chore(manifest): add security_group to env manifest

internal/pkg/deploy/cloudformation/stack/env.go

@@ -5,10 +5,13 @@ package stack
 
 import (
 	"fmt"
-
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
+	"github.com/aws/copilot-cli/internal/pkg/manifest"
+	"gopkg.in/yaml.v3"
+	"strings"
+
 	"github.com/aws/copilot-cli/internal/pkg/config"
 	"github.com/aws/copilot-cli/internal/pkg/deploy"
 	"github.com/aws/copilot-cli/internal/pkg/template"
@@ -87,6 +90,11 @@ func (e *EnvStackConfig) Template() (string, error) {
 	if err != nil {
 		return "", err
 	}
+
+	securityGroupConfig, err := getSecurityGroupConfig(e.in.Mft)
+	if err != nil {
+		return "", err
+	}
 	forceUpdateID := e.lastForceUpdateID
 	if e.in.ForceUpdate {
 		id, err := uuid.NewRandom()
@@ -107,6 +115,7 @@ func (e *EnvStackConfig) Template() (string, error) {
 		CustomInternalALBSubnets: e.internalALBSubnets(),
 		AllowVPCIngress:          aws.BoolValue(e.in.Mft.HTTPConfig.Private.SecurityGroupsConfig.Ingress.VPCIngress),
 		Telemetry:                e.telemetryConfig(),
+		SecurityGroupConfig:      securityGroupConfig,
 		CDNConfig:                e.cdnConfig(),
 
 		Version:            e.in.Version,
@@ -120,6 +129,30 @@ func (e *EnvStackConfig) Template() (string, error) {
 	return content.String(), nil
 }
 
+func getSecurityGroupConfig(mft *manifest.Environment) (*template.SecurityGroupConfig, error) {
+	var ingress string
+	if mft != nil && !mft.Network.VPC.SecurityGroupConfig.Ingress.IsZero() {
+		out, err := yaml.Marshal(mft.Network.VPC.SecurityGroupConfig.Ingress)
+		if err != nil {
+			return &template.SecurityGroupConfig{}, fmt.Errorf("marshal security group ingress from environment manifest to embed in template: %w", err)
+		}
+		ingress = strings.TrimSpace(string(out))
+	}
+
+	var egress string
+	if mft != nil && !mft.Network.VPC.SecurityGroupConfig.Egress.IsZero() {
+		out, err := yaml.Marshal(mft.Network.VPC.SecurityGroupConfig.Egress)
+		if err != nil {
+			return &template.SecurityGroupConfig{}, fmt.Errorf("marshal security group egress from environment manifest to embed in template: %w", err)
+		}
+		egress = strings.TrimSpace(string(out))
+	}
+	return &template.SecurityGroupConfig{
+		Ingress: ingress,
+		Egress:  egress,
+	}, nil
+}
+
 // Parameters returns the parameters to be passed into an environment CloudFormation template.
 func (e *EnvStackConfig) Parameters() ([]*cloudformation.Parameter, error) {
 	httpsListener := "false"

internal/pkg/deploy/cloudformation/stack/env_integration_test.go

@@ -64,6 +64,59 @@ observability:
 			}(),
 			wantedFileName: "template-with-imported-certs-observability.yml",
 		},
+
+		"generate template with embedded manifest file with custom security groups rules added by the customer": {
+			input: func() *deploy.CreateEnvironmentInput {
+				rawMft := `name: test
+type: Environment
+# Create the public ALB with certificates attached.
+http:
+  public:
+    certificates:
+      - cert-1
+      - cert-2
+observability:
+  container_insights: true # Enable container insights.
+network:
+  vpc:
+    security_group:
+      ingress:
+        - IpProtocol: tcp
+          FromPort: 0
+          ToPort: 65535
+        - IpProtocol: tcp
+          FromPort: 1
+          ToPort: 6
+      egress:
+        - IpProtocol: tcp
+          FromPort: 0
+          ToPort: 65535`
+				var mft manifest.Environment
+				err := yaml.Unmarshal([]byte(rawMft), &mft)
+				require.NoError(t, err)
+				return &deploy.CreateEnvironmentInput{
+					Version: "1.x",
+					App: deploy.AppInformation{
+						AccountPrincipalARN: "arn:aws:iam::000000000:root",
+						Name:                "demo",
+					},
+					Name:                 "test",
+					ArtifactBucketARN:    "arn:aws:s3:::mockbucket",
+					ArtifactBucketKeyARN: "arn:aws:kms:us-west-2:000000000:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+					CustomResourcesURLs: map[string]string{
+						"CertificateValidationFunction": "https://mockbucket.s3-us-west-2.amazonaws.com/dns-cert-validator",
+						"DNSDelegationFunction":         "https://mockbucket.s3-us-west-2.amazonaws.com/dns-delegation",
+						"CustomDomainFunction":          "https://mockbucket.s3-us-west-2.amazonaws.com/custom-domain",
+					},
+					AllowVPCIngress: true,
+					Mft:             &mft,
+					RawMft:          []byte(rawMft),
+				}
+			}(),
+
+			wantedFileName: "template-with-custom-security-group.yml",
+		},
+
 		"generate template with custom resources": {
 			input: func() *deploy.CreateEnvironmentInput {
 				rawMft := `name: test

internal/pkg/deploy/cloudformation/stack/env_test.go

@@ -56,6 +56,7 @@ func TestEnv_Template(t *testing.T) {
 								Key:    "mockkey4",
 							},
 						},
+						SecurityGroupConfig: &template.SecurityGroupConfig{},
 						Telemetry: &template.Telemetry{
 							EnableContainerInsights: false,
 						},