cloud-mu 3.1.4 → 3.1.5

data/modules/mu/clouds/aws/dnszone.rb

@@ -369,7 +369,7 @@ module MU
         def self.manageRecord(id, name, type, targets: nil,
             ttl: 7200, delete: false, sync_wait: true, failover: nil,
             healthcheck: nil, region: nil, weight: nil, overwrite: true,
-            location: nil, set_identifier: nil, alias_zone: nil)
+            location: nil, set_identifier: nil, alias_zone: nil, noop: false)
 
           MU.setVar("curRegion", region) if !region.nil?
           zone = MU::Cloud::DNSZone.find(cloud_id: id).values.first
@@ -380,6 +380,11 @@ module MU
           action = "UPSERT" if overwrite
           action = "DELETE" if delete
 
+          record_sets = MU::Cloud::AWS.route53.list_resource_record_sets(
+            hosted_zone_id: id,
+            start_record_name: name
+          ).resource_record_sets if delete
+
           if type == "R53ALIAS"
             target_zone = id
             target_name = targets[0].downcase
@@ -413,7 +418,15 @@ module MU
             }
           else
             rrsets = []
-            if !targets.nil?
+            if delete
+              record_sets.each { |r|
+                if r.name == name and r.type == type
+                  rrsets = MU.structToHash(r.resource_records)
+                end
+              }
+            end
+
+            if !targets.nil? and (!delete or rrsets.empty?)
               targets.each { |target|
                 rrsets << {value: target}
               }
@@ -426,6 +439,7 @@ module MU
               resource_records: rrsets
             }
 
+
             if !healthcheck.nil?
               base_rrset[:health_check_id] = healthcheck
             end
@@ -445,12 +459,13 @@ module MU
 
           # Doing an UPSERT with a new set_identifier will fail with a record already exist error, so lets try and get it from an existing record. 
           # This can be an issue with multiple secondary failover records
-          if (location || failover || region || weight) && set_identifier.nil?
-            record_sets = MU::Cloud::AWS.route53.list_resource_record_sets(
+          if (location || failover || region || weight) and set_identifier.nil?
+            record_sets ||= MU::Cloud::AWS.route53.list_resource_record_sets(
               hosted_zone_id: id,
               start_record_name: name
             ).resource_record_sets
 
+          
             record_sets.each { |r|
               if r.name == name
                 if location && location == r.location
@@ -497,18 +512,23 @@ module MU
             MU.log "Adding DNS record #{name} => #{targets} (#{type}) to #{id}", details: params
           end
 
-          begin
+          return if noop
+
+          on_retry = Proc.new { |e|
+            if (delete and e.message.match(/but it was not found/)) or
+               (!delete and e.message.match(/(it|name) already exists/))
+              MU.log e.message, MU::DEBUG, details: params
+              return
+            elsif e.class == Aws::Route53::Errors::InvalidChangeBatch
+              MU.log "Problem managing entry for #{name}", MU::ERR, details: params
+              raise MuError, e.inspect
+            end
+          }
+
+          change_id = nil
+          MU.retrier([Aws::Route53::Errors::PriorRequestNotComplete, Aws::Route53::Errors::InvalidChangeBatch], wait: 15, max: 10, on_retry: on_retry) {
             change_id = MU::Cloud::AWS.route53.change_resource_record_sets(params).change_info.id
-          rescue Aws::Route53::Errors::PriorRequestNotComplete => e
-            sleep 10
-            retry
-          rescue Aws::Route53::Errors::InvalidChangeBatch, Aws::Route53::Errors::InvalidInput, StandardError => e
-            return if e.message.match(/ but it already exists/) and !delete
-            MU.log "Failed to change DNS records, #{e.inspect}", MU::ERR, details: params
-            raise e if !delete
-            MU.log "Record #{name} (#{type}) in #{id} can't be deleted. Already removed? #{e.inspect}", MU::WARN, details: params if delete
-            return
-          end
+          }
 
           if sync_wait
             attempts = 0
@@ -535,23 +555,27 @@ module MU
         # @param delete [Boolean]: Remove this entry instead of creating it.
         # @param cloudclass [Object]: The resource's Mu class.
         # @param sync_wait [Boolean]: Wait for DNS entry to propagate across zone.
-        def self.genericMuDNSEntry(name: nil, target: nil, cloudclass: nil, noop: false, delete: false, sync_wait: true)
-          return nil if name.nil? or target.nil? or cloudclass.nil?
-          mu_zone = MU::Cloud::DNSZone.find(cloud_id: "platform-mu").values.first
+        def self.genericMuDNSEntry(name: nil, target: nil, cloudclass: nil, noop: false, delete: false, sync_wait: true, credentials: nil)
+          return nil if name.nil? or cloudclass.nil?
+          return nil if target.nil? and !delete
+          mu_zone = MU::Cloud::DNSZone.find(cloud_id: "platform-mu", credentials: credentials).values.first
           raise MuError, "Couldn't isolate platform-mu DNS zone" if mu_zone.nil?
 
