fix(deploy): define missing AllowedCIDR parameter in CloudFormation template - #3
Open
zjdMASTER wants to merge 1 commit into
Open
Conversation
The CloudFormation template referenced an AllowedCIDR parameter in the ALB security group ingress rule, but the parameter was never declared. CloudFormation rejects the template with an unresolved-dependency error, so the one-click deploy (deploy/deploy.sh) fails for both EC2 and ECS modes before any resource is created. Declare the AllowedCIDR parameter, and open the ALB security group on port 80 to match the HTTP listener that the stack actually creates (the ingress previously only permitted 443, for which there is no listener, leaving the ALB unreachable). Port 443 is kept for the documented post-deploy ACM/HTTPS listener.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is wrong
deploy/cfn-agentic-data.yamlreferences anAllowedCIDRparameter in the ALB security group ingress rule:but
AllowedCIDRis never declared in theParametersblock (onlyVpcCidrexists). CloudFormation treats this as an unresolved resource dependency and rejects the template at create/validate time, so the one-click deploy indeploy/deploy.sh(which runsaws cloudformation deploy --template-file cfn-agentic-data.yaml ...) fails for both EC2 and ECS modes before any resource is created.deploy.shalso never passes anAllowedCIDRoverride, so the parameter needs a default.A second, related defect in the same security group: the ingress only opened TCP 443, but the stack's only listener (
ALBListener) is HTTP on port 80, and the stack output /deploy/README.mdadvertisehttp://<alb-dns>. Even once the template parses, the ALB would be unreachable because port 80 is not permitted inbound.The fix
AllowedCIDRparameter (CIDR-validated, default10.0.0.0/8, consistent with the siblingcdk/deploy.shdefault and the template's existing "never 0.0.0.0/0" guidance).How verified
cfn-lint 1.53.1on the original template:E1020 'AllowedCIDR' is not one of [...]atcfn-agentic-data.yaml:327.cfn-lint deploy/cfn-agentic-data.yamlexits 0 with no findings.Not verified
A full live
aws cloudformation deploywas not run (no AWS account was used), so end-to-end stack creation and actual ALB reachability were not exercised. The change is limited to the template parameter declaration and security-group ingress; it was validated statically with cfn-lint.