amazon ec2 - How to add a temporary rule to an EC2 security group with Ansible -

i have ansible role handle creation of rds instance , databases on instance. role allows security group specified database. want able add rule security group @ beginning of role allows access current host ansible can run database creation/maintenance tasks. want remove rule security group while maintaining existing groups.

what i've done far used ec2_group_facts module information given security group save in security_group variable. add rule task similar following:

- name: add hole security group   local_action:     module: ec2_group     name: "{{ security_group.group_name }}"     purge_rules: no     rules:       - proto: tcp         from_port: "{{ db_port }}"         to_port: "{{ db_port }}"         cidr_ip: 0.0.0.0/0 

this works properly. issue @ end of role, when want restore existing rules, format of rules returned ec2_group_facts not accepted ec2_group module. information saved security_group in following format:

{   "group_id": "sg-1234abcd",    "group_name": "security-group",    "ip_permissions": [     {       "from_port": 1234,        "ip_protocol": "tcp",        "ip_ranges": [         {           "cidr_ip": "0.0.0.0/0"         }       ],        "ipv6_ranges": [],        "prefix_list_ids": [],        "to_port": 1234,        "user_id_group_pairs": []     }   ],    "ip_permissions_egress": [],    "owner_id": "123456789012",    "tags": {     "name": ""   },    "vpc_id": "vpc-1234abcd" } 

the rules argument of ec2_group module needs list of objects proto, from_port, to_port, , cidr_ip attributes, how map data above required format?

edit: guess 1 solution add temporary security group allows access current host. if understanding of ec2 security groups correct, permissive rule of security groups associated instance applied achieve want. require editing security groups attached existing rds instance, prefer edit rules of existing security group if possible.

edit 2: travis ci publishes ip addresses used run builds. add these security group permanently, although i'm not sure security implications of are.

ec2_group docs
ec2_group_facts docs

when running playbooks want consistent state , sounds of things don't have consistent state throughout play.

i suggest additional task perform on database run other instance more trusted (perhaps place you're running ansible from?).

consider happen if playbook run twice @ same time. perhaps isn't workflow allows should still consider case.

if isn't option or rather not change implementation edit's suggestion sounds more suitable. apply standard rules , when required add rules (or create new security group purpose) , destroy or modify when no longer required.