           if !mu_zone.nil? and !MU.myVPC.nil?
             subdomain = cloudclass.cfg_name
             dns_name = name.downcase+"."+subdomain
             dns_name += "."+MU.myInstanceId if MU.myInstanceId
+
             record_type = "CNAME"
             record_type = "A" if target.match(/^\d+\.\d+\.\d+\.\d+/)
             ip = nil
 
-            lookup = MU::Cloud::AWS.route53.list_resource_record_sets(
-                hosted_zone_id: mu_zone.id,
-                start_record_name: "#{dns_name}.platform-mu",
-                start_record_type: record_type
+            records = []
+            lookup = MU::Cloud::AWS.route53(credentials: credentials).list_resource_record_sets(
+              hosted_zone_id: mu_zone.id,
+              start_record_name: "#{dns_name}.platform-mu",
+              start_record_type: record_type,
+              max_items: 1
             ).resource_record_sets
 
             lookup.each { |record|
@@ -572,34 +596,14 @@ module MU
 #						MU.log "'#{dns_name}.platform-mu' does not resolve.", MU::DEBUG, details: e.inspect
 #					end
 
-            if ip == target
-              return "#{dns_name}.platform-mu" if !delete
-            elsif noop
-              return nil
+            if ip == target and !delete
+              return "#{dns_name}.platform-mu"
             end
 
             sync_wait = false if delete
 
             record_type = "R53ALIAS" if cloudclass == MU::Cloud::AWS::LoadBalancer
-            attempts = 0
-            begin
-              MU::Cloud::AWS::DNSZone.manageRecord(mu_zone.id, dns_name, record_type, targets: [target], delete: delete, sync_wait: sync_wait)
-            rescue Aws::Route53::Errors::PriorRequestNotComplete => e
-              MU.log "Route53 was still processing a request, waiting", MU::WARN, details: e
-              sleep 15
-              retry
-            rescue Aws::Route53::Errors::InvalidChangeBatch => e
-              if e.inspect.match(/alias target name does not lie within the target zone/) and attempts < 5
-                MU.log e.inspect, MU::WARN
-                sleep 15
-                attempts = attempts + 1
-                retry
-              elsif !e.inspect.match(/(it|name) already exists/)
-                raise MuError, "Problem managing entry for #{dns_name} -> #{target}: #{e.inspect}"
-              else
-                MU.log "#{dns_name} already exists", MU::DEBUG, details: e.inspect
-              end
-            end
+            MU::Cloud::AWS::DNSZone.manageRecord(mu_zone.id, dns_name, record_type, targets: [target], delete: delete, sync_wait: sync_wait, noop: noop)
             return "#{dns_name}.platform-mu"
           else
             return nil

data/modules/mu/clouds/aws/firewall_rule.rb

@@ -382,9 +382,8 @@ module MU
         # @param region [String]: The cloud provider region
         # @return [void]
         def self.cleanup(noop: false, ignoremaster: false, region: MU.curRegion, credentials: nil, flags: {})
-          filters = nil
-          if flags and flags["vpc_id"]
-            filters = [
+          filters = if flags and flags["vpc_id"]
+            [
               {name: "vpc-id", values: [flags["vpc_id"]]}
             ]
           else
@@ -394,6 +393,7 @@ module MU
             if !ignoremaster
               filters << {name: "tag:MU-MASTER-IP", values: [MU.mu_public_ip]}
             end
+            filters
           end
 
