Gremlin Resolver SG with all open egress.

[ramanp07]

Please could some one help me in understanding the reason for having an open egress to the internet for the security group attached to the Gremlin Resolver Lambda. The SG is provided below for easy reference and the link to it is here - https://github.com/aws-solutions/workload-discovery-on-aws/blob/main/source/cfn/templates/gremlin-resolvers.template#L56

GremlinResolverLambdaSg:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F1000
            reason: Needs open egress for API as it is on the internet.
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Security group for Gremlin AppSync lambda
      VpcId: !Ref VpcId
#      SecurityGroupEgress:
#        - Description: Explicit egress group locking down outbound access for HTTPS
#          CidrIp: !Ref VPCCidrBlock
#          IpProtocol: tcp
#          ToPort: !Ref NeptuneClusterPort
#          FromPort: !Ref NeptuneClusterPort

Thank you!

[svozza]

This appears to be leftover from when the solution had a monolithic lambda function that made calls not only to the database but multiple AWS services using the SDK, thus requiring access to the internet so those SDK calls could be made. I've tested it and you can uncomment the code back in and everything should work. We will update this in the the next release.

[ramanp07]

Hi Stefano, This makes more sense now 👍. Thank you!

[svozza]

FYI, this was updated in the 2.1.10 release last week.