@go-to-k/cdkd 0.51.3 → 0.51.4

package/dist/cli.js

@@ -21733,10 +21733,21 @@ var EC2Provider = class {
    *    `AllocationId`, `ConnectivityType`, `PrivateIpAddress`.
    *  - **AWS::EC2::RouteTable**: `DescribeRouteTables` for `VpcId`.
    *  - **AWS::EC2::SecurityGroup**: `DescribeSecurityGroups` for
-   *    `GroupName`, `GroupDescription`, `VpcId`. Ingress / egress rules
-   *    are NOT surfaced — the CFn shape is rule-list-style, while AWS
-   *    returns IpPermissions in a different normalized form, and a
-   *    faithful reverse-mapping is out of scope for v1.
+   *    `GroupName`, `GroupDescription`, `VpcId`, plus `SecurityGroupIngress`
+   *    and `SecurityGroupEgress` reverse-mapped from AWS's normalized
+   *    `IpPermissions[]` / `IpPermissionsEgress[]` form. Each AWS
+   *    `IpPermission` is flattened into one CFn rule per `IpRanges` /
+   *    `Ipv6Ranges` / `UserIdGroupPairs` / `PrefixListIds` entry; field
+   *    names follow CFn direction conventions (`Source*` for ingress,
+   *    `Destination*` for egress). When state templates ingress/egress
+   *    rules, AWS's response is reordered to match state's positional
+   *    order via `reconcileSgRules` so the comparator's array compare
+   *    doesn't fire false drift on AWS's normalized ordering. The
+   *    AWS-auto-attached "allow-all 0.0.0.0/0" egress rule is filtered
+   *    out of `SecurityGroupEgress` when state did not template egress
+   *    (the auto-default is invisible to drift). Both arrays are
+   *    always emitted (even as `[]`) so the v3 `observedProperties`
+   *    baseline catches console-side rule ADDs to a templated SG.
    *  - **AWS::EC2::Instance**: `DescribeInstances` for `ImageId`,
    *    `InstanceType`, `KeyName`, `SubnetId`. SecurityGroupIds /
    *    BlockDeviceMappings shape-match is out of scope for v1.
@@ -21761,7 +21772,7 @@ var EC2Provider = class {
    * Returns `undefined` when the resource is gone (any `*NotFound` /
    * `Invalid*` error from the EC2 SDK matches `isNotFoundError`).
    */
-  async readCurrentState(physicalId, logicalId, resourceType) {
+  async readCurrentState(physicalId, logicalId, resourceType, properties) {
     try {
       switch (resourceType) {
         case "AWS::EC2::VPC":
@@ -21775,7 +21786,7 @@ var EC2Provider = class {
         case "AWS::EC2::RouteTable":
           return await this.readRouteTableCurrentState(physicalId);
         case "AWS::EC2::SecurityGroup":
-          return await this.readSecurityGroupCurrentState(physicalId);
+          return await this.readSecurityGroupCurrentState(physicalId, properties);
         case "AWS::EC2::Instance":
           return await this.readInstanceCurrentState(physicalId);
         case "AWS::EC2::NetworkAcl":
@@ -21884,7 +21895,7 @@ var EC2Provider = class {
       result["VpcId"] = rt.VpcId;
     return result;
   }
-  async readSecurityGroupCurrentState(physicalId) {
+  async readSecurityGroupCurrentState(physicalId, properties) {
     const resp = await this.ec2Client.send(
       new DescribeSecurityGroupsCommand2({ GroupIds: [physicalId] })
     );
@@ -21898,6 +21909,15 @@ var EC2Provider = class {
       result["GroupDescription"] = sg.Description;
     if (sg.VpcId !== void 0)
       result["VpcId"] = sg.VpcId;
+    const stateIngress = Array.isArray(properties?.["SecurityGroupIngress"]) ? properties["SecurityGroupIngress"] : void 0;
+    const ingressRules = flattenIpPermissions(sg.IpPermissions ?? [], "ingress");
+    result["SecurityGroupIngress"] = reconcileSgRules(ingressRules, stateIngress, "ingress");
+    const stateEgress = Array.isArray(properties?.["SecurityGroupEgress"]) ? properties["SecurityGroupEgress"] : void 0;
+    let egressRules = flattenIpPermissions(sg.IpPermissionsEgress ?? [], "egress");
+    if (stateEgress === void 0) {
+      egressRules = egressRules.filter((r) => !isDefaultEgressRule(r));
+    }
+    result["SecurityGroupEgress"] = reconcileSgRules(egressRules, stateEgress, "egress");
     return result;
   }
   async readInstanceCurrentState(physicalId) {
@@ -21967,6 +21987,115 @@ var EC2Provider = class {
     }
   }
 };
+function flattenIpPermissions(perms, direction) {
+  const out = [];
+  for (const p of perms) {
+    const base = {};
