cloud-mu 3.4.0 → 3.5.0

data/modules/mu/providers/aws/dnszone.rb

@@ -25,7 +25,7 @@ module MU
           super
           @mu_name ||= @deploy.getResourceName(@config["name"])
 
-          MU.setVar("curRegion", @config['region']) if !@config['region'].nil?
+          MU.setVar("curRegion", @region) if !@region.nil?
         end
 
         # Called automatically by {MU::Deploy#createResources}
@@ -119,7 +119,7 @@ module MU
                   if @dependencies.has_key?('loadbalancer') and @dependencies['loadbalancer'].has_key?(dnsrec['target']) and !@dependencies['loadbalancer'][dnsrec['target']].cloudobj.nil? and dnsrec['deploy_id'].nil?
                     @dependencies['loadbalancer'][dnsrec['target']].cloudobj.notify['dns']
                   elsif dnsrec['deploy_id']
-                    found = MU::MommaCat.findStray("AWS", "loadbalancer", deploy_id: dnsrec["deploy_id"], mu_name: dnsrec["target"], region: @config["region"])
+                    found = MU::MommaCat.findStray("AWS", "loadbalancer", deploy_id: dnsrec["deploy_id"], mu_name: dnsrec["target"], region: @region)
                     raise MuError, "Couldn't find #{dnsrec['mu_type']} #{dnsrec["target"]}" if found.nil? || found.empty?
                     found.first.deploydata['dns']
                   end
@@ -128,7 +128,7 @@ module MU
                     MU.log "dnsrec['target'] #{dnsrec['target']}"
                     deploydata = @dependencies['server'][dnsrec['target']].deploydata
                   elsif dnsrec['deploy_id']
-                    found = MU::MommaCat.findStray("AWS", "server", deploy_id: dnsrec["deploy_id"], mu_name: dnsrec["target"], region: @config["region"])
+                    found = MU::MommaCat.findStray("AWS", "server", deploy_id: dnsrec["deploy_id"], mu_name: dnsrec["target"], region: @region)
                     raise MuError, "Couldn't find #{dnsrec['mu_type']} #{dnsrec["target"]}" if found.nil? || found.empty?
                     deploydata = found.first.deploydata
                   end
@@ -159,7 +159,7 @@ module MU
                   if @dependencies.has_key?(dnsrec['mu_type']) && dnsrec['deploy_id'].nil?
                     @dependencies[dnsrec['mu_type']][dnsrec['target']].deploydata['endpoint']
                   elsif dnsrec['deploy_id']
-                    found = MU::MommaCat.findStray("AWS", "database", deploy_id: dnsrec["deploy_id"], mu_name: dnsrec["target"], region: @config["region"])
+                    found = MU::MommaCat.findStray("AWS", "database", deploy_id: dnsrec["deploy_id"], mu_name: dnsrec["target"], region: @region)
                     raise MuError, "Couldn't find #{dnsrec['mu_type']} #{dnsrec["target"]}" if found.nil? || found.empty?
                     found.first.deploydata['endpoint']
                   end
@@ -642,7 +642,7 @@ module MU
             # )
             # deploydata.merge!(MU.structToHash(resp.hosted_zone))
             # deploydata['vpcs'] = @config['vpcs'] if !@config['vpcs'].nil?
-            # deploydata["region"] = @config['region'] if !@config['region'].nil?
+            # deploydata["region"] = @region if !@region.nil?
             # @deploy.notify(MU::Cloud::DNSZone.cfg_plural, mu_name, deploydata)
             # return deploydata
 

data/modules/mu/providers/aws/endpoint.rb

@@ -13,7 +13,7 @@ module MU
 
         # Called automatically by {MU::Deploy#createResources}
         def create
-          resp = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).create_rest_api(
+          resp = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).create_rest_api(
             name: @mu_name,
             description: @deploy.deploy_id,
             endpoint_configuration: {
@@ -27,7 +27,7 @@ module MU
 
         # Create/update all of the methods declared for this endpoint
         def generate_methods(integrations = true)
-          resp = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_resources(
+          resp = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_resources(
             rest_api_id: @cloud_id,
           )
           root_resource = resp.items.first.id
@@ -36,11 +36,11 @@ module MU
           @config['methods'].each { |m|
             m["auth"] ||= m["iam_role"] ? "AWS_IAM" : "NONE"
 
