https://pulumi.com logo
Title
e

enough-leather-70274

03/09/2021, 11:24 PM
Hi folks - how do I setup a SecurityGroupRule to allow all ICMP IPv4 traffic from a specific prefix list?
l

little-cartoon-10569

03/09/2021, 11:30 PM
protocol: "icmp", cidrBlocks: prefixList
. Afaik you shouldn't need fromPort and toPort for "all" ICMP traffic, only certain ICMP traffic cares about those.
e

enough-leather-70274

03/09/2021, 11:30 PM
Yeah Docs say if protocol is "icmp" I need to provide ICMP type number in
from_port
and ICMP code in the
to_port
, both of which are required... but that doesn't make sense as ICMP codes are error type indicators.
l

little-cartoon-10569

03/09/2021, 11:31 PM
Hmm.. I'll see if I can find the code...
e

enough-leather-70274

03/09/2021, 11:31 PM
Thanks @little-cartoon-10569 - unfortunately pulumi throws errors if I don't specify from and to ports
(using python)
l

little-cartoon-10569

03/09/2021, 11:32 PM
Looks like all types are in the range 0 to 254.. try those?
e

enough-leather-70274

03/09/2021, 11:36 PM
Nope, that results in the following:
Type				Protocol	Port range
Custom ICMP - IPv4	Echo Reply	254
I'm looking for :
Type			Protocol	Port range
All ICMP - IPv4	ICMP		All
l

little-cartoon-10569

03/09/2021, 11:41 PM
-1? Though as far as I know, "All" is used only when protocol = -1, and that means "all protocols and ports".
But the protocol should definitely read ICMP, not Echo Reply...
e

enough-leather-70274

03/09/2021, 11:43 PM
So... -1 in
from_port
?
Well type 0 is echo reply
l

little-cartoon-10569

03/09/2021, 11:44 PM
I'd try -1 in both ports... I can't find AWS docs on this though, I'm just guessing.
For the ICMP protocol, you must also specify the ICMP type and code. You can use -1 for the type or code to mean all types or all codes.
e

enough-leather-70274

03/09/2021, 11:49 PM
Yup, that's got it.
Pulumi doesn't use CF tho right? Be boto I imagine.
ToPort [...] A value of -1 indicates all ICMP/ICMPv6 codes. If you specify all ICMP/ICMPv6 types, you must specify all codes.
Thanks for your help @little-cartoon-10569.
l

little-cartoon-10569

03/10/2021, 12:42 AM
Yep, doesn't use CF, but they both use the same server-side API, so the values for properties should be identical, unless the client libraries do extra things to the values.
Doesn't use boto either. Uses the API that boto uses though 🙂
e

enough-leather-70274

03/10/2021, 12:46 AM
Gotcha... so this one :)
l

little-cartoon-10569

03/10/2021, 12:49 AM
Yep, looks good. Didn't know about that site, of course it had to exist, didn't it? Bookmarked now..
1