[ECS] Why "securityGroups" fromClusterAttributes mandatory ?

When using ECS with EC2 instances (hosts), no pb; but when using Fargate, we don’t have any Security Group associated with the container instances registered to the cluster, so why it’s needed at the import ?

Reproduction Steps

For example, you create a Cluster in a Stack A :

    const EcsCluster = new ecs.Cluster(this, 'EcsCluster', {
      vpc: vpc,
      clusterName: EcsClusterName,
      containerInsights: true
    });

     const SecurityGroupEcsHost = new ec2.SecurityGroup(this, 'SecurityGroupEcsHost', {
       vpc: vpc,
       allowAllOutbound: true,
       description: 'Security Group for ECS Host'
     });

    AutoScalingGroupEcsHost.addSecurityGroup(SecurityGroupEcsHost);

    EcsCluster.addAutoScalingGroup(AutoScalingGroupEcsHost;

And you want to create an ECS EC2Service in another Stack B :

clusterName: EcsClusterName,
vpc,
securityGroups: [SecurityGroupEcsHost]
});

No pb at this time because on the first Stack, you have provided SGR & ASG resources for Hosts Instances.

What did you expect to happen?

But now, I want to create ECS Fargate resources on the other Stack, and the SGR is created on this one because associated with Fargate Service.

    const EcsClusterFargate = new ecs.Cluster(this, 'EcsClusterFargate ', {
      vpc: vpc,
      clusterName: EcsClusterFargateName,
      containerInsights: true
    });

But in that case, I can’t import the dedicated Cluster like that :

const EcsClusterFargate = ecs.Cluster.fromClusterAttributes(this, 'EcsCluster', {
clusterName: EcsClusterFargateName,
vpc
});

So, why it’s mandatory ? Do I have to attach a fake SGR ?

Environment

• CLI Version : 1.68.0
• Framework Version: 6.14.8
• Node.js Version: v12.15.0
• OS : Linux
• Language (Version): TypeScript

---

This is 🐛 Bug Report

[frankwese]

the securityGroups property can contain an empty array

const vpcId = StringParameter.valueFromLookup(this, `/${stage}/VpcId`);
const cluster = ecs.Cluster.fromClusterAttributes(this, 'ImportedCluster', {
      clusterName: cdk.Fn.importValue(`${stage}-ClusterName`),
      vpc: ec2.Vpc.fromLookup(this, 'VPC', { vpcId}),
      securityGroups: [],
    })

[ranma2913]

the securityGroups property can contain an empty array

const vpcId = StringParameter.valueFromLookup(this, `/${stage}/VpcId`);
const cluster = ecs.Cluster.fromClusterAttributes(this, 'ImportedCluster', {
      clusterName: cdk.Fn.importValue(`${stage}-ClusterName`),
      vpc: ec2.Vpc.fromLookup(this, 'VPC', { vpcId}),
      securityGroups: [],
    })

This fixed my lookup issue. Thanks so much!