-            method_arn = "arn:#{MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws"}:execute-api:#{@config["region"]}:#{MU::Cloud::AWS.credToAcct(@credentials)}:#{@cloud_id}/*/#{m['type']}/#{m['path']}"
+            method_arn = "arn:#{MU::Cloud::AWS.isGovCloud?(@region) ? "aws-us-gov" : "aws"}:execute-api:#{@region}:#{MU::Cloud::AWS.credToAcct(@credentials)}:#{@cloud_id}/*/#{m['type']}/#{m['path']}"
             path_part = ["", "/"].include?(m['path']) ? nil : m['path']
             method_arn.sub!(/\/\/$/, '/')
 
-            resp = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_resources(
+            resp = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_resources(
               rest_api_id: @cloud_id
             )
             ext_resource = nil
@@ -51,11 +51,11 @@ module MU
             }
 
             resp = if ext_resource
-MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_resource(
+MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_resource(
   rest_api_id: @cloud_id,
   resource_id: ext_resource,
 )
-#              MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).update_resource(
+#              MU::Cloud::AWS.apig(region: @region, credentials: @credentials).update_resource(
 #                rest_api_id: @cloud_id,
 #                resource_id: ext_resource,
 #                patch_operations: [
@@ -67,7 +67,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
 #                ]
 #              )
             else
-              MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).create_resource(
+              MU::Cloud::AWS.apig(region: @region, credentials: @credentials).create_resource(
                 rest_api_id: @cloud_id,
                 parent_id: root_resource,
                 path_part: path_part
@@ -76,13 +76,13 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
             parent_id = resp.id
 
             resp = begin
-              MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_method(
+              MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_method(
                 rest_api_id: @cloud_id,
                 resource_id: parent_id,
                 http_method: m['type']
               )
             rescue Aws::APIGateway::Errors::NotFoundException
-              resp = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).put_method(
+              resp = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).put_method(
                 rest_api_id: @cloud_id,
                 resource_id: parent_id,
                 authorization_type: m['auth'],
@@ -111,7 +111,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
                   params[:response_models] = r['body'].map { |b| [b['content_type'], b['is_error'] ? "Error" : "Empty"] }.to_h
                 end
 
-                MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).put_method_response(params)
+                MU::Cloud::AWS.apig(region: @region, credentials: @credentials).put_method_response(params)
               }
             rescue Aws::APIGateway::Errors::ConflictException
               # fine to ignore
@@ -133,13 +133,13 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
 
               uri, type = if m['integrate_with']['type'] == "aws_generic"
                 svc, action = m['integrate_with']['aws_generic_action'].split(/:/)
-                ["arn:aws:apigateway:"+@config['region']+":#{svc}:action/#{action}", aws_int_type]
+                ["arn:aws:apigateway:"+@region+":#{svc}:action/#{action}", aws_int_type]
               elsif m['integrate_with']['type'] == "functions"
                 function_obj = nil
                 MU.retrier([], max: 5, wait: 9, loop_if: Proc.new { function_obj.nil? }) {
                   function_obj = @deploy.findLitterMate(name: m['integrate_with']['name'], type: "functions")
                 }
-                ["arn:aws:apigateway:"+@config['region']+":lambda:path/2015-03-31/functions/"+function_obj.cloudobj.arn+"/invocations", aws_int_type]
+                ["arn:aws:apigateway:"+@region+":lambda:path/2015-03-31/functions/"+function_obj.cloudobj.arn+"/invocations", aws_int_type]
               elsif m['integrate_with']['type'] == "mock"
                 [nil, "MOCK"]
               end
@@ -176,7 +176,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
                 }]
               end
 
-              resp = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).put_integration(params)
+              resp = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).put_integration(params)
 
               if m['integrate_with']['type'] =~ /^functions?$/
                 function_obj.addTrigger(method_arn, "apigateway", @config['name'])
@@ -196,7 +196,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
                   }.to_h
                 end
 
-                MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).put_integration_response(params)
+                MU::Cloud::AWS.apig(region: @region, credentials: @credentials).put_integration_response(params)
 
               }
 
@@ -209,13 +209,13 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
         def groom
           generate_methods
 
-          deployment = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_deployments(
+          deployment = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_deployments(
             rest_api_id: @cloud_id
           ).items.sort { |a, b| a.created_date <=> b.created_date }.last
 
           if !deployment
             MU.log "Deploying API Gateway #{@config['name']} to #{@config['deploy_to']}"
-            deployment = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).create_deployment(
+            deployment = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).create_deployment(
               rest_api_id: @cloud_id,
               stage_name: @config['deploy_to']
 #            cache_cluster_enabled: false,
@@ -225,7 +225,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
           # this automatically creates a stage with the same name, so we don't
           # have to deal with that
 
