Join Log in
Score:1
Goural avatar Server

CloudFormation - Updating the SecurityGroupIds of an ec2 instance it recreates the instance instead of modifying the same

cn flag
Goural

I created ec2 instance with cloudformation. When I try to update the securitygroup of the instance in the same template , cloudformation recreates the instance instead of modifying the same (Like in terraform). How to update the SecurityGroup of instance without recreating it ?

For example the below template -

Resources:
  Ec2Instance:
    Type: 'AWS::EC2::Instance'
    Properties:
      InstanceType: t2.micro
      ImageId: ami-0ed9277fb7eb570c9
      SecurityGroupIds:
        - sg-09d68774a93ec40df

Now If I try to add another SecurityGroupIds it recreates the ec2 -

Resources:
  Ec2Instance:
    Type: 'AWS::EC2::Instance'
    Properties:
      InstanceType: t2.micro
      ImageId: ami-0ed9277fb7eb570c9
      SecurityGroupIds:
        - sg-09d68774a93ec40df
        - sg-05555951931eeaca7
92
0 + 0
Tim avatar
gp flag
Tim
Documentation says update of that property creates interruptions but not replacement. Are you changing anything else at the same time? I would expect this to work. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-instance.html#cfn-ec2-instance-securitygroupids
0
Reply
Score:0
avatar Server
cn flag
shearn89

I tested this with a copy of your stack, and see the same behaviour. However, when I create a new VPC (which is recommended security practice, the default VPC should be avoided) the security groups update cleanly without replacement.

I suspect this is to do with the behaviour on the default VPC, and is expected (but odd) behaviour!

I would recommend you create a new VPC with subnets - the VPC wizard does a good job here. Go to Services -> VPC to get started.

My testing file:

Resources:
  Ec2Instance:
    Type: 'AWS::EC2::Instance'
    Properties:
      InstanceType: t2.micro
      # default Amazon Linux AMI
      ImageId: ami-0d37e07bd4ff37148
      SecurityGroupIds:
        # first security group I created in default:
        - sg-0d16f8e62054c9ed0
        # second security group I created in default:
        - sg-0ffc2a7a986ab0e8c

  OtherEc2Instance:
    Type: 'AWS::EC2::Instance'
    Properties:
      InstanceType: t2.micro
      ImageId: ami-0d37e07bd4ff37148
      # Private subnet (no internet) in a new VPC:
      SubnetId: subnet-08dc2104d169a815e
      SecurityGroupIds:
        # First SG in that VPC:
        - sg-0ebec69e461a555b8
        # Second SG in that VPC:
        - sg-00b18a57193a12f5c
0 + 0
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.