aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

AWS::EC2::SecurityGroup - Handle duplicates when defining SecurityGroupIngress as property of AWS::EC2::SecurityGroup

Open
#612 3 comments 9 reactions 0 assignees View on GitHub
Coverage
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

## 1. Title
#### Handle duplicates when defining SecurityGroupIngress as property of AWS::EC2::SecurityGroup

## 2. Scope of request
#### AWS::EC2::SecurityGroupIngress handles duplicates, however, when creating EC2 security group ingresses as a property of the security group resource (AWS::EC2::SecurityGroup) duplicates are not handled in the same way.

## 3. Expected behavior

If a duplicate entry is made in the SecurityGroupIngress property of "AWS::EC2::SecurityGroup" resource, CloudFormation should not show it as a drift. Also, the ingress rule should not be removed if only duplicate entry is removed from the ingress rules list.

Sample snippet to replicate -

```
AWSTemplateFormatVersion: 2010-09-09
Resources:
TestSg:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: Test duplicate ingress
VpcId:
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryA
- IpProtocol: tcp
FromPort: 8080
ToPort: 8080
CidrIp: 172.24.186.0/23
Description: EntryB (Duplicate)
```

Drift Result when this stack is created -
Screenshot 2020-08-21 at 10 02 21 AM

Drift Result when Duplicate ingress (EntryB) is removed in update -
Screenshot 2020-08-21 at 10 17 58 AM

Category - Compute

Contributor guide

Open the contributing guide

Research direction

Start with the AWS::EC2::SecurityGroup SecurityGroupIngress property and compare its duplicate handling with AWS::EC2::SecurityGroupIngress. Reproduce the supplied template, then verify that duplicate rules do not appear as drift and that removing only a duplicate does not remove the ingress rule.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.