-          my_hostname = @cloud_id+".execute-api."+@config['region']+".amazonaws.com"
+          my_hostname = @cloud_id+".execute-api."+@region+".amazonaws.com"
           my_url = "https://"+my_hostname+"/"+@config['deploy_to']
           MU.log "API Endpoint #{@config['name']}: "+my_url, MU::SUMMARY
 
@@ -262,7 +262,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
               end
 
               dom_desc = begin
-                MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_domain_name(domain_name: dnsname)
+                MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_domain_name(domain_name: dnsname)
               rescue ::Aws::APIGateway::Errors::NotFoundException
 
                 params = {
@@ -278,10 +278,10 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
                 end
 
                 MU.log "Creating API Gateway Domain Name #{dnsname}", MU::NOTICE, details: params
-                MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).create_domain_name(params)
+                MU::Cloud::AWS.apig(region: @region, credentials: @credentials).create_domain_name(params)
               end
 
-              mappings = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_base_path_mappings(domain_name: dnsname, limit: 500).items
+              mappings = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_base_path_mappings(domain_name: dnsname, limit: 500).items
               found = false
               if mappings
                 mappings.each { |m|
@@ -293,7 +293,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
               end
               if !found
                 MU.log "Mapping #{dnsname} to API Gateway #{@mu_name}"
-                MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).create_base_path_mapping(
+                MU::Cloud::AWS.apig(region: @region, credentials: @credentials).create_base_path_mapping(
                   domain_name: dnsname,
                   rest_api_id: @cloud_id,
                   stage: @config['deploy_to']
@@ -308,7 +308,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
 
           # The creation of our deployment should have created a matching stage,
           # which we're now going to mess with.
-          stage = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_stage(
+          stage = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_stage(
             rest_api_id: @cloud_id,
             stage_name: @config['deploy_to']
           )
@@ -316,7 +316,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
           if @config['access_logs'] and !stage.access_log_settings
             log_ref = MU::Config::Ref.get(@config['access_logs'])
             MU.log "Enabling API Gateway access logs to CloudWatch Log Group #{log_ref.cloud_id}"
-            stage = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).update_stage(
+            stage = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).update_stage(
               rest_api_id: @cloud_id,
               stage_name: @config['deploy_to'],
               patch_operations: [
@@ -350,11 +350,11 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
           end
 
 
-#          resp = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).create_authorizer(
+#          resp = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).create_authorizer(
 #            rest_api_id: @cloud_id,
 #          )
 
-#          resp = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).create_vpc_link(
+#          resp = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).create_vpc_link(
 #          )
  
         end
@@ -364,7 +364,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
         def cloud_desc(use_cache: true)
           return @cloud_desc_cache if @cloud_desc_cache and use_cache
           return nil if !@cloud_id
-          @cloud_desc_cache = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_rest_api(
+          @cloud_desc_cache = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_rest_api(
             rest_api_id: @cloud_id
           )
           @cloud_desc_cache
@@ -375,7 +375,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
         def notify
           return nil if !@cloud_id or !cloud_desc(use_cache: false)
           deploy_struct = MU.structToHash(cloud_desc, stringify_keys: true)
-          deploy_struct['url'] = "https://"+@cloud_id+".execute-api."+@config['region']+".amazonaws.com"
+          deploy_struct['url'] = "https://"+@cloud_id+".execute-api."+@region+".amazonaws.com"
           deploy_struct['url'] += "/"+@config['deploy_to'] if @config['deploy_to']
 # XXX stages and whatnot
           return deploy_struct
@@ -466,7 +466,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
             "cloud" => "AWS",
             "credentials" => @credentials,
             "cloud_id" => @cloud_id,
-            "region" => @config['region']
+            "region" => @region
           }
 
           if !cloud_desc
@@ -476,7 +476,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
 
           bok['name'] = cloud_desc.name
 
-          resources = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_resources(
+          resources = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_resources(
             rest_api_id: @cloud_id,
           ).items
 
@@ -485,7 +485,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
             r.resource_methods.each_pair { |http_type, m|
               bok['methods'] ||= []
               method = {}
-              m_desc = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_method(
+              m_desc = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_method(
                 rest_api_id: @cloud_id,
                 resource_id: r.id,
                 http_method: http_type 
@@ -535,7 +535,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
                       cloud: "AWS",
                       integration_http_method: m_desc.method_integration.http_method
                     )
-                  elsif m_desc.method_integration.uri.match(/#{@config['region']}:([^:]+):action\/(.*)/)
+                  elsif m_desc.method_integration.uri.match(/#{@region}:([^:]+):action\/(.*)/)
                     method['integrate_with'] = {
                       "type" => "aws_generic",
                       "integration_http_method" => m_desc.method_integration.http_method,
@@ -594,10 +594,10 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
             }
           }
 