           # Some services create sneaky rogue ENIs which then block removal of
@@ -408,136 +408,111 @@ module MU
             MU.log "Revoking rules in EC2 Security Group #{sg.group_name} (#{sg.group_id})"
 
             if !noop
-              ingress_to_revoke = Array.new
-              egress_to_revoke = Array.new
-              sg.ip_permissions.each { |hole|
-                ingress_to_revoke << MU.structToHash(hole)
-                ingress_to_revoke.each { |rule|
-                  if !rule[:user_id_group_pairs].nil? and rule[:user_id_group_pairs] .size == 0
-                    rule.delete(:user_id_group_pairs)
-                  elsif !rule[:user_id_group_pairs].nil?
-                    rule[:user_id_group_pairs].each { |group_ref|
-                      group_ref = MU.structToHash(group_ref)
-                      group_ref.delete(:group_name) if group_ref[:group_id]
-                    }
-                  end
+              revoke_rules(sg, region: region, credentials: credentials)
+              revoke_rules(sg, egress: true, region: region, credentials: credentials)
+            end
+          }
 
-                  if !rule[:ip_ranges].nil? and rule[:ip_ranges].size == 0
-                    rule.delete(:ip_ranges)
-                  end
+          resp.data.security_groups.each { |sg|
+            next if sg.group_name == "default"
+            MU.log "Removing EC2 Security Group #{sg.group_name}"
 
-                  if !rule[:prefix_list_ids].nil? and rule[:prefix_list_ids].size == 0
-                    rule.delete(:prefix_list_ids)
-                  end
-                  
-                  if !rule[:ipv_6_ranges].nil? and rule[:ipv_6_ranges].size == 0
-                    rule.delete(:ipv_6_ranges)
-                  end
-                }
-              }
-              sg.ip_permissions_egress.each { |hole|
-                egress_to_revoke << MU.structToHash(hole)
-                egress_to_revoke.each { |rule|
-                  if !rule[:user_id_group_pairs].nil? and rule[:user_id_group_pairs].size == 0
-                    rule.delete(:user_id_group_pairs)
-                  elsif !rule[:user_id_group_pairs].nil?
-                    rule[:user_id_group_pairs].each { |group_ref|
-                      group_ref = MU.structToHash(group_ref)
-                      group_ref.delete(:group_name) if group_ref[:group_id]
+            on_retry = Proc.new {
+              # try to get out from under loose network interfaces with which
+              # we're associated
+              if sg.vpc_id
+                default_sg = MU::Cloud::AWS::VPC.getDefaultSg(sg.vpc_id, region: region, credentials: credentials)
+                if default_sg
+                  eni_resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_network_interfaces(
+                    filters: [ {name: "group-id", values: [sg.group_id]} ]
+                  )
+                  if eni_resp and eni_resp.data and
+                     eni_resp.data.network_interfaces
+                    eni_resp.data.network_interfaces.each { |iface|
+                      iface_groups = iface.groups.map { |if_sg| if_sg.group_id }
+                      iface_groups.delete(sg.group_id)
+                      iface_groups << default_sg if iface_groups.empty?
+                      MU.log "Attempting to remove #{sg.group_id} (#{sg.group_name}) from ENI #{iface.network_interface_id}"
+                      begin
+                        MU::Cloud::AWS.ec2(credentials: credentials, region: region).modify_network_interface_attribute(
+                          network_interface_id: iface.network_interface_id,
+                          groups: iface_groups
+                        )
+                      rescue ::Aws::EC2::Errors::InvalidNetworkInterfaceIDNotFound
+                        # fine by me
+                      rescue ::Aws::EC2::Errors::AuthFailure
+                        MU.log "Permission denied attempting to trim Security Group list for #{iface.network_interface_id}", MU::WARN, details: iface.groups.map { |g| g.group_name }.join(",")+" => default"
+                      end
                     }
                   end
+                end
+              end
+            }
 
-                  if !rule[:ip_ranges].nil? and rule[:ip_ranges].size == 0
-                    rule.delete(:ip_ranges)
-                  end
+            if !noop
+              MU.retrier([Aws::EC2::Errors::DependencyViolation, Aws::EC2::Errors::InvalidGroupInUse], ignoreme: [Aws::EC2::Errors::InvalidGroupNotFound], max: 10, wait: 10, on_retry: on_retry) {
+                begin
+                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_security_group(group_id: sg.group_id)
+                rescue Aws::EC2::Errors::CannotDelete => e
+                  MU.log e.message, MU::WARN
+                end
+              }
+            end
 
-                  if !rule[:prefix_list_ids].nil? and rule[:prefix_list_ids].size == 0
-                    rule.delete(:prefix_list_ids)
-                  end
+          }
+        end
 
