terraform-aws-modules / terraform-aws-security-group

Terraform module to create AWS Security Group resources 🇺🇦
https://registry.terraform.io/modules/terraform-aws-modules/security-group/aws
Other
564 stars 1.08k forks source link

fix: Remove `prefix_list_ids` attribute from `*_with_self` resouces #324

Closed SSW-SCIENTIFIC closed 1 month ago

SSW-SCIENTIFIC commented 4 months ago

Description

aws_security_group_rule with both self = true and non-empty prefix_list_ids generates multiple (# of self + # of prefix_list_ids) rules for self and each prefix_list_ids, for example,

resource "aws_security_group_rule" "ingress_with_self" {
  security_group_id = local.this_sg_id
  type              = "ingress"

  self            = true
  prefix_list_ids = ["id1", "id2"]
  description     = "sample"

  from_port = -1
  to_port   = -1
  protocol  = "-1"
}

then we get the rules not only allow all-all from self SG, but also allow all-all from prefix-list id1 and allow all-all from prefix-list id2. I think this is unexpected result, ingress_with_self itself should only add rule to allow self SG, so remove prefix_list_ids attribute from *_with_self resouces.

Motivation and Context

Described as above.

Breaking Changes

This change avoid creating SG rules allow all-all from each prefix-list, this is breaking change.

How Has This Been Tested?

titouan-joseph commented 3 months ago

Same thing with *_with_cidr_blocks

Edit : Open #325 for this

github-actions[bot] commented 2 months ago

This PR has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this PR will be closed in 10 days

titouan-joseph commented 2 months ago

@antonbabenko @bryantbiggs This PR is similar to #325, please have a look on both PR

We are still blocking for production, we are waiting for this update

github-actions[bot] commented 1 month ago

This PR has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this PR will be closed in 10 days

github-actions[bot] commented 1 month ago

This PR was automatically closed because of stale in 10 days

github-actions[bot] commented 1 day ago

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.