Has anyone successfully used AWS native to do secu...
# awss
sparse-library-18327
05/12/2025, 8:48 PMHas anyone successfully used AWS native to do security group referencing across the transit gateway with another account id?
I have the configuration there. Both the transit gateway and all attachments are enabled for security group referencing. I can create rules that reference the security group with the AWS cli, and I've compared the responses logged in cloudtrail for the AWS cli vs pulumi. The response provided by AWS is the same, but pulumi handles it as a failure.
error: creating resource: reading resource state: operation error CloudControl: GetResource, https response error StatusCode: 400, RequestID: b43587c9-ea8c-49db-84e9-0eb5b8fdc060, ResourceNotFoundException: AWS:EC2:SecurityGroupIngress Handler returned status FAILED: The security group 'sg-12345678901234' does not exist (Service: Ec2, Status Code: 400, Request ID: 00ee5f94-abde-486f-b1dd-ed8db9a5fa99) (SDK Attempt Count: 1) (HandlerErrorCode: NotFound, RequestToken: 9003f0ad-11ba-48f7-883b-8d96e669a95d)
I can see in the details of pulumi up that it is providing the right values, including the account id to reference.
I haven't found any options to do the references with the aws library instead of aws-native which would enable me to continue. I expect this error will probably result in a bug ticket for aws native.
l
little-cartoon-10569
05/12/2025, 8:54 PMDoes the user/role you're using in the Pulumi provider have auth to read the security group in the other account?
s
sparse-library-18327
05/12/2025, 8:56 PMIt's the same user which successfully created it via the cli
sparse-library-18327
05/12/2025, 8:57 PMThere's nothing in the https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-security-group-referencing-for-aws-transit-gateway/ guide about any cross account iam setup required to grant a user access to a security group in the other account
sparse-library-18327
05/12/2025, 8:57 PMit doesn't require a RAM share.
sparse-library-18327
05/12/2025, 8:58 PMIt only requires the transit gateway and attachment security group referencing
sparse-library-18327
05/12/2025, 8:58 PMand aws is sending the same successful response to pulumi
sparse-library-18327
05/12/2025, 9:02 PMAlso, it does actually create the ingress rule, but pulumi is erroring
l
little-cartoon-10569
05/12/2025, 9:03 PMAh. That's strange. Sounds like a bug report might be the right way to go.
s
stocky-restaurant-98004
05/12/2025, 9:42 PMCurious why you're using AWS CC (FKA AWS Native)
s
sparse-library-18327
05/13/2025, 1:04 PMI didn't see any security group rule methods within aws that supports referencing security groups across accounts via an account id
sparse-library-18327
05/13/2025, 1:07 PMhttps://www.pulumi.com/registry/packages/aws-native/api-docs/ec2/securitygroupingress/
has:
Copy code
source_security_group_id: Optional[str] = None,
source_security_group_owner_id: Optional[str] = None,l
little-cartoon-10569
05/13/2025, 7:30 PMIt doesn't? I thought it was just the 2nd part of the ARN.
little-cartoon-10569
05/13/2025, 7:31 PMI admit to not having seen those new resources before. I only have the EC2 resources in my code. I've had none of the problems you're describing.
I'll just leave that there.
;)