Skip to content

Commit abc78bf

Browse files
jdukewichjdukewich
authored
feat(ec2): security group lookup via filters (#30625)
### Issue # (if applicable) Closes #30331. ### Reason for this change This will improve the security group lookup functionality for importing existing security groups into a CDK stack. ### Description of changes I added the ability to lookup existing security groups via more filters. Filters are supported by the [DescribeSecurityGroups API](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DescribeSecurityGroups.html), and using these filters can be immensely useful for looking up existing security groups, especially if your account or organization follows predictable rules regarding things like security group tags. ### Description of how you validated changes I added unit tests similar to the ones that test the normal lookup by ID or name. ### Checklist - [x] My code adheres to the [CONTRIBUTING GUIDE](https://github.com/aws/aws-cdk/blob/main/CONTRIBUTING.md) and [DESIGN GUIDELINES](https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md) ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*
1 parent b17bd1d commit abc78bf

File tree

21 files changed

+1485
-26
lines changed

21 files changed

+1485
-26
lines changed

‎packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.security-group-lookup.js.snapshot/LookupStack.assets.json

+20
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.security-group-lookup.js.snapshot/LookupStack.template.json

+36
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"Parameters": {
3+
"BootstrapVersion": {
4+
"Type": "AWS::SSM::Parameter::Value<String>",
5+
"Default": "/cdk-bootstrap/hnb659fds/version",
6+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
7+
}
8+
},
9+
"Rules": {
10+
"CheckBootstrapVersion": {
11+
"Assertions": [
12+
{
13+
"Assert": {
14+
"Fn::Not": [
15+
{
16+
"Fn::Contains": [
17+
[
18+
"1",
19+
"2",
20+
"3",
21+
"4",
22+
"5"
23+
],
24+
{
25+
"Ref": "BootstrapVersion"
26+
}
27+
]
28+
}
29+
]
30+
},
31+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
32+
}
33+
]
34+
}
35+
}
36+
}

‎packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.security-group-lookup.js.snapshot/SgLookupTestDefaultTestDeployAssert9466B7BF.assets.json

+19
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.security-group-lookup.js.snapshot/SgLookupTestDefaultTestDeployAssert9466B7BF.template.json

+36
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.security-group-lookup.js.snapshot/StackWithSg.assets.json

+34
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/@aws-cdk-testing/framework-integ/test/aws-ec2/test/integ.security-group-lookup.js.snapshot/StackWithSg.template.json

