aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::EC2::SecurityGroup] - [BUG] - drift does not determine SecurityGroupIngress changes when property list is empty
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EC2::SecurityGroup
### Resource Name
_No response_
### Issue Description
Create a ```AWS::EC2::SecurityGroup``` resource with "SecurityGroupIngress" property value as empty list in cloudformation stack. Then, add an ingress rule to this security group manually (from outside the stack).
During drift detection, drift result show AWS::EC2::SecurityGroup resource status as 'In_Sync'. Drift does not determine SecurityGroupIngress changes when property list is empty.
### Expected Behavior
Drift detection identifies changes to "SecurityGroupIngress" property and shows status 'Modified'.
### Observed Behavior
Drift result shows ```AWS::EC2::SecurityGroup``` status as 'In_Sync'
### Test Cases
```
Resources:
TestSecurityGroup:
Type: AWS::EC2::SecurityGroup
Properties:
GroupDescription: description
VpcId:
SecurityGroupIngress: []
SecurityGroupEgress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: 0.0.0.0/0
```
### Other Details
_No response_
Contributor guide
Research direction
No source file or test path is provided. Reproduce the issue with the supplied AWS::EC2::SecurityGroup template, add an ingress rule outside the stack, and run drift detection; done means the resource is reported as Modified with the SecurityGroupIngress change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 48/100