aws-cdk: cdk ls throws RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
We have the gitlab cicd pipeline which runs a docker based out of python-3.8-alpine image.
We perform *cdk ls* operation and it fails with following error:
```
fn = alambda.DockerImageFunction(
File "/usr/local/lib/python3.8/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
File "/usr/local/lib/python3.8/site-packages/aws_cdk/aws_lambda/__init__.py", line 26367, in __init__
jsii.create(self.__class__, self, [scope, id, props])
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 334, in create
response = self.provider.create(
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 365, in create
return self._process.send(request, CreateResponse)
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 342, in send
raise RuntimeError(resp.error) from JavaScriptError(resp.stack)
RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.
Subprocess exited with error 1
```
On removing allowAllOutbound from my SecurityGroups, it works as expected.
[allowAllOutbound](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_lambda/FunctionOptions.html#aws_cdk.aws_lambda.FunctionOptions.allow_all_outbound) with a value of true is supposed to be the default anyway.
Similar Discussion here - https://github.com/aws/aws-cdk/discussions/27669
### Expected Behavior
Since its default value, it should not be failing anyway on explicitly specifying it.
### Current Behavior
```
fn = alambda.DockerImageFunction(
File "/usr/local/lib/python3.8/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
File "/usr/local/lib/python3.8/site-packages/aws_cdk/aws_lambda/__init__.py", line 26367, in __init__
jsii.create(self.__class__, self, [scope, id, props])
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 334, in create
response = self.provider.create(
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 365, in create
return self._process.send(request, CreateResponse)
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 342, in send
raise RuntimeError(resp.error) from JavaScriptError(resp.stack)
RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.
Subprocess exited with error 1
```
### Reproduction Steps
Won't be able to share complete code -
Docker image from python [3.8-alpine](https://github.com/docker-library/python/blob/bcb484c9ef3b745f9a5b05854a875efc79a7db10/3.8/alpine3.18/Dockerfile)
Add/Install npm, cdk cli, aws-cdk-lib
Create a Security Group for a lambda function and use allow_all_outboud= True. If will fail
### Possible Solution
_No response_
### Additional Information/Context
_No response_
### CDK CLI Version
2.110.1
### Framework Version
_No response_
### Node.js Version
v18.18.2
### OS
Linux Alpine Image
### Language
Python
### Language Version
Python 3.8.18
### Other information
python3 --version
Python 3.8.18
node --version
v18.18.2
aws --version
aws-cli/2.13.5 Python/3.11.6 Linux/5.15.0-1049-aws source/x86_64.alpine.3 prompt/off
cdk --version
2.110.1
npm --version
9.6.6
Note: The issue is seen only when cdk ls is run inside the docker container and not locally.
Contributor guide
Research direction
Start by reproducing the DockerImageFunction setup in the Python 3.8 Alpine container with aws-cdk-lib 2.110.1, focusing on an explicitly configured SecurityGroup and allow_all_outbound=True. Trace the validation that raises the RuntimeError and compare it with local cdk ls behavior; done means the container command succeeds and a regression test covers the explicit default setting.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, node.js, python, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100