[aws-ecs-patterns] `NetworkLoadBalancedFargateService` should allow controlling security group's `allowAllOutbound`setting

Given a Fargate service backed by a NLB created using ecsPatterns.NetworkLoadBalancedFargateService, when I try to modify the outbound rules on the associated security group using

service.service.connections.allowTo(
            Peer.ipv4(service.cluster.vpc.vpcCidrBlock),
            ec2.Port.allTraffic(),
            "Allow outbound traffic to the VPC on any TCP port");

the change in the code is not reflected in CloudFormation.

allowFrom* statements work successfully and update the inbound rules of the security group.

Reproduction Steps

const service = new ecsPatterns.NetworkLoadBalancedFargateService(this, 'Service', {...});

//this works:
service.service.connections.allowFrom(
            Peer.ipv4(service.cluster.vpc.vpcCidrBlock),
            ec2.Port.tcp(EcsServiceStack.securedServicePort),
            "Allow traffic from within the VPC to the service secure port");

// this does not work:
        service.service.connections.allowTo(
            Peer.ipv4(service.cluster.vpc.vpcCidrBlock),
            ec2.Port.allTraffic(),
            "Allow outbound traffic to the VPC on any TCP port");

What did you expect to happen?

I expected the security group associated with the service to have an outbound rule to allow traffic to the VPC’s CIDR block on all ports

What actually happened?

The security group has the default outbound rule to allow all traffic

Environment

• CLI Version :
• Framework Version: 1.32.2
• Node.js Version: v12.18.2
• OS Mac OS Catalina 10.15.6 :
• **Language (Version): TypeScript 3.8.3 **

Other

---

This is 🐛 Bug Report

[mllefler]

Just found this comment in aws-ec2.SecurityGroupImportOptions:

 /**
     * Mark the SecurityGroup as having been created allowing all outbound traffic
     *
     * Only if this is set to false will egress rules be added to this security
     * group. Be aware, this would undo any potential "all outbound traffic"
     * default.
     *
     * @experimental
     * @default true
     */
    readonly allowAllOutbound?: boolean;

It explains why changes to the egress rules are ignored.

My recommendation would be:

1. Fail with an error if an egress rule is added to a security group with allowAllOutbound=true
2. Add a property to the creation of NetworkLoadBalancedFargateService that will allow setting allowAllOutbound=false

[mllefler]

What is not working in your current setup? Are your connections failing?

Connections are not failing and everything works. However, I would like to have the ability to tighten the security of the service.