elb_application_lb with empty security groups list behaves inconsistently on create/update about community.aws HOT 8 CLOSED

@briantist Thank you for reporting this! We have recently this module to our CI so it should be easier to add a test case for this.

from community.aws.

If that's what happens on first creation, then that's what should happen after first creation as well imo to maintain idempotence. I'll work on that and add some integration tests to validate

from community.aws.

Files identified in the description:

• plugins/modules/elb_application_lb.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

from community.aws.

cc @jillr @s-hertel @tremble @wimnat
click here for bot help

from community.aws.

I'm not sure if this is reproducible outside of a VPC since I'm not sure there is such a thing as a default SG in that case.

imo you can create ALB resources only in a VPC.

the only way to solve this issue is imo to not allow an empty array as an input for security_groups parameter.
otherwise and empty array must be treated as "use the VPCs default security group", which must be determined inside the code.

from community.aws.

I believe that "use the default VPC SG" is a desirable option in some/many use cases, so I wouldn't want to see that option disappear. It would be most useful if the module handled that case correctly, even if internally it means it has to retrieve the VPC default in order to verify its state.

from community.aws.

I can work on this @briantist @markuman. Expected behavior is treat empty array as "use the VPCs default security group" ?

from community.aws.

I can work on this @briantist @markuman. Expected behavior is treat empty array as "use the VPCs default security group" ?

@jatorcasso kind of yes, that's already what happens on first creation; the problem is that running it again will fail. So when the ALB already exists, the module needs to have a way to verify the current state, and that part is not working now. It may require reading the default SG from the VPC in order to verify.

It might also be desirable to have "use the default VPC" as a separate option and then disallow the empty SG list, not sure...

I might also suggest that no security group option supplied, when the ALB exists, might mean "don't check or change the state of SGs" but that is a behavioral change.

from community.aws.