(ec2): addIngressRule and addEgressRule detect unresolved tokens as duplicates

### What is the problem?

When passing in a token to the `peer` property of these functions, the `renderPeer()` function is called and will return a constant value `'{IndirectPeer}'`. 
https://github.com/aws/aws-cdk/blob/5831456465fa44af96a268de56db0e3a8d3c2ea6/packages/%40aws-cdk/aws-ec2/lib/security-group.ts#L174-L193

If the other properties remain constant, calling this multiple times will cause only one rule to be added to the security group due to the duplicate checker seen here https://github.com/aws/aws-cdk/blob/5831456465fa44af96a268de56db0e3a8d3c2ea6/packages/%40aws-cdk/aws-ec2/lib/security-group.ts#L86-L96

### Reproduction Steps

Call `addIngressRule()` or `addEgressRule()` multiple times on a security group, while only changing the `peer` prop from one token to another token. Only one rule will be added

### What did you expect to happen?

I was trying to add multiple ingress rules to a security group

### What actually happened?

I only added one ingress rule to a security group

### CDK CLI Version

latest

### Framework Version

_No response_

### Node.js Version

16

### OS

mac

### Language

Typescript

### Language Version

_No response_

### Other information

_No response_

	function determineRuleScope(
	group: SecurityGroupBase,
	peer: IPeer,
	connection: Port,
	fromTo: 'from' \| 'to',
	remoteRule?: boolean): [SecurityGroupBase, string] {

	if (remoteRule && SecurityGroupBase.isSecurityGroup(peer) && differentStacks(group, peer)) {
	// Reversed
	const reversedFromTo = fromTo === 'from' ? 'to' : 'from';
	return [peer, `${group.uniqueId}:${connection} ${reversedFromTo}`];
	} else {
	// Regular (do old ID escaping to in order to not disturb existing deployments)
	return [group, `${fromTo} ${renderPeer(peer)}:${connection}`.replace('/', '_')];
	}
	}

	function renderPeer(peer: IPeer) {
	return Token.isUnresolved(peer.uniqueId) ? '{IndirectPeer}' : peer.uniqueId;
	}

	const [scope, id] = determineRuleScope(this, peer, connection, 'from', remoteRule);

	// Skip duplicates
	if (scope.node.tryFindChild(id) === undefined) {
	new CfnSecurityGroupIngress(scope, id, {
	groupId: this.securityGroupId,
	...peer.toIngressRuleConfig(),
	...connection.toRuleJson(),
	description,
	});
	}

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(ec2): addIngressRule and addEgressRule detect unresolved tokens as duplicates #17201

What is the problem?

Reproduction Steps

What did you expect to happen?

What actually happened?

CDK CLI Version

Framework Version

Node.js Version

OS

Language

Language Version

Other information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

(ec2): addIngressRule and addEgressRule detect unresolved tokens as duplicates #17201

Description

What is the problem?

Reproduction Steps

What did you expect to happen?

What actually happened?

CDK CLI Version

Framework Version

Node.js Version

OS

Language

Language Version

Other information

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions