---
- hosts: localhost
  gather_facts: yes

  vars_files:
    - vars/ec2_security_groups.yaml

  tasks:
    # Zoox Corporate
    - name: default
      ec2_group:
        name: default
        description: default VPC security group
        vpc_id: '{{ vpc.zoox_corporate }}'
        region: us-west-1
        rules:
          - proto: all
            group_id: sg-77251a12
    - name: Dispatch Server
      ec2_group:
        name: Dispatch Server
        description: Exposes webserver ports to the world
        vpc_id: '{{ vpc.zoox_corporate }}'
        region: us-west-1
        rules:
          # Prod
          - proto: tcp
            from_port: '{{ ports.https }}'
            to_port: '{{ ports.https }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.dispatch_vehicle_prod }}'
            to_port: '{{ ports.dispatch_vehicle_prod }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.dispatch_user_api_prod }}'
            to_port: '{{ ports.dispatch_user_api_prod }}'
            cidr_ip: '{{ cidr.all }}'
          # Demo
          - proto: tcp
            from_port: 12001
            to_port: 12003
            cidr_ip: '{{ cidr.all }}'
          # Dev
          - proto: tcp
            from_port: 11001
            to_port: 11003
            cidr_ip: '{{ cidr.all }}'
    - name: ssh
      ec2_group:
        name: ssh
        description: Open SSH ports
        vpc_id: '{{ vpc.zoox_corporate }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
    # Zoox Private
    - name: altium-vault
      ec2_group:
        name: altium-vault
        description: Security Group for Altium Vault Server
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.rdp }}'
            to_port: '{{ ports.rdp }}'
            cidr_ip: '{{ cidr.eng.aws.legacy }}'
          - proto: tcp
            from_port: 9780
            to_port: 9780
            cidr_ip: '{{ cidr.eng.aws.legacy }}'
          - proto: icmp
            from_port: '{{ icmp.type.echo_reply }}'
            to_port: '{{ icmp.code.echo_reply }}'
            cidr_ip: '{{ cidr.all }}'
    - name: ControlledByBamboo
      ec2_group:
        name: ControlledByBamboo
        description: Instance shutdown controlled by Bamboo
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules: []
    - name: data catalog prod db
      ec2_group:
        name: data catalog prod db
        description: .
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: '{{ cidr.public.x2180_1 }}'
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: '{{ cidr.public.x2180_2 }}'
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: '{{ cidr.public.x2180_3 }}'
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: 108.60.121.11/32 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: 198.129.0.0/16 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: '{{ cidr.public.firehouse_wired }}'
    - name: default
      ec2_group:
        name: default
        description: default VPC security group
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: '{{ cidr.public.x2180_1 }}'
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: '{{ cidr.public.x2180_2 }}'
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: '{{ cidr.public.x2180_3 }}'
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: 108.60.121.11/32 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            cidr_ip: 198.129.0.0/16 # TODO(jph): identify.
          - proto: all
            group_id: sg-6672d203
          - proto: all
            group_id: sg-a29a1fc7
          - proto: all
            group_id: sg-ca72d2af
          - proto: all
            group_id: sg-d9f5a2bc
    - name: Dispatch
      ec2_group:
        name: Dispatch
        description: Dispatch Server Access
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: 50.196.176.24/29 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: 50.240.221.189/32 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: 166.170.43.163/32 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.https }}'
            to_port: '{{ ports.https }}'
            cidr_ip: 198.129.0.0/16 # TODO(jph): identify.
          - proto: tcp
            from_port: 1443
            to_port: 1443
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: 2443
            to_port: 2443
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: 11001
            to_port: 11003
            cidr_ip: 198.129.0.0/16 # TODO(jph): identify.
          - proto: tcp
            from_port: 12001
            to_port: 12001
            cidr_ip: 101.187.233.72/32 # TODO(jph): identify.
