Ref SecuityGroup id's that will be created by the template in yaml config ?

[aduzsardi]

Hi,
I would like to define all the securitygroup rules in a config file for a stack , the problem is that beside the regular cidr,ports allow/deny rules i would like to also add the rules that will reference the security groups that will be created by this stack/template.

Is this possible ?

i.e.

rules:
- IpProtocol: "tcp"
  FromPort: "80"
  ToPort: "80"
  CidrIp: "10.0.0.0/8"
- IpProtocol: "tcp"
  FromPort: "80"
  ToPort: "80"
  SourceSecurityGroupId: Ref security group that will be created by the template/stack

is this possible with sceptre configs ?

Thank you!

[1oglop1]

This depends on your template, but it is possible to write template using python and troposphere to do so. All you need to do is to check for SourceSecurityGroupId and then process the reference.

[aduzsardi]

The template is python and yes , i know you can reference the security group using troposphere's Ref class but i wonder if there's some kind of trick to add the security group that will be created in the stacks's config file instead

let's say have some rules in mystack.yaml

template_path:  mystack.py
sceptre_user_data:
  rules:
    - IpProtocol: "tcp"
      FromPort: "80"
      ToPort: "80"
      CidrIp: "10.0.0.0/8"
    - IpProtocol: "tcp"
      FromPort: "80"
      ToPort: "80"
      SourceSecurityGroupId: "my-sec-group-name"

i want to iterate over this rules with a AWS::EC2::SecurityGroupIngress resource and where my-sec-group-name will be created by this template/stack :)

I guess this si probably not possible

[aduzsardi]

I figured it out , if anybody is interested i'll add an example

[ralthi]

Yes, Please add a sample

[aduzsardi]

i added an example in this repository https://github.com/aduzsardi/sceptre-example
of course you could create some wrapper functions to deal with different parameter series or ingress vs egress (inbound , outbound)
Also if IpProtocol = -1 , FromPort and ToPort should not be specified as parameters for ingress or egress rules (it will work , but it will be seen as drifted if you check the drift status) and possible some other quirks .

btw , i'm still on sceptre 1.4.2 so you'll probably need to change the path for the template in the yaml config if you're using version 2+ , let me know if something is not clear.

[thetumper]

Example is no longer available? :(