aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
AWS::EC2::SecurityGroup Egress duplicate rules causes unintended deletion
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EC2::SecurityGroup
### Resource Name
_No response_
### Issue Description
This issue is highlighted within this Issue for the Ingress Rules:
https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/612
Within the Egress section of an AWS::EC2::SecurityGroup Resource, if you happen to accidentally supply a duplicate Rule entry, CloudFormation allows you to create the resource.
If you happen to spot the duplicate rule and delete the duplicate Rule, CloudFormation triggers a deletion workflow for that singular Rule. Because when duplicate rules are supplied to the AWS::EC2::SecurityGroup Ingress or Egress properties, only one of the Rules specified are applied. Due to this, it causes an unintended deletion of duplicated Rule.
### Expected Behavior
Duplicate Rules are caught at either the Template Validation Level or at the EC2 API level and CloudFormation Exception handling to account for this specific issue
### Observed Behavior
CloudFormation ignores the Duplicate Rule application attempt failure. This causes a silent failure within the Resource that could ultimately cause unintended deletion moving forward since CloudFormation considers both rules present on the Stack.
### Test Cases
Below is my test Template to highlight the issue that occurs within the Egress Rule and the Ingress Rule property when duplicates are provided:
Deploy this Template:
```
AWSTemplateFormatVersion: 2010-09-09
Parameters:
VPCID:
Type: AWS::EC2::VPC::Id
Resources:
TestSg:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: Test duplicate ingress
VpcId: !Ref VPCID
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
```
Update the Stack with this Template to remove the Duplicate Entries:
```
AWSTemplateFormatVersion: 2010-09-09
Parameters:
VPCID:
Type: AWS::EC2::VPC::Id
Resources:
TestSg:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: Test duplicate ingress
VpcId: !Ref VPCID
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
```
You will observe that no Rules are now on the Security Group for the Ingress and the Egress Rule, Stack Drift detection shows that the duplicated rules are missing on the Resource, and we now observe a drift between the expected and actual results:

### Other Details
The Proposed workaround within the following Github issue may offer an ideal resolution regarding the duplicate entries issue, however the root problem of the Resource not accounting for the "Client.InvalidPermission.Duplicate" Error Code that is passed by the EC2 API is the true root problem for both the Ingress and Egress rules properties.
https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/1532
Contributor guide
Research direction
Start by reviewing the linked ingress issue 612 and workaround issue 1532, then reproduce the behavior with the supplied AWS::EC2::SecurityGroup templates. Compare the initial deployment and update results, including drift detection. Done means duplicate ingress and egress rules are rejected or handled without silently deleting the remaining rule.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100