Support for SourceSecurityGroupId under SecurityGroupEgress in AWS::EC2::SecurityGroup

cfn-lint version: (cfn-lint --version) cfn-lint 0.7.3

Description of issue. For some reason I get:

E3002 Invalid Property Resources/LaServiceEndpointSecurityGroup/Properties/SecurityGroupEgress/0/SourceSecurityGroupId
template.yml:1483:9

for

  LaServiceEndpointSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: LaServiceEndpointSecurityGroup
      GroupDescription: Security Group for VPC endpoints in the Lambda subnets
      SecurityGroupEgress:
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        SourceSecurityGroupId:
          Fn::GetAtt: [LambdaCanCallLaServiceSecurityGroup, GroupId]
      SecurityGroupIngress:
      - IpProtocol: tcp
        FromPort: 443
        ToPort: 443
        SourceSecurityGroupId:
          Fn::GetAtt: [LambdaCanCallLaServiceSecurityGroup, GroupId]
      VpcId:
        Ref: VPC
      Tags:
        - Key: Name
          Value: LaServiceEndpointSecurityGroup
        - Key: Stage
          Value: {Ref: Stage}

The odd part is it doesn’t complain about SourceSecurityGroupId under SecurityGroupIngress only SecurityGroupEgress

[cmmeyer]

Ok, that’s so WEIRD – I ran it myself and it looks like the CloudFormation workflow is treating the SourceSecurityGroupId as a DestinationSecurityGroupId. This kind of makes sense since the underlying API (AuthorizeSecurityGroupEgress) doesn’t differentiate and simply has a parameter called “GroupId”.

I’m going to cut a ticket with the CloudFormation team. Seems silly to have differentiated properties on the CFN side if they’re just going to lump them together on the API side, but I would say in general this is behavior as expected within the linter.

Are you ok with changing your template to use DestinationSecurityGroupId per the docs/spec for now and we’ll treat this a CloudFormation issue?

[kddejong]

@cmmeyer can you take this one? Looks like another case of weirdness with the documentation/spec/API.

@Hamitamaru we rely on the CloudFormation spec a lot for this. I cut and pasted the appropriate section below for reference and that property isn’t specified.

Looks like the documentation matches the spec.

So the API may take SourceSecurityGroupId. My guess is you should be using DestinationSecurityGroupId but something is still allowing SourceSecurityGroupId which isn’t documented?

    "AWS::EC2::SecurityGroup.Egress": {
      "Documentation": "http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-rule.html",
      "Properties": {
        "CidrIp": {... },
        "CidrIpv6": { ... },
        "Description": { ... },
        "DestinationPrefixListId": { ... },
        "DestinationSecurityGroupId": { ... },
        "FromPort": { ... },
        "IpProtocol": { ... },
        "ToPort": { ... }
      }