feat: configure environment security group from env manifest

internal/pkg/deploy/cloudformation/stack/env.go

@@ -5,7 +5,6 @@ package stack
 
 import (
 	"fmt"
-
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/arn"
 	"github.com/aws/aws-sdk-go/service/cloudformation"
@@ -95,13 +94,19 @@ func (e *EnvStackConfig) Template() (string, error) {
 		}
 		forceUpdateID = id.String()
 	}
+
+	vpcConfig, err := e.vpcConfig()
+	if err != nil {
+		return "", err
+	}
+
 	content, err := e.parser.ParseEnv(&template.EnvOpts{
 		AppName:              e.in.App.Name,
 		EnvName:              e.in.Name,
 		CustomResources:      crs,
 		ArtifactBucketARN:    e.in.ArtifactBucketARN,
 		ArtifactBucketKeyARN: e.in.ArtifactBucketKeyARN,
-		VPCConfig:            e.vpcConfig(),
+		VPCConfig:            vpcConfig,
 		PublicHTTPConfig:     e.publicHTTPConfig(),
 		PrivateHTTPConfig:    e.privateHTTPConfig(),
 		Telemetry:            e.telemetryConfig(),
@@ -365,12 +370,17 @@ func (e *EnvStackConfig) privateHTTPConfig() template.HTTPConfig {
 	}
 }
 
-func (e *EnvStackConfig) vpcConfig() template.VPCConfig {
-	return template.VPCConfig{
-		Imported:        e.importVPC(),
-		Managed:         e.managedVPC(),
-		AllowVPCIngress: aws.BoolValue(e.in.Mft.HTTPConfig.Private.SecurityGroupsConfig.Ingress.VPCIngress),
+func (e *EnvStackConfig) vpcConfig() (template.VPCConfig, error) {
+	securityGroupConfig, err := convertEnvSecurityGroupCfg(e.in.Mft)
+	if err != nil {
+		return template.VPCConfig{}, err
 	}
+	return template.VPCConfig{
+		Imported:            e.importVPC(),
+		Managed:             e.managedVPC(),
+		AllowVPCIngress:     aws.BoolValue(e.in.Mft.HTTPConfig.Private.SecurityGroupsConfig.Ingress.VPCIngress),
+		SecurityGroupConfig: securityGroupConfig,
+	}, nil
 }
 
 func (e *EnvStackConfig) importVPC() *template.ImportVPC {

internal/pkg/deploy/cloudformation/stack/env_integration_test.go

@@ -70,6 +70,100 @@ observability:
 			}(),
 			wantedFileName: "template-with-imported-certs-observability.yml",
 		},
+
+		"generate template with embedded manifest file with custom security groups rules added by the customer": {
+			input: func() *deploy.CreateEnvironmentInput {
+				rawMft := `name: test
+type: Environment
+# Create the public ALB with certificates attached.
+http:
+  public:
+    certificates:
+      - cert-1
+      - cert-2
+observability:
+  container_insights: true # Enable container insights.
+network:
+  vpc:
+    security_group:
+      ingress:
+        - ip_protocol: tcp
+          ports: 10
+          cidr: 0.0.0.0
+        - ip_protocol: tcp
+          ports: 1-10
+          cidr: 0.0.0.0
+      egress:
+        - ip_protocol: tcp
+          ports: 0-65535
+          cidr: 0.0.0.0`
+				var mft manifest.Environment
+				err := yaml.Unmarshal([]byte(rawMft), &mft)
+				require.NoError(t, err)
+				return &deploy.CreateEnvironmentInput{
+					Version: "1.x",
+					App: deploy.AppInformation{
+						AccountPrincipalARN: "arn:aws:iam::000000000:root",
+						Name:                "demo",
+					},
+					Name:                 "test",
+					ArtifactBucketARN:    "arn:aws:s3:::mockbucket",
+					ArtifactBucketKeyARN: "arn:aws:kms:us-west-2:000000000:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+					CustomResourcesURLs: map[string]string{
+						"CertificateValidationFunction": "https://mockbucket.s3-us-west-2.amazonaws.com/dns-cert-validator",
+						"DNSDelegationFunction":         "https://mockbucket.s3-us-west-2.amazonaws.com/dns-delegation",
+						"CustomDomainFunction":          "https://mockbucket.s3-us-west-2.amazonaws.com/custom-domain",
+					},
+					AllowVPCIngress: true,
+					Mft:             &mft,
+					RawMft:          []byte(rawMft),
+				}
+			}(),
+
+			wantedFileName: "template-with-custom-security-group.yml",
+		},
+
+		"generate template with embedded manifest file with empty security groups rules added by the customer": {
+			input: func() *deploy.CreateEnvironmentInput {
+				rawMft := `name: test
+type: Environment
+# Create the public ALB with certificates attached.
+http:
+  public:
+    certificates:
+      - cert-1
+      - cert-2
+observability:
+  container_insights: true # Enable container insights.
+security_group:
+  ingress:
+  egress:`
+				var mft manifest.Environment
+				err := yaml.Unmarshal([]byte(rawMft), &mft)
+				require.NoError(t, err)
+				return &deploy.CreateEnvironmentInput{
+					Version: "1.x",
+					App: deploy.AppInformation{
+						AccountPrincipalARN: "arn:aws:iam::000000000:root",
+						Name:                "demo",
+					},
+					Name:                 "test",
+					ArtifactBucketARN:    "arn:aws:s3:::mockbucket",
+					ArtifactBucketKeyARN: "arn:aws:kms:us-west-2:000000000:key/1234abcd-12ab-34cd-56ef-1234567890ab",
+					CustomResourcesURLs: map[string]string{
+						"CertificateValidationFunction": "https://mockbucket.s3-us-west-2.amazonaws.com/dns-cert-validator",
+						"DNSDelegationFunction":         "https://mockbucket.s3-us-west-2.amazonaws.com/dns-delegation",
+						"CustomDomainFunction":          "https://mockbucket.s3-us-west-2.amazonaws.com/custom-domain",
+					},
+					AllowVPCIngress: true,
+					Mft:             &mft,
+					RawMft:          []byte(rawMft),
+				}
+			}(),
+
+			wantedFileName: "template-with-custom-empty-security-group.yml",
+		},
+
 		"generate template with custom resources": {
 			input: func() *deploy.CreateEnvironmentInput {
 				rawMft := `name: test

internal/pkg/deploy/cloudformation/stack/env_test.go

@@ -40,6 +40,7 @@ func TestEnv_Template(t *testing.T) {
 								PrivateSubnetCIDRs: DefaultPrivateSubnetCIDRs,
 								PublicSubnetCIDRs:  DefaultPublicSubnetCIDRs,
 							},
+							SecurityGroupConfig: nil,
 						},
 						LatestVersion: deploy.LatestEnvTemplateVersion,
 						CustomResources: map[string]template.S3ObjectLocation{
@@ -59,6 +60,7 @@ func TestEnv_Template(t *testing.T) {
 						Telemetry: &template.Telemetry{
 							EnableContainerInsights: false,
 						},
+
 						SerializedManifest: "name: env\ntype: Environment\n",
 						ForceUpdateID:      "mockPreviousForceUpdateID",
 					}, data)