Missing attribute DestinationPrefixListId in SecurityGroupRule

[urluba]

Hi everyone,

According to CFN doc, a prefx list can be used in an Egress Security Group:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-rule.html#cfn-ec2-security-group-rule-destinationprefixlistid

DestinationPrefixListId (SecurityGroupEgress only)

The AWS service prefix of an Amazon VPC endpoint. For more information, see VPC Endpoints in the Amazon VPC User Guide.

Required: Conditional. You must specify only one of the following properties: CidrIp, CidrIpv6, DestinationPrefixListId, DestinationSecurityGroupId, or SourceSecurityGroupId.

Type: String

But it's missing in the SecurityGroupRule definition:

troposphere/troposphere/ec2.py

Lines 506 to 518 in d1bb52f

	class SecurityGroupRule(AWSProperty):
	props = {
	'CidrIp': (basestring, False),
	'CidrIpv6': (basestring, False),
	'Description': (basestring, False),
	'FromPort': (network_port, False),
	'IpProtocol': (basestring, True),
	'SourceSecurityGroupId': (basestring, False),
	'SourceSecurityGroupName': (basestring, False),
	'SourceSecurityGroupOwnerId': (basestring, False),
	'ToPort': (network_port, False),
	'DestinationSecurityGroupId': (basestring, False),
	}

We should have something like;

class SecurityGroupRule(AWSProperty):
    props = {
        'CidrIp': (basestring, False),
        'CidrIpv6': (basestring, False),
        'Description': (basestring, False),
        'FromPort': (network_port, False),
        'IpProtocol': (basestring, True),
        'SourceSecurityGroupId': (basestring, False),
        'SourceSecurityGroupName': (basestring, False),
        'SourceSecurityGroupOwnerId': (basestring, False),
        'ToPort': (network_port, False),
        'DestinationPrefixListId': (basestring, False),
        'DestinationSecurityGroupId': (basestring, False),
}

Note that, SecurityGroupEgress class is correct and can be used as a workaround.

Whatsoever, thanks for the great work! 👍

[markpeek]

Thanks for the issue. Fixed on master now.

Note: SecurityGroupRule is documented but does not exist in the resource specification files. Those have separate properties (Ingress and Egress). In a future version there may be a breaking change as we align with the resource specification.