From 67d768edcfd83b293be72a536274c03e159bca88 Mon Sep 17 00:00:00 2001
From: hedrall <>
Date: Sat, 13 Feb 2021 14:48:55 +0900
Subject: [PATCH] add test

---
 packages/@aws-cdk/aws-ec2/lib/nat.ts       |  2 +-
 packages/@aws-cdk/aws-ec2/test/vpc.test.ts | 25 ++++++++++++++++++++++
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/packages/@aws-cdk/aws-ec2/lib/nat.ts b/packages/@aws-cdk/aws-ec2/lib/nat.ts
index b8dda606beca6..b819c84043e5c 100644
--- a/packages/@aws-cdk/aws-ec2/lib/nat.ts
+++ b/packages/@aws-cdk/aws-ec2/lib/nat.ts
@@ -213,7 +213,7 @@ export class NatInstanceProvider extends NatProvider implements IConnectable {
     this._securityGroup = this.props.securityGroup ?? new SecurityGroup(options.vpc, 'NatSecurityGroup', {
       vpc: options.vpc,
       description: 'Security Group for NAT instances',
-      allowAllOutbound: this.props.allowAllTraffic
+      allowAllOutbound: this.props.allowAllTraffic ?? true,
     });
     this._connections = new Connections({ securityGroups: [this._securityGroup] });
 
diff --git a/packages/@aws-cdk/aws-ec2/test/vpc.test.ts b/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
index 9f4ceaf1357d6..e08a00b0bc540 100644
--- a/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
+++ b/packages/@aws-cdk/aws-ec2/test/vpc.test.ts
@@ -904,6 +904,22 @@ nodeunitShim({
         DestinationCidrBlock: '0.0.0.0/0',
         InstanceId: { Ref: 'TheVPCPublicSubnet1NatInstanceCC514192' },
       }));
+      cdkExpect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+        SecurityGroupEgress: [
+          {
+            CidrIp: '0.0.0.0/0',
+            Description: 'Allow all outbound traffic by default',
+            IpProtocol: '-1',
+          },
+        ],
+        SecurityGroupIngress: [
+          {
+            CidrIp: '0.0.0.0/0',
+            Description: 'from 0.0.0.0/0:ALL TRAFFIC',
+            IpProtocol: '-1',
+          },
+        ],
+      }));
 
       test.done();
     },
@@ -948,6 +964,15 @@ nodeunitShim({
 
       // THEN
       cdkExpect(stack).to(haveResource('AWS::EC2::SecurityGroup', {
+        SecurityGroupEgress: [
+          {
+            CidrIp: '255.255.255.255/32',
+            Description: 'Disallow all traffic',
+            FromPort: 252,
+            IpProtocol: 'icmp',
+            ToPort: 86,
+          },
+        ],
         SecurityGroupIngress: [
           {
             CidrIp: '1.2.3.4/32',