Skip to content

Commit

Permalink
fix(ec2): Invalid security group ID
Browse files Browse the repository at this point in the history
When using any of the static methods `fromLookup`, `fromLookupById`, `fromLookupByName` the context provider responsible for doing the lookup will be provided with dummy values:

```
{
  securityGroupId: 'sg-12345678',
  allowAllOutbound: true,
}
```

These values will apply during the construction phase. The actual lookup happens at a later stage.

Unfortunately, the dummy value for `securityGroupId` is invalid – at least according to the input validation defined in the `peer` module:
https://github.com/aws/aws-cdk/blob/9d1b2c7b1f0147089f912c32a61d7ba86edb543c/packages/@aws-cdk/aws-ec2/lib/peer.ts#L224

This means that any attempt to reference an existing security group retrieved through `fromLookup…()` as a peer causes an exception to be thrown during the construction phase (before CDK even attempts to perform the lookup).

Example code:

```
const sg = ec2.SecurityGroup.fromLookupByName(this, "Group", "group-name", vpc);
const peer = ec2.Peer.securityGroupId(sg.securityGroupId);
```

Example output:

```
$ cdk synth
> Error: Invalid security group ID: "sg-12345"
>   at new SecurityGroupId (/Users/jsc/code/trustpilot/appmesh-demo/node_modules/aws-cdk-lib/aws-ec2/lib/peer.js:1:2617)
>   at Function.securityGroupId (/Users/jsc/code/trustpilot/appmesh-demo/node_modules/aws-cdk-lib/aws-ec2/lib/peer.js:1:549)
```

Changing the dummy value to match the expected pattern will allow the construction phase to complete, the lookup will come into play, and the synth will complete without errors and with the actual ID of the referenced security group rendered in the resulting CloudFormation template.
  • Loading branch information
schourode committed Nov 10, 2022
1 parent 93915f1 commit 9250950
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion packages/@aws-cdk/aws-ec2/lib/security-group.ts
Expand Up @@ -432,7 +432,7 @@ export class SecurityGroup extends SecurityGroupBase {
vpcId: options.vpc?.vpcId,
},
dummyValue: {
securityGroupId: 'sg-12345',
securityGroupId: 'sg-12345678',
allowAllOutbound: true,
} as cxapi.SecurityGroupContextResponse,
}).value;
Expand Down

0 comments on commit 9250950

Please sign in to comment.