aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[Drift Detection] AWS::EC2::SecurityGroup resource returns false positive drift for "SourceSecurityGroupName" property
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EC2::SecurityGroup
### Resource Name
_No response_
### Issue Description
AWS::EC2::Security Group resource returns false positive drift by ignoring the "SourceSecurityGroupName" property mentioned under Inbound rule (`AWS::EC2::SecurityGroupIngress` )
The drift details will incorrectly show that "SourceSecurityGroupName" is removed
### Expected Behavior
Resource should not be marked as Drifted. The SG has correct Inbound rule with correct Source SG assigned, with no changes made to SG rules outside of CFN
### Observed Behavior
"SourceSecurityGroupName" property under AWS::EC2::SecurityGroupIngress is reported as "REMOVED" which is a false positive drift.
- When we use `DescribeSecurityGroup` returns GroupId associated to ingress rule. However within the template we are specifying a SG group name. This causes a conflict and hence Cloudformation might be returning a false drift.
### Test Cases
```
Resources:
InstanceSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: Allow http to client host
InboundRule:
Type: AWS::EC2::SecurityGroupIngress
Properties:
IpProtocol: tcp
FromPort: 0
ToPort: 0
SourceSecurityGroupName: !Ref InstanceSecurityGroup
GroupName: !Ref InstanceSecurityGroup
```
- Create Stack with above template
- Once the stack is CreateComplete, detect drift
- InstanceSecurityGroup will be marked as DRIFTED with 'SourceSecurityGroupName' property as REMOVED/Missing.
### Other Details
_No response_
Contributor guide
Research direction
No repository file or test is mentioned. Reproduce the supplied AWS::EC2::SecurityGroup and AWS::EC2::SecurityGroupIngress template, create the stack, and run drift detection; the issue is done when SourceSecurityGroupName is no longer incorrectly reported as REMOVED.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100