run_code\n    exec(code, run_globals)\n  File \"/var/folders/2w/g4gydjx960qbfxyvmbd3_sl00000gn/T/ansible_amazon.aws.ec2_payload_lpsz83a1/ansible_amazon.aws.ec2_payload.zip/ansible_collections/amazon/aws/plugins/modules/ec2.py\", line 1740, in <module>\n  File \"/var/folders/2w/g4gydjx960qbfxyvmbd3_sl00000gn/T/ansible_amazon.aws.ec2_payload_lpsz83a1/ansible_amazon.aws.ec2_payload.zip/ansible_collections/amazon/aws/plugins/modules/ec2.py\", line 1724, in main\n  File \"/var/folders/2w/g4gydjx960qbfxyvmbd3_sl00000gn/T/ansible_amazon.aws.ec2_payload_lpsz83a1/ansible_amazon.aws.ec2_payload.zip/ansible_collections/amazon/aws/plugins/modules/ec2.py\", line 1042, in create_instances\n  File \"/usr/local/Caskroom/miniconda/base/lib/python3.9/site-packages/boto/ec2/connection.py\", line 2983, in get_all_security_groups\n    return self.get_list('DescribeSecurityGroups', params,\n  File \"/usr/local/Caskroom/miniconda/base/lib/python3.9/site-packages/boto/connection.py\", line 1186, in get_list\n    raise self.ResponseError(response.status, response.reason, body)\nboto.exception.EC2ResponseError: EC2ResponseError: 400 Bad Request\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<Response><Errors><Error><Code>InvalidGroup.NotFound</Code><Message>The security group 'sg-0dcf7ca7899835648' does not exist</Message></Error></Errors><RequestID>8241e3ea-5a59-4383-a5ac-f3a568f91960</RequestID></Response>\n", "module_stdout": "", "msg": "MODULE FAILURE\nSee stdout/stderr for the exact error", "rc": 1}

Answer 1

It's because (as your commented code indicates) one needs to specify vpc_subnet_id: otherwise AWS will use the "default" VPC which is evidently not the vpc-6a3ebe00 in which you created the SG