No matter how you like to participate in developer communities, Pulumi wants to meet you there. If you want to meet other Pulumi users to share use-cases and best practices, contribute code or documentation, see us at an event, or just tell a story about something cool you did with Pulumi, you are part of our community.

Pulumi Community

`protocol: "icmp", cidrBlocks: prefixList`. Afaik you shouldn't need fromPort and toPort for "all" ICMP traffic, only certain ICMP traffic cares about those.

Yeah <https://www.pulumi.com/docs/reference/pkg/aws/ec2/securitygrouprule/|Docs say> if protocol is "icmp" I need to provide ICMP type number in `from_port`  and ICMP code in the `to_port` , both of which are required... but that doesn't make sense as ICMP codes are error type indicators.

Thanks <@U012UJTT55M>  - unfortunately pulumi throws errors if I don't specify from and to ports

Looks like all types are in the range 0 to 254.. try those?

Nope, that results in the following:
```Type				Protocol	Port range
Custom ICMP - IPv4	Echo Reply	254```

I'm looking for :
```Type			Protocol	Port range
All ICMP - IPv4	ICMP		All```


-1? Though as far as I know, "All" is used only when protocol = -1, and that means "all protocols and ports".

But the protocol should definitely read ICMP, not Echo Reply...

I'd try -1 in both ports... I can't find AWS docs on this though, I'm just guessing.

Ah found it in CloudFormation docs: <https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-security-group-egress.html>

&gt; For the ICMP protocol, you must also specify the ICMP type and code. You can use -1 for the type or code to mean all types or all codes. 

Pulumi doesn't use CF tho right? Be boto I imagine.

Got it: <https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ec2.html#EC2.SecurityGroup.ip_permissions>

&gt; ToPort [...] A value of -1 indicates all ICMP/ICMPv6 codes. If you specify all ICMP/ICMPv6 types, you must specify all codes.

Yep, doesn't use CF, but they both use the same server-side API, so the values for properties should be identical, unless the client libraries do extra things to the values.

Doesn't use boto either. Uses the API that boto uses though :slightly_smiling_face:

Gotcha... so <https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_AuthorizeSecurityGroupIngress.html|this one> :)

Yep, looks good. Didn't know about that site, of course it had to exist, didn't it? Bookmarked now..