Question 339185 in Amazon Web Sevices Question posted in
The official Amazon Web Services documentation can be found here.

Amazon web services – Why is this causing a Circular Dependency in Security Group Error: CDK

Why is this creating a circular dependency error?

Error: Deployment failed: Error [ValidationError]: Circular dependency between resources: [docDbSG, elasticDocDbCluster]

I even tried separating the code for DocDbCluster and SecurityGroup in separate stacks but it still shows the same error

// Fetch VPC from ID
    const vpc = ec2.Vpc.fromLookup(this, 'docDbVpc', {
      vpcId: props!.vpcId
    });

    const securityGroup = new ec2.SecurityGroup(this, 'docDbSG', {
      vpc: vpc,
    });

// Add ingress rules
// I believe this is where the issue is coming from, if I remove this line it works
    securityGroup.addIngressRule(ec2.Peer.securityGroupId(securityGroup.securityGroupId), ec2.Port.allTraffic());

    new docdbelastic.CfnCluster(this, 'elasticDocDbCluster', {
      adminUserName: props!.AdminUserName,
      adminUserPassword: "password",
      authType: props!.AuthType,
      clusterName: props!.ClusterName,
      shardCapacity: props!.ShardCapacity,
      shardCount: props!.ShardCount,
      subnetIds: props!.dataSubnets,
      vpcSecurityGroupIds: [securityGroup.securityGroupId],
    });

EDIT:

How to add security group as a source itself in its rules without creating circular dependency?

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    I think the error is misleading. While

    securityGroup.addIngressRule(ec2.Peer.securityGroupId(securityGroup.securityGroupId), ec2.Port.allTraffic());

    gives a circular dependency error between the DocDBCluster and SecurityGroup, commenting out the docDbCluster still generates a circular dependency error -

    Deployment failed: Error [ValidationError]: Circular dependency between resources: [docDbSG]

    This means that the security group itself has a circular dependency. It is probably due to accessing the securityGroupId before it is being created.

    A workaround provided by Zapl in the comments works -

    securityGroup.addIngressRule(securityGroup, ec2.Port.allTraffic());

    Another approach suggested by Andre also works -

    securityGroup.connections.allowInternally(ec2.Port.allTraffic());

  2. 0

    Indeed, you are causing a circular dependency. Here is how you do it:

    securityGroup.connections.allowInternally(ec2.Port.allTraffic());
    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search