-          deployment = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_deployments(
+          deployment = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_deployments(
             rest_api_id: @cloud_id
           ).items.sort { |a, b| a.created_date <=> b.created_date }.last
-          stages = MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_stages(
+          stages = MU::Cloud::AWS.apig(region: @region, credentials: @credentials).get_stages(
             rest_api_id: @cloud_id,
             deployment_id: deployment.id
           )
@@ -612,7 +612,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
               bok['access_logs'] = MU::Config::Ref.get(
                 id: stage.access_log_settings.destination_arn.sub(/.*?:([^:]+)$/, '\1'),
                 credentials: @credentials,
-                region: @config['region'],
+                region: @region,
                 type: "logs",
                 cloud: "AWS"
               )
@@ -860,7 +860,7 @@ MU::Cloud::AWS.apig(region: @config['region'], credentials: @credentials).get_re
         # Canonical Amazon Resource Number for this resource
         # @return [String]
         def arn
-          "arn:#{MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws"}:execute-api:#{@config["region"]}:#{MU::Cloud::AWS.credToAcct(@credentials)}:#{@cloud_id}"
+          "arn:#{MU::Cloud::AWS.isGovCloud?(@region) ? "aws-us-gov" : "aws"}:execute-api:#{@region}:#{MU::Cloud::AWS.credToAcct(@credentials)}:#{@cloud_id}"
         end
 
 

data/modules/mu/providers/aws/firewall_rule.rb

@@ -52,14 +52,14 @@ module MU
           begin
             MU.log "Creating EC2 Security Group #{groupname}", details: sg_struct
 
-            secgroup = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).create_security_group(sg_struct)
+            secgroup = MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).create_security_group(sg_struct)
             @cloud_id = secgroup.group_id
           rescue Aws::EC2::Errors::InvalidGroupDuplicate
             MU.log "EC2 Security Group #{groupname} already exists, using it", MU::NOTICE
             filters = [{name: "group-name", values: [groupname]}]
             filters << {name: "vpc-id", values: [vpc_id]} if !vpc_id.nil?
 
-            secgroup = MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_security_groups(filters: filters).security_groups.first
+            secgroup = MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).describe_security_groups(filters: filters).security_groups.first
             if secgroup.nil?
               raise MuError, "Failed to locate security group named #{groupname}, even though EC2 says it already exists", caller
             end
@@ -67,25 +67,25 @@ module MU
           end
 
           begin
-            MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).describe_security_groups(group_ids: [secgroup.group_id])
+            MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).describe_security_groups(group_ids: [secgroup.group_id])
           rescue Aws::EC2::Errors::InvalidGroupNotFound
             MU.log "#{secgroup.group_id} not yet ready, waiting...", MU::NOTICE
             sleep 10
             retry
           end
 
-          MU::Cloud::AWS.createStandardTags(secgroup.group_id, region: @config['region'], credentials: @config['credentials'])
-          MU::Cloud::AWS.createTag(secgroup.group_id, "Name", groupname, region: @config['region'], credentials: @config['credentials'])
+          MU::Cloud::AWS.createStandardTags(secgroup.group_id, region: @region, credentials: @credentials)
+          MU::Cloud::AWS.createTag(secgroup.group_id, "Name", groupname, region: @region, credentials: @credentials)
 
           if @config['optional_tags']
             MU::MommaCat.listOptionalTags.each { |key, value|
-              MU::Cloud::AWS.createTag(secgroup.group_id, key, value, region: @config['region'], credentials: @config['credentials'])
+              MU::Cloud::AWS.createTag(secgroup.group_id, key, value, region: @region, credentials: @credentials)
             }
           end
 
           if @config['tags']
             @config['tags'].each { |tag|
-              MU::Cloud::AWS.createTag(secgroup.group_id, tag['key'], tag['value'], region: @config['region'], credentials: @config['credentials'])
+              MU::Cloud::AWS.createTag(secgroup.group_id, tag['key'], tag['value'], region: @region, credentials: @credentials)
             }
           end
 
