second first commit

2026-09-22 08:57:00 -04:00
parent e88d7e2ff3
commit 0aef7fb2d8
4766 changed files with 1236986 additions and 0 deletions
@@ -0,0 +1,93 @@
+# Regression coverage for #2266 at the Terraform layer.
+#
+# "Allow traffic from security group X" is how one tier is wired to another -- an ALB
+# to its backend tasks, an application to its database, a cluster to itself. When
+# AuthorizeSecurityGroupIngress dropped the source, the provider's create-wait could
+# not find the rule it had just made and the apply failed with
+# "couldn't find resource"; a response that reported the rule but lost the reference
+# would instead apply cleanly and then show as drift on every subsequent plan.
+#
+# Both of the standard spellings are exercised, because they read the source back
+# through different APIs: aws_security_group_rule polls DescribeSecurityGroups, and
+# aws_vpc_security_group_ingress_rule polls DescribeSecurityGroupRules.
+
+resource "aws_vpc" "sg_sources" {
+  cidr_block = "10.71.0.0/16"
+
+  tags = {
+    Name = "floci-sg-rule-sources"
+  }
+}
+
+resource "aws_security_group" "alb" {
+  name        = "floci-sg-rule-sources-alb"
+  description = "Front tier"
+  vpc_id      = aws_vpc.sg_sources.id
+}
+
+resource "aws_security_group" "backend" {
+  name        = "floci-sg-rule-sources-backend"
+  description = "Back tier, reachable only from the front tier"
+  vpc_id      = aws_vpc.sg_sources.id
+}
+
+# The classic spelling: reads its source back off DescribeSecurityGroups.
+resource "aws_security_group_rule" "backend_from_alb" {
+  type                     = "ingress"
+  from_port                = 8080
+  to_port                  = 8080
+  protocol                 = "tcp"
+  security_group_id        = aws_security_group.backend.id
+  source_security_group_id = aws_security_group.alb.id
+  description              = "app traffic from the load balancer"
+}
+
+# Self-reference: a cluster whose members talk to each other. This is the shape that
+# fails first, because the group is both the rule's owner and its source.
+resource "aws_security_group_rule" "backend_self" {
+  type              = "ingress"
+  from_port         = 0
+  to_port           = 0
+  protocol          = "-1"
+  security_group_id = aws_security_group.backend.id
+  self              = true
+  description       = "intra-cluster traffic"
+}
+
+# The current spelling: reads its source back off DescribeSecurityGroupRules, and
+# needs referencedGroupInfo rather than a UserIdGroupPair.
+resource "aws_vpc_security_group_ingress_rule" "backend_from_alb_v2" {
+  security_group_id            = aws_security_group.backend.id
+  referenced_security_group_id = aws_security_group.alb.id
+  from_port                    = 9090
+  to_port                      = 9090
+  ip_protocol                  = "tcp"
+  description                  = "admin traffic from the load balancer"
+}
+
+# A CIDR rule alongside them: the reference must not be lost when a group carries
+# both kinds, and a CIDR rule must not sprout a phantom reference.
+resource "aws_vpc_security_group_ingress_rule" "backend_from_cidr" {
+  security_group_id = aws_security_group.backend.id
+  cidr_ipv4         = "10.71.0.0/16"
+  from_port         = 443
+  to_port           = 443
+  ip_protocol       = "tcp"
+  description       = "https from inside the vpc"
+}
+
+output "alb_sg_id" {
+  value = aws_security_group.alb.id
+}
+
+output "backend_sg_id" {
+  value = aws_security_group.backend.id
+}
+
+output "backend_from_alb_v2_rule_id" {
+  value = aws_vpc_security_group_ingress_rule.backend_from_alb_v2.security_group_rule_id
+}
+
+output "backend_from_cidr_rule_id" {
+  value = aws_vpc_security_group_ingress_rule.backend_from_cidr.security_group_rule_id
+}
@@ -0,0 +1,35 @@
+terraform {
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 6.0"
+    }
+  }
+}
+
+variable "endpoint" {
+  type    = string
+  default = "http://localhost:4566"
+}
+
+provider "aws" {
+  region     = "us-east-1"
+  access_key = "test"
+  secret_key = "test"
+
+  skip_credentials_validation = true
+  skip_metadata_api_check     = true
+  s3_use_path_style           = true
+
+  # Deliberately NOT skip_requesting_account_id. The provider renders a same-account
+  # referenced_security_group_id as a bare group id and a cross-account one as
+  # "<account>/<group>", and it tells them apart by comparing ReferencedGroupInfo.UserId
+  # against its own resolved account. Skipping account resolution leaves that unknown,
+  # so every same-account reference reads back as cross-account and the plan never
+  # converges. Floci answers STS GetCallerIdentity, so there is nothing to skip.
+
+  endpoints {
+    ec2 = var.endpoint
+    sts = var.endpoint
+  }
+}