aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::EC2::SecurityGroup] - [BUG] - No IPv6 egress by default

Open
#2,241 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::SecurityGroup

### Resource Name

_No response_

### Issue Description

While the [AWS::EC2::SecurityGroup documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-securitygroup.html) says:

```text
If you do not specify an egress rule, we add egress rules that allow IPv4 and IPv6 traffic on all ports and protocols to any destination.
We do not add these rules if you specify your own egress rules.
```

Deploying a security group with no egress rule with CloudFormation results with only one IPv4 egress rule:

![Image](https://github.com/user-attachments/assets/7ae3abf0-5106-454a-8c17-d9d685127215)

### Expected Behavior

I expect the default IPv6 egress rule to be present once CloudFormation has deployed a security group template with no egress.

### Observed Behavior

See the screenshot in the issue description, no default IPv6 egress rule is deployed.

### Test Cases

Here is a template extract of the failing security group:

```yaml
TestLoadBalancerSecurityGroup:
Properties:
GroupDescription: Internet to load balancer firewall rules
SecurityGroupIngress:
- CidrIpv6: ::/0
FromPort: 80
IpProtocol: TCP
ToPort: 80
- CidrIp: '0.0.0.0/0'
FromPort: 80
IpProtocol: TCP
ToPort: 80
VpcId: !Ref 'VPC'
Type: AWS::EC2::SecurityGroup
```

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by deploying the YAML template shown in the issue through CloudFormation and inspect the resulting AWS::EC2::SecurityGroup egress rules, comparing IPv4 and IPv6 behavior with the linked AWS documentation. Done means the no-egress configuration produces the documented default IPv6 egress rule, with the observed behavior and any required coverage change verified.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.