No Way To Assign Existing Security Groups To ECS Cluster

❓ General Issue

The Question

When I attempt to create a Cluster using the AWS CDK (Typescript) like so:

    const serverCluster = new ecs.Cluster(this, 'EcsServerCluster', { vpc: vpc })

    serverCluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MEDIUM),
    })

The CDK deploy blows up on the addCapacity call: 1/26 | 10:47:30 AM | CREATE_FAILED | AWS::EC2::SecurityGroup | EcsServerCluster/DefaultAutoScalingGroup/InstanceSecurityGroup (EcsServerClusterDefaultAutoScalingGroupInstanceSecurityGroupEE7A9C3D) API: ec2:CreateSecurityGroup You are not authorized to perform this operation.

I apparently need a way to pass existing security groups when establishing the cluster. When going through the AWS console to create an ECS cluster, you are allowed to specify existing subnets and security groups (for example) when creating a cluster.

I did notice that there was a connections property of ECS Cluster which is used to “Manage the allowed network connections for the cluster with Security Groups.” However, there appears to be no way to set it in the Typescript AWS CDK.

Environment

• CDK CLI Version: 1.13.1 (build 96cfc63)
• Module Version: aws-ecs
• OS: OSX Mojave
• Language: TypeScript

Other information

1/26 | 10:47:30 AM | CREATE_FAILED | AWS::EC2::SecurityGroup | EcsServerCluster/DefaultAutoScalingGroup/InstanceSecurityGroup (EcsServerClusterDefaultAutoScalingGroupInstanceSecurityGroupEE7A9C3D) API: ec2:CreateSecurityGroup You are not authorized to perform this operation.

[ShawnWu33]

Hi @joncantu @hencrice ,

I saw you add the security group to the cluster.connection however the default security group are always been created in EC2 DefaultAutoScalingGroup, with no inbound rules.

If you are trying add your security group to your ec2 resources that used by your cluster, here is the way: (the following code is using aws-cdk@1.4.7

    const serverCluster = new ecs.Cluster(this, 'EcsServerCluster', { vpc: vpc })

     /***
       * This method adds compute capacity to a cluster by creating an AutoScalingGroup with the specified options.
       * and return the AutoScalingGroup
       */
    const autoScalingGroup = serverCluster.addCapacity('DefaultAutoScalingGroup', {
      instanceType: ec2.InstanceType.of(ec2.InstanceClass.T2, ec2.InstanceSize.MEDIUM),
    })
    // You can add security group to the autoScalingGroup
    autoScalingGroup.addSecurityGroup(yourSecurityGroup);

I have tested this solution and it works, the security group added here would be added to the ec2 instance created by your ecs cluster and tasks

[yukihirai0505]

I also had the same issue. It has been solved by the @ShawnWu33 's approach. Thank you.