https://pulumi.com logo
Join Slack
Powered by
I have a security group defined like this: ``` let...
# general
f
I have a security group defined like this:
Copy code
let lbSecurityGroup = new aws.ec2.SecurityGroup("fib-lb-sg", {
    namePrefix: "fib-lb-sg",
    ingress: [{
        protocol: "tcp",
        fromPort: 80,
        toPort: 80,
        cidrBlocks: ["0.0.0.0/0"]
    }],
    egress: [{
        protocol: "-1",
        fromPort: 0,
        toPort: 0,
        cidrBlocks: ["0.0.0.0/0"]
    }],
    vpcId: network.vpcId
});
After running 
pulumi up
, I get this message:
Copy code
updating urn:pulumi:fibonacci-dev::fibonacci::aws:ec2/securityGroup:SecurityGroup::fib-lb-sg: from_port (80) and to_port (80) must both be 0 to use the 'ALL' "-1" protocol!
Not sure what it is talking about.
m
was the update modifying an existing security group?
f
Yes. I changed the ingress rule.
m
Did it use "-1" as its protocol before?
f
Yes
m
kk, let me see if I can repro this
possible that we're pulling that in as a default for some reason
do you also have 
aws.ec2.SecurityGroupRule
resources, or does the 
aws.ec2.SecurityGroup
define all of its rules inline?
f
All rules inline.
m
just for kicks, can you try "TCP" instead of "tcp"?
f
Added the ingress rule via AWS console then running 
pulumi refresh
followed by 
pulumi update
fixes it.
Lemme see if I can get into that state again.
m
That would be great. So far I've been unable to repro that as well.
Which versions of the packages are you working with?
f
Copy code
"dependencies": {
        "@pulumi/pulumi": "0.16.6",
        "@pulumi/aws": "0.16.2",
        "@pulumi/aws-infra": "0.16.2",
        "@pulumi/cloud-aws": "0.16.0",
        "@pulumi/cloud": "0.16.0"
    }
Simply changing from tcp to -1 to tcp does not do it.
m
Hm. That's quite odd.
f
I think I got it. Go from
Copy code
{
    protocol: "tcp",
        fromPort: 80,
    toPort: 80,
    cidrBlocks: ["0.0.0.0/0"]
}
to
Copy code
{
    protocol: "-1",
        fromPort: 80,
    toPort: 80,
    cidrBlocks: ["0.0.0.0/0"]
}
to
Copy code
{
    protocol: "-1",
        fromPort: 0,
    toPort: 0,
    cidrBlocks: ["0.0.0.0/0"]
}
m
That second configuration should not be allowed
Are you able to successfully run a 
pulumi update
with
Copy code
{
    protocol: "-1",
        fromPort: 80,
    toPort: 80,
    cidrBlocks: ["0.0.0.0/0"]
}
?
f
Right. It failed deployment. But then going from the second to third resulted in the above exception.
m
okay, I can repro this
hoo boy, that is weird
can you file an issue in pulumi-aws?
my guess is that there's some bad interaction with terraform here
good to know that a 
refresh
unblocked you
f
I've somehow managed to hit this multiple times. Some combo of refresh and/or stack export | import usually fixes things.
m
cc @stocky-spoon-28903
f
Open in Slack
PreviousNext
Powered by