aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::EC2::SecurityGroup Egress duplicate rules causes unintended deletion

Open
#1,534 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::SecurityGroup

### Resource Name

_No response_

### Issue Description

This issue is highlighted within this Issue for the Ingress Rules:
https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/612

Within the Egress section of an AWS::EC2::SecurityGroup Resource, if you happen to accidentally supply a duplicate Rule entry, CloudFormation allows you to create the resource.

If you happen to spot the duplicate rule and delete the duplicate Rule, CloudFormation triggers a deletion workflow for that singular Rule. Because when duplicate rules are supplied to the AWS::EC2::SecurityGroup Ingress or Egress properties, only one of the Rules specified are applied. Due to this, it causes an unintended deletion of duplicated Rule.

### Expected Behavior

Duplicate Rules are caught at either the Template Validation Level or at the EC2 API level and CloudFormation Exception handling to account for this specific issue

### Observed Behavior

CloudFormation ignores the Duplicate Rule application attempt failure. This causes a silent failure within the Resource that could ultimately cause unintended deletion moving forward since CloudFormation considers both rules present on the Stack.

### Test Cases

Below is my test Template to highlight the issue that occurs within the Egress Rule and the Ingress Rule property when duplicates are provided:

Deploy this Template:
```
AWSTemplateFormatVersion: 2010-09-09
Parameters:
VPCID:
Type: AWS::EC2::VPC::Id
Resources:
TestSg:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: Test duplicate ingress
VpcId: !Ref VPCID
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
```

Update the Stack with this Template to remove the Duplicate Entries:

```

AWSTemplateFormatVersion: 2010-09-09
Parameters:
VPCID:
Type: AWS::EC2::VPC::Id
Resources:
TestSg:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: Test duplicate ingress
VpcId: !Ref VPCID
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
```
You will observe that no Rules are now on the Security Group for the Ingress and the Egress Rule, Stack Drift detection shows that the duplicated rules are missing on the Resource, and we now observe a drift between the expected and actual results:

image

### Other Details

The Proposed workaround within the following Github issue may offer an ideal resolution regarding the duplicate entries issue, however the root problem of the Resource not accounting for the "Client.InvalidPermission.Duplicate" Error Code that is passed by the EC2 API is the true root problem for both the Ingress and Egress rules properties.

https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1532

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the linked ingress issue 612 and workaround issue 1532, then reproduce the behavior with the supplied AWS::EC2::SecurityGroup templates. Compare the initial deployment and update results, including drift detection. Done means duplicate ingress and egress rules are rejected or handled without silently deleting the remaining rule.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.