aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[Drift Detection] AWS::EC2::SecurityGroup resource returns false positive drift for "SourceSecurityGroupName" property

Open
#1,524 0 comments 0 reactions 0 assignees View on GitHub
bug NeedTriage
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::SecurityGroup

### Resource Name

_No response_

### Issue Description

AWS::EC2::Security Group resource returns false positive drift by ignoring the "SourceSecurityGroupName" property mentioned under Inbound rule (`AWS::EC2::SecurityGroupIngress` )
The drift details will incorrectly show that "SourceSecurityGroupName" is removed

### Expected Behavior

Resource should not be marked as Drifted. The SG has correct Inbound rule with correct Source SG assigned, with no changes made to SG rules outside of CFN

### Observed Behavior

"SourceSecurityGroupName" property under AWS::EC2::SecurityGroupIngress is reported as "REMOVED" which is a false positive drift.

- When we use `DescribeSecurityGroup` returns GroupId associated to ingress rule. However within the template we are specifying a SG group name. This causes a conflict and hence Cloudformation might be returning a false drift.

### Test Cases

```
Resources:
InstanceSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Allow http to client host
InboundRule:
Type: AWS::EC2::SecurityGroupIngress
Properties:
IpProtocol: tcp
FromPort: 0
ToPort: 0
SourceSecurityGroupName: !Ref InstanceSecurityGroup
GroupName: !Ref InstanceSecurityGroup

```

- Create Stack with above template
- Once the stack is CreateComplete, detect drift
- InstanceSecurityGroup will be marked as DRIFTED with 'SourceSecurityGroupName' property as REMOVED/Missing.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

No repository file or test is mentioned. Reproduce the supplied AWS::EC2::SecurityGroup and AWS::EC2::SecurityGroupIngress template, create the stack, and run drift detection; the issue is done when SourceSecurityGroupName is no longer incorrectly reported as REMOVED.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.