+233
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
{
2+
"Resources": {
3+
"MyVpcF9F0CA6F": {
4+
"Type": "AWS::EC2::VPC",
5+
"Properties": {
6+
"CidrBlock": "10.0.0.0/16",
7+
"EnableDnsHostnames": true,
8+
"EnableDnsSupport": true,
9+
"InstanceTenancy": "default",
10+
"Tags": [
11+
{
12+
"Key": "Name",
13+
"Value": "my-vpc-name"
14+
}
15+
]
16+
}
17+
},
18+
"MyVpcRestrictDefaultSecurityGroupCustomResourceA4FCCD62": {
19+
"Type": "Custom::VpcRestrictDefaultSG",
20+
"Properties": {
21+
"ServiceToken": {
22+
"Fn::GetAtt": [
23+
"CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E",
24+
"Arn"
25+
]
26+
},
27+
"DefaultSecurityGroupId": {
28+
"Fn::GetAtt": [
29+
"MyVpcF9F0CA6F",
30+
"DefaultSecurityGroup"
31+
]
32+
},
33+
"Account": "12345678"
34+
},
35+
"UpdateReplacePolicy": "Delete",
36+
"DeletionPolicy": "Delete"
37+
},
38+
"CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0": {
39+
"Type": "AWS::IAM::Role",
40+
"Properties": {
41+
"AssumeRolePolicyDocument": {
42+
"Version": "2012-10-17",
43+
"Statement": [
44+
{
45+
"Action": "sts:AssumeRole",
46+
"Effect": "Allow",
47+
"Principal": {
48+
"Service": "lambda.amazonaws.com"
49+
}
50+
}
51+
]
52+
},
53+
"ManagedPolicyArns": [
54+
{
55+
"Fn::Sub": "arn:${AWS::Partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
56+
}
57+
],
58+
"Policies": [
59+
{
60+
"PolicyName": "Inline",
61+
"PolicyDocument": {
62+
"Version": "2012-10-17",
63+
"Statement": [
64+
{
65+
"Effect": "Allow",
66+
"Action": [
67+
"ec2:AuthorizeSecurityGroupIngress",
68+
"ec2:AuthorizeSecurityGroupEgress",
69+
"ec2:RevokeSecurityGroupIngress",
70+
"ec2:RevokeSecurityGroupEgress"
71+
],
72+
"Resource": [
73+
{
74+
"Fn::Join": [
75+
"",
76+
[
77+
"arn:",
78+
{
79+
"Ref": "AWS::Partition"
80+
},
81+
":ec2:test-region:12345678:security-group/",
82+
{
83+
"Fn::GetAtt": [
84+
"MyVpcF9F0CA6F",
85+
"DefaultSecurityGroup"
86+
]
87+
}
88+
]
89+
]
90+
}
91+
]
92+
}
93+
]
94+
}
95+
}
96+
]
97+
}
98+
},
99+
"CustomVpcRestrictDefaultSGCustomResourceProviderHandlerDC833E5E": {
100+
"Type": "AWS::Lambda::Function",
101+
"Properties": {
102+
"Code": {
103+
"S3Bucket": "cdk-hnb659fds-assets-12345678-test-region",
104+
"S3Key": "bde7b5c89cb43285f884c94f0b9e17cdb0f5eb5345005114dd60342e0b8a85a1.zip"
105+
},
106+
"Timeout": 900,
107+
"MemorySize": 128,
108+
"Handler": "__entrypoint__.handler",
109+
"Role": {
110+
"Fn::GetAtt": [
111+
"CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0",
112+
"Arn"
113+
]
114+
},
115+
"Runtime": "nodejs18.x",
116+
"Description": "Lambda function for removing all inbound/outbound rules from the VPC default security group"
117+
},
118+
"DependsOn": [
119+
"CustomVpcRestrictDefaultSGCustomResourceProviderRole26592FE0"
120+
]
121+
},
122+
"MySgAFDC270F2": {
123+
"Type": "AWS::EC2::SecurityGroup",
124+
"Properties": {
125+
"GroupDescription": "StackWithSg/MySgA",
126+
"SecurityGroupEgress": [
127+
{
128+
"CidrIp": "0.0.0.0/0",
129+
"Description": "Allow all outbound traffic by default",
130+
"IpProtocol": "-1"
131+
}
132+
],
133+
"Tags": [
134+
{
135+
"Key": "myTag",
136+
"Value": "my-value"
137+
}
138+
],
139+
"VpcId": {
140+
"Ref": "MyVpcF9F0CA6F"
141+
}
142+
}
143+
},
144+
"MySgB343D3C61": {
145+
"Type": "AWS::EC2::SecurityGroup",
146+
"Properties": {
147+
"GroupDescription": "StackWithSg/MySgB",
148+
"SecurityGroupEgress": [
149+
{
150+
"CidrIp": "0.0.0.0/0",
151+
"Description": "Allow all outbound traffic by default",
152+
"IpProtocol": "-1"
153+
}
154+
],
155+
"Tags": [
156+
{
157+
"Key": "myTagKey",
158+
"Value": "true"
159+
}
160+
],
161+
"VpcId": {
162+
"Ref": "MyVpcF9F0CA6F"
163+
}
164+
}
165+
},
166+
"MySgC50C8732C": {
167+
"Type": "AWS::EC2::SecurityGroup",
168+
"Properties": {
169+
"GroupDescription": "my-description",
170+
"SecurityGroupEgress": [
171+
{
172+
"CidrIp": "0.0.0.0/0",
173+
"Description": "Allow all outbound traffic by default",
174+
"IpProtocol": "-1"
175+
}
176+
],
177+
"VpcId": {
178+
"Ref": "MyVpcF9F0CA6F"
179+
}
180+
}
181+
},
182+
"MySgDA51BA0C2": {
183+
"Type": "AWS::EC2::SecurityGroup",
184+
"Properties": {
185+
"GroupDescription": "ownerId description",
186+
"SecurityGroupEgress": [
187+
{
188+
"CidrIp": "0.0.0.0/0",
189+
"Description": "Allow all outbound traffic by default",
190+
"IpProtocol": "-1"
191+
}
192+
],
193+
"VpcId": {
194+
"Ref": "MyVpcF9F0CA6F"
195+
}
196+
}
197+
}
198+
},
199+
"Parameters": {
200+
"BootstrapVersion": {
201+
"Type": "AWS::SSM::Parameter::Value<String>",
202+
"Default": "/cdk-bootstrap/hnb659fds/version",
203+
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
204+
}
205+
},
206+
"Rules": {
207+
"CheckBootstrapVersion": {
208+
"Assertions": [
209+
{
210+
"Assert": {
211+
"Fn::Not": [
212+
{
213+
"Fn::Contains": [
214+
[
215+
"1",
216+
"2",
217+
"3",
218+
"4",
219+
"5"
220+
],
221+
{
222+
"Ref": "BootstrapVersion"
223+
}
224+
]
225+
}
226+
]
227+
},
228+
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
229+
}
230+
]
231+
}
232+
}
233+
}

0 commit comments

Comments
 (0)