https://pulumi.com logo
#general
Title
# general
b

bitter-island-28909

05/28/2020, 7:15 PM
Just started getting a perplexing error. Creating a standard security group, just like I have with Pulumi a dozen times before, and started getting this error:
Copy code
Error authorizing security group ingress rules: InvalidPermission.Malformed: Unsupported IP protocol "-1"  - supported: [tcp, udp, icmp]
Very strange, because “-1” is clearly supported in the docs and hasn’t given me any problems up until now.
g

gentle-diamond-70147

05/28/2020, 7:19 PM
Is this AWS or GCP or some other provider? Do you know what changed? Did you upgrade the Pulumi CLI or provider package?
b

bitter-island-28909

05/28/2020, 7:22 PM
AWS. Yes, I updated Pulumi to 2.3.0. Last time I’m sure it worked was probably 2.10
g

gentle-diamond-70147

05/28/2020, 7:24 PM
What version of pulumi/aws are you using?
b

bitter-island-28909

05/28/2020, 7:28 PM
Copy code
"@pulumi/pulumi": "^2.0.0",
        "@pulumi/aws": "^2.0.0",
        "@pulumi/awsx": "^0.20.0",
upgrading those and trying again…
same results with pulumi/pulumi=2.3.0, pulumi/aws=2.6.0, & pulumi/awsx=0.20.0
g

gentle-diamond-70147

05/28/2020, 7:50 PM
And this is specifically on a
SecurityGroup
or
SecurityGroupRule
resource?
b

bitter-island-28909

05/28/2020, 7:51 PM
it’s an
aws.ec2.SecurityGroup
resource
g

gentle-diamond-70147

05/28/2020, 8:08 PM
Can you share your
aws.ec2.SecurityGroup
code?
b

bitter-island-28909

05/28/2020, 8:11 PM
certainly, one moment (going to unwrap some convenience functions I was using, for clarity)
@gentle-diamond-70147 ok, well, in the process of cleaning up my example, I found the problem. The VPC ID was ending up undefined due to an error unwinding a Pulumi output variable. It worked when I hardcoded the VPC ID. That was a super misleading error message, though. Didn’t even suspect the VPC wasn’t making it in. Thanks for your help and patience!
g

gentle-diamond-70147

05/28/2020, 8:17 PM
Ah, interesting.
So I'm guessing the SG was getting created in "classic" EC2?
b

bitter-island-28909

05/28/2020, 8:35 PM
my account is that old, but I thought I had created a new-style VPC to work in.
g

gentle-diamond-70147

05/28/2020, 9:19 PM
If the VPC ID is undefined, the SG will end up in "classic" in that case.