aws / aws/aws-cdk

aws-cdk: cdk ls throws RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.

Open
#28,170 7 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-lambda bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

We have the gitlab cicd pipeline which runs a docker based out of python-3.8-alpine image.

We perform *cdk ls* operation and it fails with following error:

```
fn = alambda.DockerImageFunction(
File "/usr/local/lib/python3.8/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
File "/usr/local/lib/python3.8/site-packages/aws_cdk/aws_lambda/__init__.py", line 26367, in __init__
jsii.create(self.__class__, self, [scope, id, props])
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 334, in create
response = self.provider.create(
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 365, in create
return self._process.send(request, CreateResponse)
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 342, in send
raise RuntimeError(resp.error) from JavaScriptError(resp.stack)
RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.
Subprocess exited with error 1
```

On removing allowAllOutbound from my SecurityGroups, it works as expected.

[allowAllOutbound](https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_lambda/FunctionOptions.html#aws_cdk.aws_lambda.FunctionOptions.allow_all_outbound) with a value of true is supposed to be the default anyway.

Similar Discussion here - https://github.com/aws/aws-cdk/discussions/27669

### Expected Behavior

Since its default value, it should not be failing anyway on explicitly specifying it.

### Current Behavior

```
fn = alambda.DockerImageFunction(
File "/usr/local/lib/python3.8/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
File "/usr/local/lib/python3.8/site-packages/aws_cdk/aws_lambda/__init__.py", line 26367, in __init__
jsii.create(self.__class__, self, [scope, id, props])
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 334, in create
response = self.provider.create(
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 365, in create
return self._process.send(request, CreateResponse)
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 342, in send
raise RuntimeError(resp.error) from JavaScriptError(resp.stack)
RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.
Subprocess exited with error 1
```

### Reproduction Steps

Won't be able to share complete code -

Docker image from python [3.8-alpine](https://github.com/docker-library/python/blob/bcb484c9ef3b745f9a5b05854a875efc79a7db10/3.8/alpine3.18/Dockerfile)

Add/Install npm, cdk cli, aws-cdk-lib

Create a Security Group for a lambda function and use allow_all_outboud= True. If will fail

### Possible Solution

_No response_

### Additional Information/Context

_No response_

### CDK CLI Version

2.110.1

### Framework Version

_No response_

### Node.js Version

v18.18.2

### OS

Linux Alpine Image

### Language

Python

### Language Version

Python 3.8.18

### Other information

python3 --version
Python 3.8.18
node --version
v18.18.2
aws --version
aws-cli/2.13.5 Python/3.11.6 Linux/5.15.0-1049-aws source/x86_64.alpine.3 prompt/off

cdk --version
2.110.1

npm --version
9.6.6

Note: The issue is seen only when cdk ls is run inside the docker container and not locally.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the DockerImageFunction setup in the Python 3.8 Alpine container with aws-cdk-lib 2.110.1, focusing on an explicitly configured SecurityGroup and allow_all_outbound=True. Trace the validation that raises the RuntimeError and compare it with local cdk ls behavior; done means the container command succeeds and a regression test covers the explicit default setting.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, node.js, python, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.