Bug 34778 – ec2-tools uses security_groups to take both, groups names and groups IDs

Bug 34778 - ec2-tools uses security_groups to take both, groups names and groups IDs


Summary:	ec2-tools uses security_groups to take both, groups names and groups IDs

Status:	RESOLVED WORKSFORME

Product:	UCS Test
Classification:	Unclassified
Component:	Framework
Version:	unspecified
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	---
Assigned To:	UCS maintainers
QA Contact:

URL:
Keywords:

Depends on:
Blocks:
	Show dependency tree / graph

Reported:	2014-05-08 14:33 CEST by Daniel Orrego
Modified:	2020-09-24 08:52 CEST (History)
CC List:	1 user (show)

See Also:
What kind of report is it?:	Development Internal
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Daniel Orrego

2014-05-08 14:33:44 CEST

I am performing some tests with ucs-ec2-tools (0.1.13-1.22.201310310927).

When creating a public instance, the script takes the name of the security group as parameter:

---/usr/lib/pymodules/python2.7/univention/ec2/lib.py:
security_groups=[self.aws_cfg['ec2_security_group']],
---


and when using a private subnet, it expects the same parameter to contain a group ID:
---/usr/lib/pymodules/python2.7/univention/ec2/lib.py
security_group_ids=[self.aws_cfg['ec2_security_group']],
---

* It seems preferable to use security_group_ids always when calling boto.ec2.connection (the only option that you can use when a subnet is specified).

---ERROR:boto:400 Bad Request
ERROR:boto:<?xml version="1.0" encoding="UTF-8"?>
<Response><Errors><Error><Code>InvalidParameterCombination</Code><Message>The parameter groupName cannot be used with the parameter subnet</Message></Error></Errors><RequestID>6ad9a24c-77fa-424b-8499-05ee6c78340b</RequestID></Response>
---

Comment 1 Philipp Hahn

2020-09-24 08:52:00 CEST

This was deliberately by design and is still so even after the migration to Boto3 with Bug #50443:

> if self.aws_cfg.get('ec2_subnet_id'):
>     param['SubnetId'] = self.aws_cfg['ec2_subnet_id']
>     param['SecurityGroupIds'] = [self.aws_cfg['ec2_security_group']]
> else:
>    param['SecurityGroups'] = [self.aws_cfg['ec2_security_group']]

This might be confusing, but works-for-us as we mostly run our VMs inside a VPN subnet. Using it for public VMs is not the norm.