What is the problem?

Hi, I am using a ecsPatterns.NetworkLoadBalancedFargateService and tried to add a SecurityGroup in order to allow connections from NLB to fargate service. However this sg was not added as I expected to the fargateService.

Reproduction Steps

Define an ecsPatterns.NetworkLoadBalancedFargateService and add the following:

const securityGroupNotAdded = new ec2.SecurityGroup(this,"NblSecurityGroupNotAddedToService", { vpc: coreVpc, description: "Security group for connections from NLB to FargateService" }); securityGroupNotAdded.addIngressRule(ec2.Peer.ipv4(coreVpc.vpcCidrBlock),ec2.Port.tcp(80),"Allow from anyone in VPC on 80");
/** Somehow this does not get added. Seems like ony one sg allowed for fg service **/ loadBalancedFargateService.service.connections.addSecurityGroup(securityGroupNotAdded);

What did you expect to happen?

I expected this to be added to the SecurityGroups [] of the NetworkConfiguration of the Fargate service in order to allow connections from NLB.

What actually happened?

The sg is defined in cloudformation template but not registered in the SecurityGroups [] of the NetworkConfiguration of the Fargate service.

If this is a bug or a feature I do not know, but if feature and only allowed with one sg on fargate service it should be documented

CDK CLI Version

1.127.0 (build 0ea309a)

Framework Version

No response

Node.js Version

v16.4.2

OS

macOS 12.0.1 (21A559)

Language

Typescript

Language Version

Typescript Version 3.9.10

Other information

The workaround I use is as follows:

const securityGroup = loadBalancedFargateService.service.connections.securityGroups[0]; securityGroup.addIngressRule(ec2.Peer.ipv4(coreVpc.vpcCidrBlock),ec2.Port.tcp(80),"Allow from anyone in VPC on 80");