Cannot specify existing SecurityGroup for autoscaling.AutoScalingGroup

Note: for support questions, please first reference our documentation, then use Stackoverflow. This repository’s issues are intended for feature requests and bug reports.

• I’m submitting a …

  • 🪲 bug report
  • [x ] 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior? If the current behavior is a 🪲bug🪲: Please provide the steps to reproduce

Currently the AutoScalingGroup always creates a new SecurityGroup per auto-scaling-group.js:

        this.securityGroup = new ec2.SecurityGroup(this, 'InstanceSecurityGroup', {
            vpc: props.vpc,
            allowAllOutbound: props.allowAllOutbound !== false
        });

• What is the expected behavior (or behavior of feature suggested)?

Ideally we could specify an existing ec2.SecurityGroup that could be used.

• What is the motivation / use case for changing the behavior or adding this feature?

Corporate policy forbids ordinary users like myself from creating security groups, so all attempts to use AWS CDK will result in 403 forbidden unless I can use an existing security group.

• Please tell us about your environment:

  • CDK CLI Version: 1.1.0 (build 1a11e96)
  • Module Version: aws-autoscaling@1.1.0
  • OS: OSX Mojave
  • Language: TypeScript

• Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc)

[knutster]

I would actually say this is a bug since the default security group cannot be modified in any way except for declaring that all outgoing connections are permitted.

[tvb]

If you are defining new infrastructure in CDK, there is a good chance you won’t have to interact with this class at all. Like IAM Roles, Security Groups need to exist to control access between AWS resources, but CDK will automatically generate and populate them with least-privilege permissions for you so you can concentrate on your business logic. All Constructs that require Security Groups will create one for you if you don’t specify one at construction. After construction, you can selectively allow connections to and between constructs via–for example-- the instance.connections object. Think of it as “allowing connections to your instance”, rather than “adding ingress rules a security group”. See the Allowing Connections section in the library documentation for examples. Direct manipulation of the Security Group through addIngressRule and addEgressRule is possible, but mutation through the .connections object is recommended.

but CDK will automatically generate and populate them with least-privilege permissions

How is defaulting to “egress allow all” providing least-privilege permissions?