aws / aws/aws-cdk

cdk synth : prints undefined for portless protocols

Open
#27,874 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-ec2 bug effort/small p2 package/tools
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

`cdk synth` prints a table of resources. For security groups, this table comprises:

* Group
* Dir(ection)
* Protocol
* Peer

The protocol printed for GRE is `47 undefined`. At a guess, it is printing the protocol name followed by the uninitialized port number. Because GRE, as with numerous other protocols, has no concepts of ports, it would be better to simply print `47` or ideally some variant of `GRE (47)`.

### Expected Behavior

Expected security group with inbound protocol 47 (GRE) printout:

```
┌───┬─────────────────────────────────┬─────┬──────────────┬──────────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼─────────────────────────────────┼─────┼──────────────┼──────────────────────┤
│ + │ ${sg1.GroupId} │ In │ All ICMP │ Everyone (IPv4) │
│ + │ ${sg1.GroupId} │ In │ TCP 22 │ Everyone (IPv4) │
│ + │ ${sg1.GroupId} │ In │ GRE 47 │ ${sg2.GroupId} │
├───┼─────────────────────────────────┼─────┼──────────────┼──────────────────────┤
```

### Current Behavior

Example of security group with inbound protocol 47 (GRE) allowed:

```
┌───┬─────────────────────────────────┬─────┬──────────────┬──────────────────────┐
│ │ Group │ Dir │ Protocol │ Peer │
├───┼─────────────────────────────────┼─────┼──────────────┼──────────────────────┤
│ + │ ${sg1.GroupId} │ In │ All ICMP │ Everyone (IPv4) │
│ + │ ${sg1.GroupId} │ In │ TCP 22 │ Everyone (IPv4) │
│ + │ ${sg1.GroupId} │ In │ 47 undefined │ ${sg2.GroupId} │
├───┼─────────────────────────────────┼─────┼──────────────┼──────────────────────┤
```

### Reproduction Steps

Pre-create an `ec2.VPC` and `ec2.SecurityGroup` and associate the following ingress rule with the latter:

```ts
const gre_ingress= new ec2.CfnSecurityGroupIngress(this, "gre01", {
ipProtocol: "47",
description: "Allow inbound GRE",
cidrIp: "192.168.1.0/24",
groupId: "yyy",
});
```

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.104.0

### Framework Version

_No response_

### Node.js Version

v18.17.1

### OS

Max OS X Sonoma

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by running the reported cdk synth reproduction with the TypeScript GRE ingress rule, then trace where the security-group table formats the protocol and port. Done means portless protocols no longer print an undefined value and GRE is displayed as 47 or as GRE 47, with the existing table output preserved.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cli, cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.