-                  if !rule[:ipv_6_ranges].nil? and rule[:ipv_6_ranges].size == 0
-                    rule.delete(:ipv_6_ranges)
-                  end
+        def self.revoke_rules(sg, egress: false, region: MU.myregion, credentials: nil)
+          holes = sg.send(egress ? :ip_permissions_egress : :ip_permissions)
+
+          to_revoke = []
+
+          holes.each { |hole|
+            to_revoke << MU.structToHash(hole)
+            to_revoke.each { |rule|
+              if !rule[:user_id_group_pairs].nil? and rule[:user_id_group_pairs].size == 0
+                rule.delete(:user_id_group_pairs)
+              elsif !rule[:user_id_group_pairs].nil?
+                rule[:user_id_group_pairs].each { |group_ref|
+                  group_ref = MU.structToHash(group_ref)
+                  group_ref.delete(:group_name) if group_ref[:group_id]
                 }
-              }
-              begin
+              end
 
-                if ingress_to_revoke.size > 0
-                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).revoke_security_group_ingress(
-                      group_id: sg.group_id,
-                      ip_permissions: ingress_to_revoke
-                  )
-                end
-                if egress_to_revoke.size > 0
-                  MU::Cloud::AWS.ec2(credentials: credentials, region: region).revoke_security_group_egress(
-                      group_id: sg.group_id,
-                      ip_permissions: egress_to_revoke
-                  )
-                end
-              rescue Aws::EC2::Errors::InvalidPermissionNotFound
-                MU.log "Rule in #{sg.group_id} disappeared before I could remove it", MU::WARN
+              if !rule[:ip_ranges].nil? and rule[:ip_ranges].size == 0
+                rule.delete(:ip_ranges)
               end
-            end
-          }
 
-          resp.data.security_groups.each { |sg|
-            next if sg.group_name == "default"
-            MU.log "Removing EC2 Security Group #{sg.group_name}"
+              if !rule[:prefix_list_ids].nil? and rule[:prefix_list_ids].size == 0
+                rule.delete(:prefix_list_ids)
+              end
 
-            retries = 0
-            begin
-              MU::Cloud::AWS.ec2(credentials: credentials, region: region).delete_security_group(group_id: sg.group_id) if !noop
-            rescue Aws::EC2::Errors::CannotDelete => e
-              MU.log e.message, MU::WARN
-            rescue Aws::EC2::Errors::InvalidGroupNotFound
-              MU.log "EC2 Security Group #{sg.group_name} disappeared before I could delete it!", MU::WARN
-            rescue Aws::EC2::Errors::DependencyViolation, Aws::EC2::Errors::InvalidGroupInUse
-              if retries < 10
-                MU.log "EC2 Security Group #{sg.group_name} is still in use, waiting...", MU::NOTICE
-                # try to get out from under loose network interfaces with which
-                # we're associated
-                if sg.vpc_id
-                  # get the default SG for this VPC
-                  default_resp = MU::Cloud::AWS.ec2(region: region, credentials: credentials).describe_security_groups(
-                    filters: [
-                      { name: "group-name", values: ["default"] },
-                      { name: "vpc-id", values: [sg.vpc_id] }
-                    ]
-                  ).security_groups
-                  if default_resp and default_resp.size == 1
-                    default_sg = default_resp.first.group_id
-                    eni_resp = MU::Cloud::AWS.ec2(credentials: credentials, region: region).describe_network_interfaces(
-                      filters: [ {name: "group-id", values: [sg.group_id]} ]
-                    )
-                    if eni_resp and eni_resp.data and
-                       eni_resp.data.network_interfaces
-                      eni_resp.data.network_interfaces.each { |iface|
-                        iface_groups = iface.groups.map { |if_sg| if_sg.group_id }
-                        iface_groups.delete(sg.group_id)
-                        iface_groups << default_sg if iface_groups.empty?
-                        MU.log "Attempting to remove #{sg.group_id} (#{sg.group_name}) from ENI #{iface.network_interface_id}"
-                        begin
-                          MU::Cloud::AWS.ec2(credentials: credentials, region: region).modify_network_interface_attribute(
-                            network_interface_id: iface.network_interface_id,
-                            groups: iface_groups
-                          )
-                        rescue ::Aws::EC2::Errors::AuthFailure
-                          MU.log "Permission denied attempting to trim Security Group list for #{iface.network_interface_id}", MU::WARN, details: iface.groups.map { |g| g.group_name }.join(",")+" => default"
-                        end
-                      }
-                    end
-                  end
-                end
+              if !rule[:ipv_6_ranges].nil? and rule[:ipv_6_ranges].size == 0
+                rule.delete(:ipv_6_ranges)
+              end
+            }
+          }
 
