Generated Security Group for Dualstack ALB Doesn't Allow IPv6 Connections

[wbprice]

Expected Behavior
When creating an application load balancer (adapted from this example), if I configure ipAddressType to be dualstack, and set internetFacing to true, I would expect the automatically generated security group to allow inbound connections from 0.0.0.0/0 and ::/0.

Actual Behavior
The automatically generated security group only allows inbound connections from 0.0.0.0/0.

Reproduction Steps

Create an application load balancer

    // Create ALB
    const lb = new ApplicationLoadBalancer(
      this,
      camelCase(`alb-${REGION}-${ENV_CODE}-api-load-balancer`),
      {
        vpc,
        internetFacing: true,
        ipAddressType: IpAddressType.DUAL_STACK,
        vpcSubnets: {
          subnets: IPV6EnabledSubnets
        },
      }
    );

Note generated security group

Error Log

n/a

Environment

• aws-cli/2.0.1 Python/3.7.4 Darwin/19.3.0 botocore/2.0.0dev5
• 1.31.0 (build 8f3ac79)
• MacOS Catalina (10.15.3)
• English

Other

I was able to workaround this by creating a security group for the load balancer manually and referencing the autoscaling group security group.

    // Create ALB
    // Configure security group for load balancer
    // TODO: I would expect IPv6 to be included for free, this is a workaround in the meantime.
    const lbSecurityGroup = new SecurityGroup(
      this,
      camelCase(`sg-${REGION}-${ENV_CODE}-api-load-balancer`),
      {
        vpc,
        description: "The API load balancer security group",
      }
    );

    // Add ingress and egress rules for load balancer
    lbSecurityGroup.addIngressRule(Peer.anyIpv4(), Port.tcp(443), "Allow IPv4 connections to the security group on port 443");
    lbSecurityGroup.addIngressRule(Peer.anyIpv6(), Port.tcp(443), "Allow IPv6 connections to the security group on port 443");
    lbSecurityGroup.addEgressRule(autoScalingGroup.connections.securityGroups[0], Port.tcp(80), "Allow port 80 IPv4 connections to the autoscaling group");

    const lb = new ApplicationLoadBalancer(
      this,
      camelCase(`alb-${REGION}-${ENV_CODE}-api-load-balancer`),
      {
        vpc,
        internetFacing: true,
        ipAddressType: IpAddressType.DUAL_STACK,
        vpcSubnets: {
          subnets: IPV6EnabledSubnets
        },
        securityGroup: lbSecurityGroup
      }
    );

---

This is 🐛 Bug Report

[ryaeng]

I'm having trouble traversing this one. Anyone care to walk me through it?

[wbprice]

Is there some part of the bug I can help explain better?

[BryanPan342]

@wbprice tackling the issue at the moment, will come back with queries if they come up!