aws / aws/aws-cdk

aws-ec2: SecurityGroupIngress resources create volatile, stage-scope dependent names

Open
#30,588 2 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-ec2 bug p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
1d 19h
Merged PRs (30d)
74

Description

### Describe the bug

After placing an existing Stack into a Stage, and even when hard-coding the Stack name to the one deployed, there's a large diff produced, where each `AWS::EC2::SecurityGroupIngress` (`CfnSecurityGroupIngress`) resource inherits the Stage name.

```diff
- DBSecurityGroupfromrdsdbfoodevDBSecurityGroup8C2C7014IndirectPort2D31B69D
+ DBSecurityGroupfromdevrdsdbfoodevDBSecurityGroup15286DE1IndirectPort48BD0C23
# ^^^ This is the stage name being added
```

### Expected Behavior

Stage name should not leak into the naming scope, when Stack names are provided.

### Current Behavior

Stage name affects the resource IDs.

### Reproduction Steps

Already described in the bug.

### Possible Solution

N/A

### Additional Information/Context

Probably happens here:

https://github.com/aws/aws-cdk/blob/3c36fe968e2f2c121e5bfc828100a9e7dafb5c26/packages/aws-cdk-lib/aws-ec2/lib/security-group.ts#L93-L98

Why is the `scope` value (not `this`) passed to `CfnSecurityGroupIngress`?

### CDK CLI Version

2.144.0

### Framework Version

_No response_

### Node.js Version

v20.14.0

### OS

macOS

### Language

TypeScript

### Language Version

_No response_

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the diff after placing an existing Stack into a Stage while hard-coding the deployed Stack name. Inspect packages/aws-cdk-lib/aws-ec2/lib/security-group.ts around lines 93-98, focusing on how CfnSecurityGroupIngress receives its scope. Done means SecurityGroupIngress resource IDs no longer include the Stage name when Stack names are provided, with the behavior verified against the reproduction.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.