diff --git a/plugins/filter/__init__.py b/plugins/filter/__init__.py
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/plugins/filter/expand_csv_tags.py b/plugins/filter/expand_csv_tags.py
new file mode 100644
index 00000000000..764ba6ba32b
--- /dev/null
+++ b/plugins/filter/expand_csv_tags.py
@@ -0,0 +1,29 @@
+# Copyright (c) 2020 Paul Arthur
+# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt)
+
+from __future__ import (absolute_import, division, print_function)
+__metaclass__ = type
+
+from ansible.errors import AnsibleFilterError
+from ansible.module_utils.common._collections_compat import Mapping
+
+
+def expand_csv_tags(mydict, separator=','):
+    ''' Takes a dictionary and transforms it into a list of key_value strings,
+        possibly after splitting the value using the supplied separator. '''
+
+    if not isinstance(mydict, Mapping):
+        raise AnsibleFilterError("expand_csv_tags requires a dictionary, got %s instead." % type(mydict))
+
+    ret = []
+
+    for key in mydict:
+        for val in mydict[key].split(separator):
+            ret.append('{0}_{1}'.format(key, val))
+
+    return ret
+
+
+class FilterModule(object):
+    def filters(self):
+        return { 'expand_csv_tags': expand_csv_tags }
diff --git a/plugins/inventory/aws_ec2.py b/plugins/inventory/aws_ec2.py
index 793d929aff3..fbdd2a5ac9f 100644
--- a/plugins/inventory/aws_ec2.py
+++ b/plugins/inventory/aws_ec2.py
@@ -120,26 +120,38 @@
 keyed_groups:
   # Add e.g. x86_64 hosts to an arch_x86_64 group
   - prefix: arch
-    key: 'architecture'
+    key: architecture
+
   # Add hosts to tag_Name_Value groups for each Name/Value tag pair
   - prefix: tag
     key: tags
+
+  # Add hosts to tag_Name_Value groups for each Name/Value tag pair,
+  # expanding comma-separated Values into multiple groups.
+  - prefix: tag
+    key: tags | amazon.aws.expand_csv_tags
+
   # Add hosts to e.g. instance_type_z3_tiny
   - prefix: instance_type
     key: instance_type
+
   # Create security_groups_sg_abcd1234 group for each SG
-  - key: 'security_groups|json_query("[].group_id")'
-    prefix: 'security_groups'
+  - key: security_groups | map(attribute='group_id')
+    prefix: security_groups
+
   # Create a group for each value of the Application tag
   - key: tags.Application
     separator: ''
+
   # Create a group per region e.g. aws_region_us_east_2
   - key: placement.region
     prefix: aws_region
+
   # Create a group (or groups) based on the value of a custom tag "Role" and add them to a metagroup called "project"
   - key: tags['Role']
     prefix: foo
-    parent_group: "project"
+    parent_group: project
+
 # Set individual variables with compose
 compose:
   # Use the private IP address to connect to the host