amazon-web-servicesaws-cloudformationtroposphere

Setting DBSecurityGroupIngress in Troposphere


Want to add Multiple CIDRIp to my DB security group ERROR:

CidrIp=Ref(AppSecurityGroup)),
TypeError: __init__() takes at least 2 arguments (1 given)

I think this is very easy but i am stuck at here and confused.

DBSecurityGroup = t.add_resource(
    rds.DBSecurityGroup(
        'DBSecurityGroup',
        GroupDescription='Enable access on the inbound port',
        DBSecurityGroupIngess=[
            rds.DBSecurityGroup(
                IpProtocol='tcp',
                FromPort='3306',
                ToPort='3306',
                CidrIp=Ref(AppSecurityGroup)),
            rds.DBSecurityGroup(
                IpProtocol='tcp',
                FromPort='3306',
                ToPort='3306',
                CidrIp=Ref(CalcSecurityGroup)),
            rds.DBSecurityGroup(
                IpProtocol='tcp',
                FromPort='3306',
                ToPort='3306',
                CidrIp=Ref(CIDRSupport))],
        VpcId=Ref(VPC),
        Tags=Tags(
            Name=Join("", [Ref("AWS::StackName"), "-DB-SG"]),
        )
    ))

Now i need to inbound to Calc-SG, App-SG and CIDRSupport on 6379 port.

How can I define it with in the SG ?


Solution

  • You are addressing a property CidrIp the DBSecurityGroup class does not have. This class is defined as:

    class RDSSecurityGroup(AWSProperty):
        props = {
            'CIDRIP': (basestring, False),
            'EC2SecurityGroupId': (basestring, False),
            'EC2SecurityGroupName': (basestring, False),
            'EC2SecurityGroupOwnerId': (basestring, False),
        }   
    
    class DBSecurityGroup(AWSObject):
        resource_type = "AWS::RDS::DBSecurityGroup"
    
        props = {
            'EC2VpcId': (basestring, False),
            'DBSecurityGroupIngress': (list, True),
            'GroupDescription': (basestring, True),
            'Tags': ((Tags, list), False),
        }
    

    From the source code here.

    What you want to say is:

    DBSecurityGroup = t.add_resource(
        rds.DBSecurityGroup(
            "DBSecurityGroup",
            GroupDescription="Enable access on the inbound port",
            DBSecurityGroupIngress=[
                rds.RDSSecurityGroup(EC2SecurityGroupId=Ref(AppSecurityGroup)),
                rds.RDSSecurityGroup(EC2SecurityGroupId=Ref(CalcSecurityGroup)),
                rds.RDSSecurityGroup(EC2SecurityGroupId=Ref(CIDRSupport))],
            EC2VpcId=Ref(VPC),
            Tags=Tags(
                Name=Join("", [Ref("AWS::StackName"), "-DB-SG"]),
            )
        ))
    

    I would note that Troposphere's RDSSecurityGroup corresponds to the "RDS Security Group Rule". The inconsistency in the naming is confusing.