bug: duplicate EC2 security group rules #11512
Comments
|
Hello 👋! It looks like this issue hasn’t been active in longer than five months. We encourage you to check if this is still an issue in the latest release. In the absence of more information, we will be closing this issue soon. If you find that this is still a problem, please feel free to provide a comment or upvote with a reaction on the initial post to prevent automatic closure. If the issue is already closed, please feel free to open a new one. |
|
This is still an issue in LocalStack 4.1.1 (build date: |
|
Hi @mcieno - sorry for the late reply. |
|
Hi @dfangl, unsure what change fixed this but yes, it's resolved in 4.4.0 🎉 Thank you |
Uh oh!
There was an error while loading. Please reload this page.
Is there an existing issue for this?
Current Behavior
Some security group rules added via
ec2:AuthorizeSecurityGroupIngressare duplicated.Expected Behavior
Security group rules should not be duplicated.
How are you starting LocalStack?
With a docker-compose file
Steps To Reproduce
How are you starting localstack
Client commands
Create a security group
Add some rules
awslocal ec2 authorize-security-group-ingress \ --group-id="${group_id}" \ --ip-permissions='[ { "FromPort": 1, "ToPort": 2, "IpProtocol": "tcp", "IpRanges": [{ "CidrIp": "127.0.0.1/32", "Description": "first rule" }] }, { "FromPort": 1, "ToPort": 2, "IpProtocol": "tcp", "IpRanges": [{ "CidrIp": "127.0.0.2/32", "Description": "second rule" }] } ]'Output
{ "Return": true, "SecurityGroupRules": [ { "SecurityGroupRuleId": "sgr-19b625c802efc975a", "GroupId": "sg-95594140376c802f5", "GroupOwnerId": "000000000000", "IsEgress": false, "IpProtocol": "tcp", "FromPort": 1, "ToPort": 2, "CidrIpv4": "127.0.0.2/32", "Description": "second rule", "Tags": [] } ] }Make sure the rules have been added correctly
awslocal ec2 describe-security-group-rules \ --filters="Name=group-id,Values=${group_id}"Output
{ "SecurityGroupRules": [ { "SecurityGroupRuleId": "sgr-c397ed63f861a0362", "GroupId": "sg-95594140376c802f5", "GroupOwnerId": "000000000000", "IsEgress": false, "IpProtocol": "tcp", "FromPort": 1, "ToPort": 2, "CidrIpv4": "127.0.0.1/32", "Description": "first rule", "Tags": [] }, { "SecurityGroupRuleId": "sgr-19b625c802efc975a", "GroupId": "sg-95594140376c802f5", "GroupOwnerId": "000000000000", "IsEgress": false, "IpProtocol": "tcp", "FromPort": 1, "ToPort": 2, "CidrIpv4": "127.0.0.2/32", "Description": "second rule", "Tags": [] }, { "SecurityGroupRuleId": "sgr-6773f91e11c3ff172", "GroupId": "sg-95594140376c802f5", "GroupOwnerId": "000000000000", "IsEgress": true, "IpProtocol": "-1", "FromPort": -1, "ToPort": -1, "CidrIpv4": "0.0.0.0/0", "Tags": [] } ] }Invoke
ec2:DescribeSecurityGroupsoperationOutput
{ "SecurityGroups": [ { "Description": "default VPC security group", "GroupName": "default", "IpPermissions": [], "OwnerId": "000000000000", "GroupId": "sg-9897979fa57feca88", "IpPermissionsEgress": [ { "IpProtocol": "-1", "IpRanges": [ { "CidrIp": "0.0.0.0/0" } ], "Ipv6Ranges": [], "PrefixListIds": [], "UserIdGroupPairs": [] } ], "Tags": [], "VpcId": "vpc-226bb034" }, { "Description": "Just an example", "GroupName": "example", "IpPermissions": [ { "FromPort": 1, "IpProtocol": "tcp", "IpRanges": [ { "CidrIp": "127.0.0.1/32", "Description": "first rule" }, { "CidrIp": "127.0.0.2/32", "Description": "second rule" } ], "Ipv6Ranges": [], "PrefixListIds": [], "ToPort": 2, "UserIdGroupPairs": [] } ], "OwnerId": "000000000000", "GroupId": "sg-95594140376c802f5", "IpPermissionsEgress": [ { "IpProtocol": "-1", "IpRanges": [ { "CidrIp": "0.0.0.0/0" } ], "Ipv6Ranges": [], "PrefixListIds": [], "UserIdGroupPairs": [] } ], "Tags": [], "VpcId": "vpc-226bb034" } ] }Check the rules again,
second ruleis now duplicatedawslocal ec2 describe-security-group-rules \ --filters="Name=group-id,Values=${group_id}"Output
{ "SecurityGroupRules": [ { "SecurityGroupRuleId": "sgr-c397ed63f861a0362", "GroupId": "sg-95594140376c802f5", "GroupOwnerId": "000000000000", "IsEgress": false, "IpProtocol": "tcp", "FromPort": 1, "ToPort": 2, "CidrIpv4": "127.0.0.1/32", "Description": "first rule", "Tags": [] }, { "SecurityGroupRuleId": "sgr-c397ed63f861a0362", "GroupId": "sg-95594140376c802f5", "GroupOwnerId": "000000000000", "IsEgress": false, "IpProtocol": "tcp", "FromPort": 1, "ToPort": 2, "CidrIpv4": "127.0.0.2/32", "Description": "second rule", "Tags": [] }, { "SecurityGroupRuleId": "sgr-19b625c802efc975a", "GroupId": "sg-95594140376c802f5", "GroupOwnerId": "000000000000", "IsEgress": false, "IpProtocol": "tcp", "FromPort": 1, "ToPort": 2, "CidrIpv4": "127.0.0.2/32", "Description": "second rule", "Tags": [] }, { "SecurityGroupRuleId": "sgr-6773f91e11c3ff172", "GroupId": "sg-95594140376c802f5", "GroupOwnerId": "000000000000", "IsEgress": true, "IpProtocol": "-1", "FromPort": -1, "ToPort": -1, "CidrIpv4": "0.0.0.0/0", "Tags": [] } ] }Environment
Anything else?
I observed that immediately after adding the rules everything looks normal. Yet, after invoking
ec2:DescribeSecurityGroups, the duplicates appear.Hence, it appears to me that this bug is related to some side effect of
ec2:DescribeSecurityGroupsoperation trying to group rules when, for example, "from" and "to" ports are the same.Also note how the output of
authorize-security-group-ingressis incorrect (it shows one rule instead of two).Debug logs
The text was updated successfully, but these errors were encountered: