aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::EC2::SecurityGroup] - [BUG] - drift does not determine SecurityGroupIngress changes when property list is empty

Open
#2,091 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::SecurityGroup

### Resource Name

_No response_

### Issue Description

Create a ```AWS::EC2::SecurityGroup``` resource with "SecurityGroupIngress" property value as empty list in cloudformation stack. Then, add an ingress rule to this security group manually (from outside the stack).
During drift detection, drift result show AWS::EC2::SecurityGroup resource status as 'In_Sync'. Drift does not determine SecurityGroupIngress changes when property list is empty.

### Expected Behavior

Drift detection identifies changes to "SecurityGroupIngress" property and shows status 'Modified'.

### Observed Behavior

Drift result shows ```AWS::EC2::SecurityGroup``` status as 'In_Sync'

### Test Cases

```
Resources:
TestSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: description
VpcId:
SecurityGroupIngress: []
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0

```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

No source file or test path is provided. Reproduce the issue with the supplied AWS::EC2::SecurityGroup template, add an ingress rule outside the stack, and run drift detection; done means the resource is reported as Modified with the SecurityGroupIngress change.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.