fix: retain SG ingress / egress [INFRA-82505] (#138)

Author: ahammond

src/aurora.ts

@@ -51,25 +51,24 @@ class ApplyRemovalPolicyAspect implements IAspect {
 
     const resourceType = node.cfnResourceType;
 
-    // Infrastructure resources to RETAIN
     const retainedTypes = [
       'AWS::KMS::Key',
       'AWS::RDS::DBCluster',
       'AWS::RDS::DBInstance',
       'AWS::RDS::DBClusterParameterGroup',
       'AWS::RDS::DBSubnetGroup',
       'AWS::EC2::SecurityGroup',
+      'AWS::EC2::SecurityGroupEgress',
+      'AWS::EC2::SecurityGroupIngress',
       'AWS::SecretsManager::Secret',
     ];
 
-    // Ephemeral resources to DESTROY
     const destroyedTypes = [
       'AWS::CDK::Metadata',
-      'AWS::CloudFormation::Stack', // Nested stacks
+      'AWS::CloudFormation::Stack',
       'AWS::Lambda::Function',
       'AWS::IAM::Role',
       'AWS::IAM::Policy',
-      'AWS::EC2::SecurityGroupIngress',
       'AWS::SecretsManager::ResourcePolicy',
       'AWS::SecretsManager::RotationSchedule',
       'AWS::SecretsManager::SecretTargetAttachment',

test/aurora.test.ts

@@ -148,27 +148,25 @@ describe('Aurora', () => {
       template.hasResourceProperties('AWS::RDS::DBProxy', { DBProxyName: 'Test' });
     });
     it('removalPolicy defaults to RETAIN for infrastructure resources', () => {
-      // Get all resources from the template
       const templateJson = template.toJSON();
       const resources = templateJson.Resources || {};
 
-      // Check infrastructure resource types that should be retained
       const infrastructureTypes = [
         'AWS::RDS::DBCluster',
         'AWS::RDS::DBInstance',
         'AWS::SecretsManager::Secret',
         'AWS::RDS::DBClusterParameterGroup',
         'AWS::EC2::SecurityGroup',
+        'AWS::EC2::SecurityGroupEgress',
+        'AWS::EC2::SecurityGroupIngress',
       ];
 
       const infrastructureResources = Object.entries(resources).filter(([_, resource]: [string, any]) =>
         infrastructureTypes.includes(resource.Type),
       );
 
-      // Verify we found some infrastructure resources
       expect(infrastructureResources.length).toBeGreaterThan(0);
 
-      // Check that these resources have DeletionPolicy: Retain by default
       infrastructureResources.forEach(([, resource]: [string, any]) => {
         expect(resource.DeletionPolicy).toBe('Retain');
       });
@@ -466,13 +464,14 @@ describe('Aurora', () => {
         const templateJson = template.toJSON();
         const resources = templateJson.Resources || {};
 
-        // Infrastructure resources that should be RETAINED
         const infrastructureTypes = [
           'AWS::RDS::DBCluster',
           'AWS::RDS::DBInstance',
           'AWS::RDS::DBClusterParameterGroup',
           'AWS::RDS::DBSubnetGroup',
           'AWS::EC2::SecurityGroup',
+          'AWS::EC2::SecurityGroupEgress',
+          'AWS::EC2::SecurityGroupIngress',
           'AWS::SecretsManager::Secret',
         ];