aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::EC2::SecurityGroup] - [Enhancement] - Allow Updates to Rule Descriptions Without Disruption

Open
#2,259 0 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::EC2::SecurityGroup

### Resource name

_No response_

### Description

### Current Behavior and APIs

Currently, when updating Security Group rule descriptions using the `AWS::EC2::SecurityGroup` [1] resource in CloudFormation, the process involves removing existing rules and recreating them with new descriptions. This is done through a sequence of `RevokeSecurityGroupIngress` [2] / `RevokeSecurityGroupEgress` [3] followed by `AuthorizeSecurityGroupIngress` [4] / `AuthorizeSecurityGroupEgress` [5] API calls, which can lead to potential service disruptions.

AWS EC2 already provides dedicated APIs (`UpdateSecurityGroupRuleDescriptionsIngress` [6] and `UpdateSecurityGroupRuleDescriptionsEgress` [7]) that allow for in-place updates of security group rule descriptions without rule recreation. These APIs are currently utilized by the standalone `AWS::EC2::SecurityGroupIngress` [8] and `AWS::EC2::SecurityGroupEgress` [9] resources, but not by the `AWS::EC2::SecurityGroup` [1] resource.

### Proposed Change

Enhance the `AWS::EC2::SecurityGroup` [1] resource to use the `UpdateSecurityGroupRuleDescriptions*` [6][7] APIs when only the description field of security group rules is being modified.

This change would eliminate service disruption during description modifications and align the behavior with the standalone Security Group Ingress/Egress resources (`AWS::EC2::SecurityGroupIngress` [8] and `AWS::EC2::SecurityGroupEgress` [9] ).

### Current vs Desired Behavior

**Current:**
```
Update Description → RevokeSecurityGroup* → AuthorizeSecurityGroup*
```

**Desired:**
```
Update Description → Direct Update Using UpdateSecurityGroupRuleDescriptions*
```

### Technical Impact

This change would require updating the CloudFormation to detect description-only changes and route them to the appropriate API calls, while maintaining the current behavior for other types of rule modifications.

### References

[1] - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-securitygroup.html
[2] - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupIngress.html
[3] - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_RevokeSecurityGroupEgress.html
[4] - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html
[5] - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupEgress.html
[6] - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UpdateSecurityGroupRuleDescriptionsIngress.html
[7] - https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_UpdateSecurityGroupRuleDescriptionsEgress.html
[8] - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-securitygroupingress.html
[9] - https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-securitygroupegress.html

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::EC2::SecurityGroup resource behavior and compare it with the standalone AWS::EC2::SecurityGroupIngress and AWS::EC2::SecurityGroupEgress resources. Review the referenced UpdateSecurityGroupRuleDescriptionsIngress and UpdateSecurityGroupRuleDescriptionsEgress APIs alongside the revoke and authorize APIs. Done means description-only changes use the update APIs without rule recreation, while other rule changes retain current behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.