-                sleep 10
-                retries = retries + 1
-                retry
+          if to_revoke.size > 0
+            begin
+              if egress
+                MU::Cloud::AWS.ec2(credentials: credentials, region: region).revoke_security_group_egress(
+                  group_id: sg.group_id,
+                  ip_permissions: to_revoke
+                )
               else
-                MU.log "Failed to delete #{sg.group_name}", MU::ERR
+                MU::Cloud::AWS.ec2(credentials: credentials, region: region).revoke_security_group_ingress(
+                  group_id: sg.group_id,
+                  ip_permissions: to_revoke
+                )
               end
+            rescue Aws::EC2::Errors::InvalidPermissionNotFound
+              MU.log "Rule in #{sg.group_id} disappeared before I could remove it", MU::WARN
             end
-          }
+          end
+
         end
+        private_class_method :revoke_rules
 
         # Cloud-specific configuration properties.
         # @param _config [MU::Config]: The calling MU::Config object
@@ -719,32 +694,7 @@ module MU
 
         private
 
-        #########################################################################
-        # Manufacture an EC2 security group. The second parameter, rules, is an
-        # "ingress_rules" structure parsed and validated by MU::Config.
-        #########################################################################
-        def setRules(rules, add_to_self: false, ingress: true, egress: false)
-          describe
-          # XXX warn about attempt to set rules before we exist
-          return if rules.nil? or rules.size == 0 or !@cloud_id
-
-          # add_to_self means that this security is a "member" of its own rules
-          # (which is to say, objects that have this SG are allowed in my these
-          # rules)
-          if add_to_self
-            rules.each { |rule|
-              if rule['sgs'].nil? or !rule['sgs'].include?(@cloud_id)
-                new_rule = rule.clone
-                new_rule.delete('hosts')
-                rule['sgs'] = Array.new if rule['sgs'].nil?
-                rule['sgs'] << @cloud_id
-              end
-            }
-          end
-
-          ec2_rules = convertToEc2(rules)
-          ext_permissions = MU.structToHash(cloud_desc.ip_permissions)
-
+        def purge_extraneous_rules(ec2_rules, ext_permissions)
           # Purge any old rules that we're sure we created (check the comment)
           # but which are no longer configured.
           ext_permissions.each { |ext_rule|
@@ -781,97 +731,110 @@ module MU
                 ip_permissions: [ext_rule]
               )
             end
-
           }
+        end
 
-          # Creating an empty security group is ok, so don't freak out if we get
-          # a null rule list.
-          if !ec2_rules.nil?
-            ec2_rules.uniq!
-            retries = 0
-            ec2_rules.each { |rule|
-              haverule = nil
-              different = false
-              ext_permissions.each { |ext_rule|
-                if rule[:from_port] == ext_rule[:from_port] and
-                   rule[:to_port] == ext_rule[:to_port] and
-                   rule[:ip_protocol] == ext_rule[:ip_protocol]
-                  haverule = ext_rule
-                  ext_rule.keys.each { |k|
-                    if ext_rule[k].nil? or ext_rule[k] == []
-                      haverule.delete(k)
-                    end
-                    different = true if rule[k] != ext_rule[k]
-                  }
-                  break
-                end
-              }
-              if haverule and !different
-                MU.log "Security Group rule already up-to-date in #{@mu_name}", MU::DEBUG, details: rule
-                next
+        #########################################################################
+        # Manufacture an EC2 security group. The second parameter, rules, is an
+        # "ingress_rules" structure parsed and validated by MU::Config.
+        #########################################################################
+        def setRules(rules, add_to_self: false, ingress: true, egress: false)
+          describe
+          # XXX warn about attempt to set rules before we exist
+          return if rules.nil? or rules.size == 0 or !@cloud_id
+
+          # add_to_self means that this security is a "member" of its own rules
+          # (which is to say, objects that have this SG are allowed in my these
+          # rules)
+          if add_to_self
+            rules.each { |rule|
+              if rule['sgs'].nil? or !rule['sgs'].include?(@cloud_id)
+                new_rule = rule.clone
+                new_rule.delete('hosts')
+                rule['sgs'] = Array.new if rule['sgs'].nil?
+                rule['sgs'] << @cloud_id
               end
+            }
+          end
 
