AWS Cloud Formation RDS security group in VPC

Question

I am trying to add ingress rules to a security group for an RDS instance, but when I add them it says The security group 'sg-14820a71' does not exist in default VPC 'vpc-527a8037'.

I have explicitly specified the VPC I want the security group in, it should not be using the default. Any idea on how to make it use the correct VPC?

"Resources": {
    "DbVpcSecurityGroup": {
        "DependsOn": ["VPC", "BeanstalkSecurityGroup"],
        "Type": "AWS::EC2::SecurityGroup",
        "Properties": {
            "GroupDescription": "Security group for RDS DB Instance.",
            "VpcId": {
                "Ref": "VPC"
            },
            "SecurityGroupIngress": [{
                    "IpProtocol": "tcp",
                    "FromPort": 3306,
                    "ToPort": 3306,
                    "SourceSecurityGroupName": {
                        "Ref": "BeanstalkSecurityGroup"
                    }
                }]
        }
    }
}

It work fine with no ingress rules (an creating the manually in the GUI):

"Resources": {
    "DbVpcSecurityGroup": {
        "DependsOn": ["VPC", "BeanstalkSecurityGroup"],
        "Type": "AWS::EC2::SecurityGroup",
        "Properties": {
            "GroupDescription": "Security group for RDS DB Instance.",
            "VpcId": {
                "Ref": "VPC"
            },
        }
    }
}

This is the beanstalk security group:

"BeanstalkSecurityGroup": {
    "DependsOn": ["VPC"],
    "Type": "AWS::EC2::SecurityGroup",
    "Properties": {
        "GroupDescription": "Allow the Elastic Beanstalk instances to access the NAT device",
        "VpcId": {
            "Ref": "VPC"
        },
    }
}

When working with vpc, you should use SourceSecurityGroupOwnerId instead of SourceSecurityGroupNam. Also, Are you sure that the BeanstalkSecurityGroup and DbVpcSecurityGroup` belong to same VPC ? — slayedbylucifer
@slayedbylucifer using SourceSecurityGroupOwnerId fixed the issue thanks. Add an answer and I will accept it. — Petah

slayedbylucifer slayedbylucifer · Accepted Answer · 2015-05-21T04:57:59

While working in VPC, we should always use Security Group ID instead of Security Group Name.

So in this case of CloudFormation, use SourceSecurityGroupOwnerId instead of SourceSecurityGroupName

AWS Cloud Formation RDS security group in VPC

1 Answers