(aws-ec2): securityGroupName returns id of sg and not name

[alexjfisher]

The securityGroupName property is documented as

An attribute that represents the security group name.

Unfortunately, it can return the ID of the security group, and not the name, (depending on how the security group is created?)

Reproduction Steps

    const vpc = ec2.Vpc.fromLookup(this, 'VPC', {
      tags: { 'aws:cloudformation:stack-name': 'BaseStack' },
    });
    const sg = new ec2.SecurityGroup(this, 'sg', {
      vpc,
      securityGroupName: "my-security-group",
    });

    // SNIP //

    // Try to reference the securityGroupName later, eg. in a Fargate container's environment variables
    const container = fargateTaskDefinition.addContainer("my-container", {
      // SNIP //
      environment: {
        "AWS_SECURITY_GROUP": sg.securityGroupName,
      },
    });

What did you expect to happen?

I expected the AWS_SECURITY_GROUP environment variable passed to my fargate task's container to contain the value my-security-group.

What actually happened?

It contained the security group id, (starting sg-).

Environment

• CDK CLI Version : 1.94.1
• Framework Version: ?
• Node.js Version: v14.15.5
• OS : CentOS 7
• Language (Version): TypeScript

Other

Looking at the relevant part of cloudformation generated,

{
  "Name": "AWS_SECURITY_GROUP",
  "Value": {
    "Ref": "sgDE989EBE"
   }
}

and the implementation.

aws-cdk/packages/@aws-cdk/aws-ec2/lib/security-group.ts

Line 412 in 2fed1e1

this.securityGroupName = this.securityGroup.ref;

I think the issue is perhaps a cloud formation limitation and related to me creating the security group with the vpc attribute.

From https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group.html

Ref:
When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the resource ID. For security groups that were created without specifying a VPC (EC2-Classic or a default VPC), Ref returns the resource name.

P.S. I'm new to both CDK and typescript/javascript, so apologies if I've messed something up.

---

This is 🐛 Bug Report

[rix0rrr]

You are completely correct.

In fact it seems like it's not possible to obtain a security group's name, so we should probably deprecate the accessor and make it throw.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.