(aws-ec2): Launch template support for multiple security groups

[TimQuist]

Description

Hi,

I noticed when migrating my EC2 launch template definition to CDK (Typescript project) that there is currently no option to provide multiple security groups for a launch template. When creating a launch template in the AWS Console this is possible to do.

I'm not sure if i am missing something here but it does not seem possible to add multiple security groups during creation or assigning additional security groups

Use Case

It would be nice to be able to re-use existing security groups instead of having to make a new (duplicate) one which is just a bunch of existing security groups combined.

Proposed Solution

LaunchTemplateProps currently only is able to process a single securityGroup. It would be nice if this would accept ISecurityGroup or ISecurityGroup[]

Another option would to be able to add additional security groups to the LaunchTemplate after instantiating just like with EC2 instances by using addSecurityGroup(securityGroup)

EDIT: Alternative is to use CfnLaunchTemplate since this does support multiple security groups.

Other information

No response

Acknowledge

• I may be able to implement this feature request
• This feature might incur a breaking change

[corymhall]

@TimQuist currently it is possible via connections

const launchTemplate = new ec2.LaunchTemplate(this, 'LT', {
  securityGroup,
});

launchTemplate.connections.addSecurityGroup(sg2);

But I do agree that we should make this easier through through a method on launch template or something.

[TimQuist]

@corymhall Ah, I have completely missed that! Thanks for the clarification.

I agree it would be a nice addition to have it directly on a method to prevent others like me sending issues like this in the future :)

[panchesrbovski]

Just to add one more workaround that did the job for me in this case.

#python
cfn_lt = launch_template.node.default_child
cfn_lt.add_property_override( "LaunchTemplateData.SecurityGroupIds", [ "security_group_id_string", "security_group_id_string", ... ] )

[andreprawira]

@panchesrbovski those lines are to override an existing security group correct? if we were to create from scratch and empty, since there is no attribute to specify security group id in CDK, then we wouldnt be able to use it?

cause when i use
cfn_lt.add_property_override( "LaunchTemplateData.SecurityGroups", [ "my_sg_1", "my_sg_2"] ) it threw me GroupName is only supported for EC2-Classic and default VPC error

@corymhall thanks it works for python too

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[teemuniiranen]

Be aware that changes to connection object are not reflected to already deployed resources: #18712