Don't rely on status for deleting security group ingress rules
Previously we relied on the status object for deleting security
group ingress rules, instead query the aws sdk for the current
list of ingress rules and revoke all ingress rules prior to deletion.
@@ -136,7 +136,7 @@ func (s *Service) deleteSecurityGroups() error {
for _, sg := range s.scope.SecurityGroups() {
current := sg.IngressRules
- if err := s.revokeSecurityGroupIngressRules(sg.ID, current); awserrors.IsIgnorableSecurityGroupError(err) != nil {
+ if err := s.revokeAllSecurityGroupIngressRules(sg.ID); awserrors.IsIgnorableSecurityGroupError(err) != nil {
return err
}
@@ -237,6 +237,29 @@ func (s *Service) revokeSecurityGroupIngressRules(id string, rules v1alpha1.Ingr
return nil
}
+func (s *Service) revokeAllSecurityGroupIngressRules(id string) error {
+ describeInput := &ec2.DescribeSecurityGroupsInput{GroupIds: []*string{aws.String(id)}}
+
+ securityGroups, err := s.scope.EC2.DescribeSecurityGroups(describeInput)
+ if err != nil {
+ return errors.Wrapf(err, "failed to query security group %q", id)
+ }
+
+ for _, sg := range securityGroups.SecurityGroups {
+ if len(sg.IpPermissions) > 0 {
+ revokeInput := &ec2.RevokeSecurityGroupIngressInput{
+ GroupId: aws.String(id),
+ IpPermissions: sg.IpPermissions,
+ }
+ if _, err := s.scope.EC2.RevokeSecurityGroupIngress(revokeInput); err != nil {
+ return errors.Wrapf(err, "failed to revoke security group %q ingress rules", id)
+ }
+ }
+ }
+
+ return nil
+}
+
func (s *Service) defaultSSHIngressRule(sourceSecurityGroupID string) *v1alpha1.IngressRule {
return &v1alpha1.IngressRule{
Description: "SSH",
