[BUG] [SM] Phase 2 SecurityGroup Error about aws-secure-environment-accelerator HOT 2 CLOSED

Fixed in 1.5.9

from aws-secure-environment-accelerator.

@AWSElectionsQuebec Where did you see this in the doc?

According to the documentation this is invalid but should not fail the stack
“You must specify only one of the following sources: an IPv4 or IPv6 address range, a prefix list, or a security group. Otherwise, the stack launches successfully, but the rule is not added to the security group.”
Ref : https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-securitygroupingress.html

We are having the exact same error with out stack but the template we use has not changed at all. The stack was created correctly before and now it's throwing this error. Did something changed recently in AWS? as in around February?

For context we are using an EB configuration:

  aws:autoscaling:launchconfiguration:
    SecurityGroups: default
    SSHSourceRestriction: tcp, 22, 22, Some Security Group Name

This application is deployed in the default VPC so we should be able to specify the SG name.

For security groups in a nondefault VPC, you must specify the group ID.

Only for deployment in non-default VPC you need the id.

This is transformed in the following CloudFormation rule:

  "Resources": {
    "AWSEBSecurityGroupSSHIngress": {
      "Properties": {
        "GroupName": { "Ref": "AWSEBSecurityGroup" },
        "FromPort": "22",
        "ToPort": "22",
        "SourceSecurityGroupName": "Some Security Group Name",
        "IpProtocol": "tcp"
      },
      "Type": "AWS::EC2::SecurityGroupIngress"
    },

and fails on creation of the stack with this same error for the logical ID "AWSEBSecurityGroupSSHIngress":

Resource handler returned message: "Exactly one of CidrIp, CidrIpv6, SourceSecurityGroupId, and SourcePrefixListId must be specified and not empty" (RequestToken: xxxx, HandlerErrorCode: InvalidRequest)

from aws-secure-environment-accelerator.