Suppose there's a permission referencing security groups in another VPC.
ec2 'vpc-xxxxxx' do
security_group 'sample-x' do # sg-xxxxxx
end
security_group 'test' do
permission :tcp, 80..80 do
groups('sg-xxxxxx', 'sg-yyyyyy')
end
end
end
ec2 'vpc-yyyyyy' do
security_group 'sample-y' do # sg-yyyyyy
end
end
When I try to delete some of them, it fails unexpectedly.
ec2 'vpc-xxxxxx' do
security_group 'sample-x' do # sg-xxxxxx
end
security_group 'test' do
permission :tcp, 80..80 do
groups('sg-xxxxxx') # Revoke sg-yyyyyy
end
end
end
ec2 'vpc-yyyyyy' do
security_group 'sample-y' do # sg-yyyyyy
end
end
% piculet -a Groupfile
Apply `/path/to/Groupfile` to SecurityGroup
Delete Permission: vpc-xxxxxx > test(ingress) > tcp 80..80
revoke sample-y
[ERROR] Can't find SecurityGroup: 012345678901/sample-y in vpc-xxxxxx
It seems normalizing security groups to their name isn't a good idea for cross-VPC permissions.
Suppose there's a permission referencing security groups in another VPC.
When I try to delete some of them, it fails unexpectedly.
It seems normalizing security groups to their name isn't a good idea for cross-VPC permissions.