+    if (p.IpProtocol !== void 0)
+      base["IpProtocol"] = p.IpProtocol;
+    if (p.FromPort !== void 0)
+      base["FromPort"] = p.FromPort;
+    if (p.ToPort !== void 0)
+      base["ToPort"] = p.ToPort;
+    for (const ip of p.IpRanges ?? []) {
+      const rule = { ...base };
+      if (ip.CidrIp !== void 0)
+        rule["CidrIp"] = ip.CidrIp;
+      if (ip.Description !== void 0)
+        rule["Description"] = ip.Description;
+      out.push(rule);
+    }
+    for (const ipv6 of p.Ipv6Ranges ?? []) {
+      const rule = { ...base };
+      if (ipv6.CidrIpv6 !== void 0)
+        rule["CidrIpv6"] = ipv6.CidrIpv6;
+      if (ipv6.Description !== void 0)
+        rule["Description"] = ipv6.Description;
+      out.push(rule);
+    }
+    for (const grp of p.UserIdGroupPairs ?? []) {
+      const rule = { ...base };
+      if (direction === "ingress") {
+        if (grp.GroupId !== void 0)
+          rule["SourceSecurityGroupId"] = grp.GroupId;
+        if (grp.UserId !== void 0)
+          rule["SourceSecurityGroupOwnerId"] = grp.UserId;
+      } else {
+        if (grp.GroupId !== void 0)
+          rule["DestinationSecurityGroupId"] = grp.GroupId;
+      }
+      if (grp.Description !== void 0)
+        rule["Description"] = grp.Description;
+      out.push(rule);
+    }
+    for (const pl of p.PrefixListIds ?? []) {
+      const rule = { ...base };
+      if (direction === "ingress") {
+        if (pl.PrefixListId !== void 0)
+          rule["SourcePrefixListId"] = pl.PrefixListId;
+      } else {
+        if (pl.PrefixListId !== void 0)
+          rule["DestinationPrefixListId"] = pl.PrefixListId;
+      }
+      if (pl.Description !== void 0)
+        rule["Description"] = pl.Description;
+      out.push(rule);
+    }
+    if ((p.IpRanges?.length ?? 0) === 0 && (p.Ipv6Ranges?.length ?? 0) === 0 && (p.UserIdGroupPairs?.length ?? 0) === 0 && (p.PrefixListIds?.length ?? 0) === 0) {
+      out.push({ ...base });
+    }
+  }
+  return out;
+}
+function sgRuleKey(rule, direction) {
+  const peerKey = direction === "egress" ? rule["DestinationSecurityGroupId"] : rule["SourceSecurityGroupId"];
+  const prefixKey = direction === "egress" ? rule["DestinationPrefixListId"] : rule["SourcePrefixListId"];
+  const peerOwner = direction === "ingress" ? rule["SourceSecurityGroupOwnerId"] : void 0;
+  return JSON.stringify({
+    p: rule["IpProtocol"] ?? "-1",
+    f: rule["FromPort"] ?? null,
+    t: rule["ToPort"] ?? null,
+    c4: rule["CidrIp"] ?? null,
+    c6: rule["CidrIpv6"] ?? null,
+    peer: peerKey ?? null,
+    peerOwner: peerOwner ?? null,
+    pl: prefixKey ?? null,
+    d: rule["Description"] ?? null
+  });
+}
+function reconcileSgRules(awsRules, stateRules, direction) {
+  if (!stateRules || stateRules.length === 0)
+    return awsRules;
+  const remaining = [...awsRules];
+  const reordered = [];
+  for (const sr of stateRules) {
+    const key = sgRuleKey(sr, direction);
+    const idx = remaining.findIndex((ar) => sgRuleKey(ar, direction) === key);
+    if (idx >= 0) {
+      reordered.push(remaining.splice(idx, 1)[0]);
+    }
+  }
+  return [...reordered, ...remaining];
+}
+function isDefaultEgressRule(rule) {
+  if (rule["IpProtocol"] !== "-1")
+    return false;
+  if (rule["CidrIp"] !== "0.0.0.0/0")
+    return false;
+  if (rule["CidrIpv6"] !== void 0)
+    return false;
+  if (rule["DestinationSecurityGroupId"] !== void 0)
+    return false;
+  if (rule["DestinationPrefixListId"] !== void 0)
+    return false;
+  if (rule["Description"] !== void 0)
+    return false;
+  if (rule["FromPort"] !== void 0 && rule["FromPort"] !== -1)
+    return false;
+  if (rule["ToPort"] !== void 0 && rule["ToPort"] !== -1)
+    return false;
+  return true;
+}
 
 // src/provisioning/providers/apigateway-provider.ts
 import {
@@ -44581,7 +44710,7 @@ function reorderArgs(argv) {
 }
 async function main() {
   const program = new Command14();
-  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.51.3");
+  program.name("cdkd").description("CDK Direct - Deploy AWS CDK apps directly via SDK/Cloud Control API").version("0.51.4");
   program.addCommand(createBootstrapCommand());
   program.addCommand(createSynthCommand());
   program.addCommand(createListCommand());