Allow ICMP to have fromport other than -1 with to port -1

[kddejong]

Issue #, if available:
#2999

Description of changes:

• Allow ICMP to have fromport other than -1 with to port -1

When picking a certain ICMP protocol the FromPort is that selection and the ToPort are -1.

from the API

"IpPermissions": [
                {
                    "FromPort": 9,
                    "IpProtocol": "icmp",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ],
                    "Ipv6Ranges": [],
                    "PrefixListIds": [],
                    "ToPort": -1,
                    "UserIdGroupPairs": []
                }
            ],

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 93.32%. Comparing base (19b13e2) to head (ce4e6dc).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3482      +/-   ##
==========================================
- Coverage   93.33%   93.32%   -0.01%     
==========================================
  Files         325      325              
  Lines       11082    11082              
  Branches     2324     2324              
==========================================
- Hits        10343    10342       -1     
  Misses        414      414              
- Partials      325      326       +1     

Flag	Coverage Δ
unittests	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[vschurink]

hi @kddejong, it seems in version 1.7.1 this PR was unmerged again? I keep getting E3688 errors again when I have the ICMP configuration?

[kddejong]

@vschurink I haven't been able to re-replicate this issue. All the following variations are fine for me.

Icmp1:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: 1
      CidrIp: 10.0.0.0/8
      FromPort: "9"
      ToPort: "-1"
  Icmp2:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: icmp
      CidrIp: 10.0.0.0/8
      FromPort: 5
      ToPort: -1
  Icmp3:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      IpProtocol: 1
      CidrIp: 10.0.0.0/8
      FromPort: 5
      ToPort: "-1"

[vschurink]

@kddejong you are correct, neither can I now. Maybe i had an old version of cfn-lint in the cache. My bad. Thanks for your quick response.