          - proto: tcp
            from_port: 12001
            to_port: 12001
            cidr_ip: 125.253.110.9/32 # TODO(jph): identify.
          - proto: tcp
            from_port: 12001
            to_port: 12001
            cidr_ip: 198.129.0.0/16 # TODO(jph): identify.
          - proto: tcp
            from_port: 12002
            to_port: 12002
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: 12003
            to_port: 12003
            cidr_ip: 198.129.0.0/16 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: 50.233.131.66/31 # TODO(jph): lock down to /32.
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: 52.9.17.4/32 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: '{{ cidr.public.firehouse_wired }}'
    - name: dispatch prod db
      ec2_group:
        name: dispatch prod db
        description: .
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.postgres }}'
            to_port: '{{ ports.postgres }}'
            group_id: sg-a29a1fc7
    - name: elasticbamboo
      ec2_group:
        name: elasticbamboo
        description: Atlassian Bamboo Elastic Agents
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.rdp }}'
            to_port: '{{ ports.rdp }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.elastic_bamboo }}'
            to_port: '{{ ports.elastic_bamboo }}'
            cidr_ip: '{{ cidr.all }}'
    - name: HadoopEC2Cluster
      ec2_group:
        name: HadoopEC2Cluster
        description: Hadoop Cluster
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: 50.233.131.66/31 # TODO(jph): restrict down to /32.
          - proto: all
            cidr_ip: 50.233.131.66/31 # TODO(jph): restrict down to /32.
          - proto: all
            group_id: sg-c2d633a6
    - name: ssh
      ec2_group:
        name: ssh
        description: ssh
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
    - name: VPN External Access
      ec2_group:
        name: VPN External Access
        description: Allow connections on 443, 943, etc...
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.https }}'
            to_port: '{{ ports.https }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.openvpn_admin }}'
            to_port: '{{ ports.openvpn_admin }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: udp
            from_port: 1134 # TODO(jph): identify.
            to_port: 1134
            cidr_ip: '{{ cidr.all }}'
    - name: VPN Server Security Group
      ec2_group:
        name: VPN Server Security Group
        description: VPN Server - SSH/VPN access
        vpc_id: '{{ vpc.zoox_private }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: 166.177.248.168/29 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: 166.177.249.243/32 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            cidr_ip: 50.196.176.24/29 # TODO(jph): identify
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.http }}'
            to_port: '{{ ports.http }}'
            cidr_ip: 198.51.111.12/32 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.http }}'
            to_port: '{{ ports.http }}'
            cidr_ip: 198.129.0.0/16 # TODO(jph): identify.
          - proto: tcp
            from_port: 6543 # TODO(jph): identify.
            to_port: 6543
            cidr_ip: 198.129.0.0/16 # TODO(jph): identify.
          - proto: udp
            from_port: 1194 # TODO(jph): identify.
            to_port: 1194
            cidr_ip: '{{ cidr.all }}'
          - proto: all
            cidr_ip: '{{ cidr.eng.aws.legacy }}'
          - proto: all
            cidr_ip: 50.233.131.64/30 # TODO(jph): identify.
          - proto: all
            cidr_ip: 50.233.131.72/29 # TODO(jph): identify.
          - proto: all
            cidr_ip: 52.9.17.4/32 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.http }}'
            to_port: '{{ ports.http }}'
            group_id: sg-d9f5a2bc
          - proto: tcp
            from_port: '{{ ports.http }}'
            to_port: '{{ ports.http }}'
            cidr_ip: '{{ cidr.public.x2180_1 }}'
          - proto: tcp
            from_port: '{{ ports.http }}'
            to_port: '{{ ports.http }}'
            cidr_ip: '{{ cidr.public.x2180_2 }}'
          - proto: tcp
            from_port: '{{ ports.http }}'
            to_port: '{{ ports.http }}'
            cidr_ip: '{{ cidr.public.x2180_3 }}'
    # VPC-Corp
    - name: default
      ec2_group:
        name: default
        description: default VPC security group
        vpc_id: '{{ vpc.vpc_corp }}'
        region: us-west-1
        rules:
          - proto: all
            group_id: sg-9ccd32f8
    - name: SG-Corp-Support
      ec2_group:
        name: SG-Corp-Support
        description: SG-Corp-Support
        vpc_id: '{{ vpc.vpc_corp }}'
        region: us-west-1
        rules:
