aws-ec2.Connections.allowInternally() does not appear to add Egress rules for aws-ec2.SecurityGroup.allowAllOutbound=false

[secpaul]

Note: for support questions, please first reference our documentation, then use Stackoverflow. This repository's issues are intended for feature requests and bug reports.

• I'm submitting a ...

  • 🪲 bug report
  • 🚀 feature request
  • 📚 construct library gap
  • ☎️ security issue or vulnerability => Please see policy
  • ❓ support request => Please see note at the top of this template.

• What is the current behavior?
  If the current behavior is a 🪲bug🪲: Please provide the steps to reproduce
  When a security group is configured to have allowOutbound=false, resources for Egress rules are not created for the target security group when calling aws-ec2.Connections.allowInternally(). The behaviour of allowFrom() and allowTo() where the target SG and the SG parameter are the same may also exhibit the same behaviour (i.e. x.allowFrom(x,y,z)).

• What is the expected behavior (or behavior of feature suggested)?
  Desired behaviour is to create Egress rules.

• What is the motivation / use case for changing the behavior or adding this feature?
  The deployed security group will not permit the requested traffic.

• Please tell us about your environment:

  • CDK CLI Version: 0.37.0
  • Module Version: xx.xx.xx
  • OS: Ubuntu
  • Language: TypeScript

• Other information (e.g. detailed explanation, stacktraces, related issues, suggestions how to fix, links for us to have context, eg. associated pull-request, stackoverflow, gitter, etc)

import { expect, haveResource } from '@aws-cdk/assert';
import { Test } from 'nodeunit';
import { Stack, App } from '@aws-cdk/core';
import { Vpc, SecurityGroup, Port } from '@aws-cdk/aws-ec2';

export = {

  'Test aws-ec2.Connections.allowInternally() adds Egress and Ingress rules'(test: Test) {

    const app = new App();
    const stack = new Stack(app, 'TestStack');
    const vpc = new Vpc(stack, 'TestVpc');
    const sg1 = new SecurityGroup(stack, 'TestGroup1', {
      allowAllOutbound: false,
      vpc: vpc
    });
    sg1.connections.allowInternally(
      Port.allTraffic(),
      'Allow all traffic between EC2 Instances having the same security group'
    );
    app.synth();

    expect(stack).to(haveResource('AWS::EC2::SecurityGroupIngress', {
      "GroupId": {
        "Fn::GetAtt": [
          "TestGroup1BB3CCD0D",
          "GroupId"
        ]
      },
      "IpProtocol": "-1",
      "Description": "Allow all traffic between EC2 Instances having the same security group",
      "SourceSecurityGroupId": {
        "Fn::GetAtt": [
          "TestGroup1BB3CCD0D",
          "GroupId"
        ]
      }
    }));

    expect(stack).to(haveResource('AWS::EC2::SecurityGroupEgress', {
      "IpProtocol": "-1",
      "Description": "Allow all traffic between EC2 Instances having the same security group",
      "GroupId": {
        "Fn::GetAtt": [
          "TestGroup1BB3CCD0D",
          "GroupId"
        ]
      },
      "DestinationSecurityGroupId": {
        "Fn::GetAtt": [
          "TestGroup1BB3CCD0D",
          "GroupId"
        ]
      }
    }));
    test.done();
  }
};
``