Self-referencing SecurityGroups

[cfndsl]

Self-referencing SecurityGroups

[kenong]

Hi Josh,

Have you tried something like this:

...
  Resource("WebSecurityGroup") {
    Type "AWS::EC2::SecurityGroup"
    Property "GroupDescription", "Security policies for web servers"
    Property "VpcId", "vpc-b543o123"
  }

  Resource("WebSecurityGroupIngress") {
    Type "AWS::EC2::SecurityGroupIngress"
    Property "GroupId", Ref("WebSecurityGroup")
    Property "IpProtocol", "tcp"
    Property "FromPort", 8080
    Property "ToPort", 8080
    Property "SourceSecurityGroupId", Ref("WebLBSecurityGroup")
  }

  Resource("WebSecurityGroupIngress8080") {
    Type "AWS::EC2::SecurityGroupIngress"
    Property "GroupId", Ref("WebSecurityGroup")
    Property "IpProtocol", "tcp"
    Property "FromPort", 8080
    Property "ToPort", 8080
    Property "SourceSecurityGroupId", Ref("WebSecurityGroup")
  }

  Resource("WebSecurityGroupEgress8080") {
    Type "AWS::EC2::SecurityGroupEgress"
    Property "GroupId", Ref("WebSecurityGroup")
    Property "IpProtocol", "tcp"
    Property "FromPort", 8080
    Property "ToPort", 8080
    Property "DestinationSecurityGroupId", Ref("WebSecurityGroup")
  }
...

it produced this for me:

...
      "WebSecurityGroup" : {
         "Type" : "AWS::EC2::SecurityGroup",
         "Properties" : {
            "VpcId" : "vpc-b543o123",
            "GroupDescription" : "Security policies for web servers"
         }
      },
      "WebSecurityGroupIngress" : {
         "Type" : "AWS::EC2::SecurityGroupIngress",
         "Properties" : {
            "ToPort" : 8080,
            "GroupId" : {
               "Ref" : "WebSecurityGroup"
            },
            "FromPort" : 8080,
            "SourceSecurityGroupId" : {
               "Ref" : "WebLBSecurityGroup"
            },
            "IpProtocol" : "tcp"
         }
      },
      "WebSecurityGroupIngress8080" : {
         "Type" : "AWS::EC2::SecurityGroupIngress",
         "Properties" : {
            "ToPort" : 8080,
            "GroupId" : {
               "Ref" : "WebSecurityGroup"
            },
            "FromPort" : 8080,
            "SourceSecurityGroupId" : {
               "Ref" : "WebSecurityGroup"
            },
            "IpProtocol" : "tcp"
         }
      },
      "WebSecurityGroupEgress8080" : {
         "Type" : "AWS::EC2::SecurityGroupEgress",
         "Properties" : {
            "DestinationSecurityGroupId" : {
               "Ref" : "WebSecurityGroup"
            },
            "ToPort" : 8080,
            "GroupId" : {
               "Ref" : "WebSecurityGroup"
            },
            "FromPort" : 8080,
            "IpProtocol" : "tcp"
         }
      },
...

[howech]

@kenong, while the code you show gives the correct output, it avoids all of the type checking mechanisms that cfndsl has to offer. An equivalent snippet that should produce the same results is

  EC2_SecurityGroup(:WebSecurityGroup) {                                                                           
    GroupDescription "Security policies for web servers"                                                           
    VpcId "vpc-b543o123"                                                                                           
  }                                                                                                                

  EC2_SecurityGroupIngress(:WebSecurityGroupIngress) {                                                             
    GroupId Ref(:WebSecurityGroup)                                                                                 
    IpProtocol "tcp"                                                                                               
    FromPort 8080                                                                                                  
    ToPort 8080                                                                                                    
    SourceSecurityGroupId Ref(:WebSecurityGroup)                                                                   
  }                                                                                                                

  EC2_SecurityGroupIngress(:WebSecurityGroupIngress8080) {                                                         
   GroupId Ref(:WebSecurityGroup)                                                                                  
   IpProtocol "tcp"                                                                                                
   FromPort 8080                                                                                                   
   ToPort 8080                                                                                                     
   SourceSecurityGroupId Ref(:WebSecurityGroup)                                                                    
  }                                                                                                                

  EC2_SecurityGroupEgress(:WebSecurityGroupEgress8080) {                                                           
    GroupId Ref(:WebSecurityGroup)                                                                                 
    IpProtocol "tcp"                                                                                               
    FromPort 8080                                                                                                  
    ToPort 8080                                                                                                    
    DestinationSecurityGroupId Ref(:WebSecurityGroup)                                                              
  }        

However, it turns out there are some typos in aws_types.yaml in the source code that cause this to not work. Expect a pull request and fix soon.

[howech]

I think that this issue is fixed.