          # TODO(jph): Lock these down.
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.dns }}'
            to_port: '{{ ports.dns }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: udp
            from_port: '{{ ports.dns }}'
            to_port: '{{ ports.dns }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
    - name: SG-Teamcenter
      ec2_group:
        name: SG-Teamcenter
        description: SG-Teamcenter
        vpc_id: '{{ vpc.vpc_corp }}'
        region: us-west-1
        rules:
          # TODO(jph): Lock these down.
          - proto: tcp
            from_port: '{{ ports.ms_sql }}'
            to_port: '{{ ports.ms_sql }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.rdp }}'
            to_port: '{{ ports.rdp }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: all
            cidr_ip: '{{ cidr.all }}'
    - name: Software Handbook
      ec2_group:
        name: Software Handbook
        description: Software Handbook
        vpc_id: '{{ vpc.vpc_corp }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.http }}'
            to_port: '{{ ports.http }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.https }}'
            to_port: '{{ ports.https }}'
            cidr_ip: '{{ cidr.all }}'
    - name: SSH
      ec2_group:
        name: SSH
        description: SSH access for VPC Corp
        vpc_id: '{{ vpc.vpc_corp }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
    # VPC-Default
    - name: default
      ec2_group:
        name: default
        description: default VPC security group
        vpc_id: '{{ vpc.vpc_default }}'
        region: us-west-1
        rules:
          - proto: all
            group_id: sg-99a955fd
    - name: SG-Altium
      ec2_group:
        name: SG-Altium
        description: SG-Altium
        vpc_id: '{{ vpc.vpc_default }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
    - name: SG-Cloudera
      ec2_group:
        name: SG-Cloudera
        description: SG-Cloudera
        vpc_id: '{{ vpc.vpc_default }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.eng.aws.norcal_normal }}'
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.corp.us }}'
          - proto: tcp
            from_port: '{{ ports.cloudera_admin }}'
            to_port: '{{ ports.cloudera_admin }}'
            cidr_ip: '{{ cidr.corp.us }}'
          - proto: all
            cidr_ip: '{{ cidr.all }}' # TODO(jph): lock down.
          - proto: all
            group_id: sg-9b9369ff
    - name: SG-Mturk
      ec2_group:
        name: SG-Mturk
        description: SG-Mturk
        vpc_id: '{{ vpc.vpc_default }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
    - name: SG-Support
      ec2_group:
        name: SG-Support
        description: SG-Support
        vpc_id: '{{ vpc.vpc_default }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.dns }}'
            to_port: '{{ ports.dns }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: udp
            from_port: '{{ ports.dns }}'
            to_port: '{{ ports.dns }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
    # VPC-Teleops
    - name: default
      ec2_group:
        name: default
        description: default VPC security group
        vpc_id: '{{ vpc.vpc_teleops }}'
        region: us-west-1
        rules:
          - proto: all
            group_id: sg-42aa5626
    - name: SG-Teleops-Default
      ec2_group:
        name: SG-Teleops-Default
        description: SG-Teleops-Default
        vpc_id: '{{ vpc.vpc_teleops }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
    - name: SG-Teleops-Support
      ec2_group:
        name: SG-Teleops-Support
        description: SG-Teleops-Support
        vpc_id: '{{ vpc.vpc_teleops }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.dns }}'
            to_port: '{{ ports.dns }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: udp
            from_port: '{{ ports.dns }}'
            to_port: '{{ ports.dns }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
    # VPC-Dispatch
    - name: default
      ec2_group:
        name: default
        description: default VPC security group
        vpc_id: '{{ vpc.vpc_dispatch }}'
        region: us-west-1
        rules:
          - proto: all
            group_id: sg-73aa5617
    - name: launch-wizard-1