@@ -123,7 +123,7 @@ module MU
         # Log metadata about this ruleset to the currently running deployment
         def notify
           sg_data = MU.structToHash(
-              MU::Cloud::FirewallRule.find(cloud_id: @cloud_id, region: @config['region'])
+              MU::Cloud::FirewallRule.find(cloud_id: @cloud_id, region: @region)
           )
           sg_data["group_id"] = @cloud_id
           sg_data["cloud_id"] = @cloud_id
@@ -151,8 +151,11 @@ module MU
             rule["firewall_rules"].concat(sgs.map { |s|
               MU::Config::Ref.get(
                 id: s,
+                region: @region,
+                credentials: @credentials,
                 cloud: "AWS",
-                type: "firewall_rule"
+                type: "firewall_rule",
+                dummy_ok: true
               )
             })
           end
@@ -169,12 +172,12 @@ module MU
 
           begin
             if egress
-              MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_egress(
+              MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).authorize_security_group_egress(
                 group_id: @cloud_id,
                 ip_permissions: ec2_rule
               )
             else
-              MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_ingress(
+              MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).authorize_security_group_ingress(
                 group_id: @cloud_id,
                 ip_permissions: ec2_rule
               )
@@ -185,12 +188,12 @@ module MU
             # existing rules
             if comment
               if egress
-                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).update_security_group_rule_descriptions_egress(
+                MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).update_security_group_rule_descriptions_egress(
                   group_id: @cloud_id,
                   ip_permissions: ec2_rule
                 )
               else
-                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).update_security_group_rule_descriptions_ingress(
+                MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).update_security_group_rule_descriptions_ingress(
                   group_id: @cloud_id,
                   ip_permissions: ec2_rule
                 )
@@ -202,7 +205,7 @@ module MU
         # Canonical Amazon Resource Number for this resource
         # @return [String]
         def arn
-          "arn:"+(MU::Cloud::AWS.isGovCloud?(@config["region"]) ? "aws-us-gov" : "aws")+":ec2:"+@config['region']+":"+MU::Cloud::AWS.credToAcct(@config['credentials'])+":security-group/"+@cloud_id
+          "arn:"+(MU::Cloud::AWS.isGovCloud?(@region) ? "aws-us-gov" : "aws")+":ec2:"+@region+":"+MU::Cloud::AWS.credToAcct(@credentials)+":security-group/"+@cloud_id
         end
 
         # Locate an existing security group or groups and return an array containing matching AWS resource descriptors for those that match.
@@ -248,9 +251,9 @@ module MU
         def toKitten(**_args)
           bok = {
             "cloud" => "AWS",
-            "credentials" => @config['credentials'],
+            "credentials" => @credentials,
             "cloud_id" => @cloud_id,
-            "region" => @config['region']
+            "region" => @region
           }
 
           if !cloud_desc
@@ -649,7 +652,7 @@ module MU
             if rule['firewall_rules']
               rule['firewall_rules'].each { |sg|
                 if sg['name'] and !sg['deploy_id']
-                  MU::Config.addDependency(acl, sg['name'], "firewall_rule", no_create_wait: true)
+                  MU::Config.addDependency(acl, sg['name'], "firewall_rule", my_phase: "groom")
                 end
               }
             end
@@ -657,7 +660,7 @@ module MU
             if rule['loadbalancers']
               rule['loadbalancers'].each { |lb|
                 if lb['name'] and !lb['deploy_id']
-                  MU::Config.addDependency(acl, lb['name'], "loadbalancer", phase: "groom")
+                  MU::Config.addDependency(acl, lb['name'], "loadbalancer", their_phase: "groom")
                 end
               }
             end
@@ -731,7 +734,7 @@ module MU
                 end
               }
               MU.log "Removing unconfigured rule in #{@mu_name}", MU::WARN, details: ext_rule
-              MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_ingress(
+              MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).revoke_security_group_ingress(
                 group_id: @cloud_id,
                 ip_permissions: [ext_rule]
               )
@@ -797,7 +800,7 @@ module MU
               if ingress
                 if haverule
                   begin
-                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_ingress(
+                    MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).revoke_security_group_ingress(
                       group_id: @cloud_id,
                       ip_permissions: [haverule]
                     )
@@ -805,7 +808,7 @@ module MU
                   end
                 end
                 begin
-                  MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_ingress(
+                  MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).authorize_security_group_ingress(
                     group_id: @cloud_id,
                     ip_permissions: [rule]
                   )
@@ -818,14 +821,14 @@ module MU
               if egress
                 if haverule
                   begin
-                    MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).revoke_security_group_egress(
+                    MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).revoke_security_group_egress(
                       group_id: @cloud_id,
                       ip_permissions: [haverule]
                     )
                   rescue Aws::EC2::Errors::InvalidPermissionNotFound
                   end
                 end
-                MU::Cloud::AWS.ec2(region: @config['region'], credentials: @config['credentials']).authorize_security_group_egress(
+                MU::Cloud::AWS.ec2(region: @region, credentials: @credentials).authorize_security_group_egress(
                   group_id: @cloud_id,
                   ip_permissions: [rule]
                 )