-              MU.log "Setting #{ingress ? "ingress" : "egress"} rule in Security Group #{@mu_name} (#{@cloud_id})", MU::NOTICE, details: rule
-              begin
-
-                if ingress
-                  if haverule
-                    begin
-                      MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_ingress(
-                        group_id: @cloud_id,
-                        ip_permissions: [haverule]
-                      )
-                    rescue Aws::EC2::Errors::InvalidPermissionNotFound => e
-                    end
+          ec2_rules = convertToEc2(rules)
+          return if ec2_rules.nil?
+
+          ext_permissions = MU.structToHash(cloud_desc.ip_permissions)
+
+          purge_extraneous_rules(ec2_rules, ext_permissions)
+
+          ec2_rules.uniq!
+          ec2_rules.each { |rule|
+            haverule = nil
+            different = false
+            ext_permissions.each { |ext_rule|
+              if rule[:from_port] == ext_rule[:from_port] and
+                 rule[:to_port] == ext_rule[:to_port] and
+                 rule[:ip_protocol] == ext_rule[:ip_protocol]
+                haverule = ext_rule
+                ext_rule.keys.each { |k|
+                  if ext_rule[k].nil? or ext_rule[k] == []
+                    haverule.delete(k)
                   end
+                  different = true if rule[k] != ext_rule[k]
+                }
+                break
+              end
+            }
+            if haverule and !different
+              MU.log "Security Group rule already up-to-date in #{@mu_name}", MU::DEBUG, details: rule
+              next
+            end
+
+            MU.log "Setting #{ingress ? "ingress" : "egress"} rule in Security Group #{@mu_name} (#{@cloud_id})", MU::NOTICE, details: rule
+
+            MU.retrier([Aws::EC2::Errors::InvalidGroupNotFound], max: 10, wait: 10, ignoreme: [Aws::EC2::Errors::InvalidPermissionDuplicate]) {
+              if ingress
+                if haverule
                   begin
-                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_ingress(
+                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_ingress(
                       group_id: @cloud_id,
-                      ip_permissions: [rule]
+                      ip_permissions: [haverule]
                     )
-                  rescue Aws::EC2::Errors::InvalidParameterCombination => e
-                    MU.log "FirewallRule #{@mu_name} had a bogus rule: #{e.message}", MU::ERR, details: rule
-                    raise e
+                  rescue Aws::EC2::Errors::InvalidPermissionNotFound
                   end
                 end
-
-                if egress
-                  if haverule
-                    begin
-                      MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_egress(
-                        group_id: @cloud_id,
-                        ip_permissions: [haverule]
-                      )
-                    rescue Aws::EC2::Errors::InvalidPermissionNotFound => e
-                    end
-                  end
-                  MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_egress(
+                begin
+                  MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_ingress(
                     group_id: @cloud_id,
                     ip_permissions: [rule]
                   )
+                rescue Aws::EC2::Errors::InvalidParameterCombination => e
+                  MU.log "FirewallRule #{@mu_name} had a bogus rule: #{e.message}", MU::ERR, details: rule
+                  raise e
                 end
+              end
 
-              rescue Aws::EC2::Errors::InvalidGroupNotFound => e
-                MU.log "#{@mu_name} (#{@cloud_id}) does not yet exist", MU::WARN
-                retries = retries + 1
-                if retries < 10
-                  sleep 10
-                  retry
-                else
-                  raise MuError, "#{@mu_name} does not exist", e.backtrace
+              if egress
+                if haverule
+                  begin
+                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_egress(
+                      group_id: @cloud_id,
+                      ip_permissions: [haverule]
+                    )
+                  rescue Aws::EC2::Errors::InvalidPermissionNotFound
+                  end
                 end
-              rescue Aws::EC2::Errors::InvalidPermissionDuplicate => e
-                MU.log "Attempt to add duplicate rule to #{@mu_name}", MU::DEBUG, details: rule
+                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_egress(
+                  group_id: @cloud_id,
+                  ip_permissions: [rule]
+                )
               end
             }
-          end
+          }
 
         end
 
-        #########################################################################
-        # Convert our config languages description of firewall rules into Amazon's.
-        # This rule structure is as defined in MU::Config.
-        #########################################################################
+        #######################################################################
+        # Convert our config languages description of firewall rules into
+        # Amazon's. Our rule structure is as defined in MU::Config.
+        #######################################################################
         def convertToEc2(rules)
           ec2_rules = []
           if rules != nil
@@ -995,8 +958,8 @@ module MU
               ec2_rules << ec2_rule
             }
           end
-          ec2_rules.uniq!
-          return ec2_rules
+
+          ec2_rules.uniq
         end
 
       end #class