aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap
[AWS::EC2::SecurityGroup] - [BUG] - No IPv6 egress by default
- Dominant language
- No language data
- Stars
- 1.1k
- Forks
- 62
- PR merge metrics
- No merged PRs in 30d
Description
### Name of the resource
AWS::EC2::SecurityGroup
### Resource Name
_No response_
### Issue Description
While the [AWS::EC2::SecurityGroup documentation](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-securitygroup.html) says:
```text
If you do not specify an egress rule, we add egress rules that allow IPv4 and IPv6 traffic on all ports and protocols to any destination.
We do not add these rules if you specify your own egress rules.
```
Deploying a security group with no egress rule with CloudFormation results with only one IPv4 egress rule:

### Expected Behavior
I expect the default IPv6 egress rule to be present once CloudFormation has deployed a security group template with no egress.
### Observed Behavior
See the screenshot in the issue description, no default IPv6 egress rule is deployed.
### Test Cases
Here is a template extract of the failing security group:
```yaml
TestLoadBalancerSecurityGroup:
Properties:
GroupDescription: Internet to load balancer firewall rules
SecurityGroupIngress:
- CidrIpv6: ::/0
FromPort: 80
IpProtocol: TCP
ToPort: 80
- CidrIp: '0.0.0.0/0'
FromPort: 80
IpProtocol: TCP
ToPort: 80
VpcId: !Ref 'VPC'
Type: AWS::EC2::SecurityGroup
```
### Other Details
_No response_
Contributor guide
Research direction
Start by deploying the YAML template shown in the issue through CloudFormation and inspect the resulting AWS::EC2::SecurityGroup egress rules, comparing IPv4 and IPv6 behavior with the linked AWS documentation. Done means the no-egress configuration produces the documented default IPv6 egress rule, with the observed behavior and any required coverage change verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100