      ec2_group:
        name: launch-wizard-1
        description: launch-wizard-1 created 2016-03-23T19:15:56.941-07:00
        vpc_id: '{{ vpc.vpc_dispatch }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.dns }}'
            to_port: '{{ ports.dns }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: udp
            from_port: '{{ ports.dns }}'
            to_port: '{{ ports.dns }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
    - name: SG-Dispatch-Default
      ec2_group:
        name: SG-Dispatch-Default
        description: SG-Dispatch-Default
        vpc_id: '{{ vpc.vpc_dispatch }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            cidr_ip: '{{ cidr.all }}'
    # AWS Default
    - name: default
      ec2_group:
        name: default
        description: default VPC security group
        vpc_id: '{{ vpc.aws_default }}'
        region: us-west-1
        rules:
          - proto: all
            group_id: sg-ea6bcb8f
    - name: ElasticMapReduce-master
      ec2_group:
        name: ElasticMapReduce-master
        description: Master group for Elastic MapReduce created on 2016-01-28T19:44:19.688Z
        vpc_id: '{{ vpc.aws_default }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            group_id: sg-d42821b1
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            group_id: sg-d72821b2
          - proto: tcp
            from_port: '{{ ports.elastic_map_reduce_cluster_management }}'
            to_port: '{{ ports.elastic_map_reduce_cluster_management }}'
            cidr_ip: 54.240.198.0/24 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.elastic_map_reduce_cluster_management }}'
            to_port: '{{ ports.elastic_map_reduce_cluster_management }}'
            cidr_ip: 204.246.160.32/28 # TODO(jph): identify.
          - proto: tcp
            from_port: '{{ ports.elastic_map_reduce_cluster_management }}'
            to_port: '{{ ports.elastic_map_reduce_cluster_management }}'
            cidr_ip: 204.246.162.32/28 # TODO(jph): identify.
          - proto: udp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            group_id: sg-d42821b1
          - proto: udp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            group_id: sg-d72821b2
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            group_id: sg-d42821b1
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            group_id: sg-d72821b2
    - name: ElasticMapReduce-slave
      ec2_group:
        name: ElasticMapReduce-slave
        description: Slave group for Elastic MapReduce created on 2016-01-28T19:44:19.691Z
        vpc_id: '{{ vpc.aws_default }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            group_id: sg-d42821b1
          - proto: tcp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            group_id: sg-d72821b2
          - proto: udp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            group_id: sg-d42821b1
          - proto: udp
            from_port: '{{ ports.min }}'
            to_port: '{{ ports.max }}'
            group_id: sg-d72821b2
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            group_id: sg-d42821b1
          - proto: icmp
            from_port: '{{ icmp.type.all }}'
            to_port: '{{ icmp.code.all }}'
            group_id: sg-d72821b2
    - name: OpenVPN Access Server -HVM--2-0-20-AutogenByAWSMP-
      ec2_group:
        name: OpenVPN Access Server -HVM--2-0-20-AutogenByAWSMP-
        description: This security group was generated by AWS Marketplace and is based on recommended settings for OpenVPN Access Server HVM version 2.0.20 provided by OpenVPN Technologies Inc.
        vpc_id: '{{ vpc.aws_default }}'
        region: us-west-1
        rules:
          - proto: tcp
            from_port: '{{ ports.ssh }}'
            to_port: '{{ ports.ssh }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.https }}'
            to_port: '{{ ports.https }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: tcp
            from_port: '{{ ports.openvpn_admin }}'
            to_port: '{{ ports.openvpn_admin }}'
            cidr_ip: '{{ cidr.all }}'
          - proto: udp
            from_port: 1194 # TODO(jph): identify.
            to_port: 1194
            cidr_ip: '{{ cidr.all }}'
