chore(ec2): warn if egress rules are ignored

[NetaNir]

If allowAllOutbound is set to true, any call to addEgressRule will be ignored, this PR adds a warning.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[eladb]

Is it possible to include some info about which egress rule is ignored?

[NetaNir]

we can add the CIDR but Im not sure it will make a different since all rules are ignored when allowAllOutbound is set to true.

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Thank you for contributing! Your pull request will be updated from master and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[aws-cdk-automation]

AWS CodeBuild CI Report

• CodeBuild project: AutoBuildProject6AEA49D1-qxepHUsryhcu
• Commit ID: 0cb0eb4
• Result: SUCCEEDED
• Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

[rrrix]

Hi @NetaNir,

I run my CDK commands with --strict (e.g. cdk diff -e stack --strict --verbose).

I recently just upgraded to 1.54.0.

This change has now caused all commands to fail in --strict mode, particularly with with built-in L2 construct methods such as ecs.Cluster.addCapacity() (https://docs.aws.amazon.com/cdk/api/latest/docs/@aws-cdk_aws-ecs.Cluster.html#add-wbr-capacityid-options).

[Warning at /shared/ecs-cluster/t3microCapacity/InstanceSecurityGroup] Ignoring Egress rule since 'allowAllOutbound' is set to true; To add customize rules, set allowAllOutbound=false on the SecurityGroup
  ConstructNode.addWarning (/Users/user/code/cdk/node_modules/@aws-cdk/core/lib/construct-compat.ts:423:22)
  SecurityGroup.addEgressRule (/Users/user/code/cdk/node_modules/@aws-cdk/aws-ec2/lib/security-group.ts:407:17)
  /Users/user/code/cdk/node_modules/@aws-cdk/aws-ec2/lib/connections.ts:131:23
  ReactiveList.forEachAndForever (/Users/user/code/cdk/node_modules/@aws-cdk/aws-ec2/lib/connections.ts:267:7)
  /Users/user/code/cdk/node_modules/@aws-cdk/aws-ec2/lib/connections.ts:130:45
  ReactiveList.push (/Users/user/code/cdk/node_modules/@aws-cdk/aws-ec2/lib/connections.ts:260:9)
  Connections.addSecurityGroup (/Users/user/code/cdk/node_modules/@aws-cdk/aws-ec2/lib/connections.ts:117:28)
  Cluster.addAutoScalingGroup (/Users/user/code/cdk/node_modules/@aws-cdk/aws-ecs/lib/cluster.ts:195:34)
  Cluster.addCapacity (/Users/user/code/cdk/node_modules/@aws-cdk/aws-ecs/lib/cluster.ts:181:10)
  new SharedService (/Users/user/code/cdk/src/services/shared.ts:109:39)
  main (/Users/user/code/cdk/src/index.ts:82:18)
  Object.<anonymous> (/Users/user/code/cdk/src/index.ts:259:1)
  Module._compile (internal/modules/cjs/loader.js:1201:30)
  Module.m._compile (/Users/user/code/cdk/node_modules/ts-node/src/index.ts:858:23)
  Module._extensions..js (internal/modules/cjs/loader.js:1221:10)
  Object.require.extensions.<computed> [as .ts] (/Users/user/code/cdk/node_modules/ts-node/src/index.ts:861:12)
  Module.load (internal/modules/cjs/loader.js:1050:32)
  Function.Module._load (internal/modules/cjs/loader.js:938:14)
  Function.executeUserEntryPoint [as runMain] (internal/modules/run_main.js:71:12)
  internal/main/run_main_module.js:17:47
Found warnings (--strict mode)
Error: Found warnings (--strict mode)
    at StackCollection.processMetadataMessages (/Users/x37/git/rapticore/glass-comb/Infrastructure/cdk/node_modules/aws-cdk/lib/api/cxapp/cloud-assembly.ts:204:13)
    at CdkToolkit.validateStacks (/Users/x37/git/rapticore/glass-comb/Infrastructure/cdk/node_modules/aws-cdk/lib/cdk-toolkit.ts:425:12)
    at CdkToolkit.selectStacksForDiff (/Users/x37/git/rapticore/glass-comb/Infrastructure/cdk/node_modules/aws-cdk/lib/cdk-toolkit.ts:404:16)
    at processTicksAndRejections (internal/process/task_queues.js:93:5)
    at CdkToolkit.diff (/Users/x37/git/rapticore/glass-comb/Infrastructure/cdk/node_modules/aws-cdk/lib/cdk-toolkit.ts:81:20)
    at main (/Users/x37/git/rapticore/glass-comb/Infrastructure/cdk/node_modules/aws-cdk/bin/cdk.ts:223:16)
    at initCommandLine (/Users/x37/git/rapticore/glass-comb/Infrastructure/cdk/node_modules/aws-cdk/bin/cdk.ts:188:9)

Is this intended?

[NetaNir]

@rrrix, can you share the code that is producing the error, I tested:

const cluster = new ecs.Cluster(this, 'EcsCluster');
cluster.addCapacity('DefaultAutoScalingGroup', {
instanceType: new ec2.InstanceType('t2.micro'),
});

and couldn't reproduce.

I have added the warning since by default we create the securityGroup with allowAllOutbound set to true, which cause all subsequent calls to addEgressRule to ignore the added rule, resulting in a lot of confusion.