aws-cdk: cdk ls throws RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups. #28170
Description
Describe the bug
We have the gitlab cicd pipeline which runs a docker based out of python-3.8-alpine image.
We perform cdk ls operation and it fails with following error:
fn = alambda.DockerImageFunction(
File "/usr/local/lib/python3.8/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
File "/usr/local/lib/python3.8/site-packages/aws_cdk/aws_lambda/__init__.py", line 26367, in __init__
jsii.create(self.__class__, self, [scope, id, props])
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 334, in create
response = self.provider.create(
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 365, in create
return self._process.send(request, CreateResponse)
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 342, in send
raise RuntimeError(resp.error) from JavaScriptError(resp.stack)
RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.
Subprocess exited with error 1
On removing allowAllOutbound from my SecurityGroups, it works as expected.
allowAllOutbound with a value of true is supposed to be the default anyway.
Similar Discussion here - #27669
Expected Behavior
Since its default value, it should not be failing anyway on explicitly specifying it.
Current Behavior
fn = alambda.DockerImageFunction(
File "/usr/local/lib/python3.8/site-packages/jsii/_runtime.py", line 118, in __call__
inst = super(JSIIMeta, cast(JSIIMeta, cls)).__call__(*args, **kwargs)
File "/usr/local/lib/python3.8/site-packages/aws_cdk/aws_lambda/__init__.py", line 26367, in __init__
jsii.create(self.__class__, self, [scope, id, props])
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/__init__.py", line 334, in create
response = self.provider.create(
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 365, in create
return self._process.send(request, CreateResponse)
File "/usr/local/lib/python3.8/site-packages/jsii/_kernel/providers/process.py", line 342, in send
raise RuntimeError(resp.error) from JavaScriptError(resp.stack)
RuntimeError: Configure 'allowAllOutbound' directly on the supplied SecurityGroups.
Subprocess exited with error 1
Reproduction Steps
Won't be able to share complete code -
Docker image from python 3.8-alpine
Add/Install npm, cdk cli, aws-cdk-lib
Create a Security Group for a lambda function and use allow_all_outboud= True. If will fail
Possible Solution
No response
Additional Information/Context
No response
CDK CLI Version
2.110.1
Framework Version
No response
Node.js Version
v18.18.2
OS
Linux Alpine Image
Language
Python
Language Version
Python 3.8.18
Other information
python3 --version
Python 3.8.18
node --version
v18.18.2
aws --version
aws-cli/2.13.5 Python/3.11.6 Linux/5.15.0-1049-aws source/x86_64.alpine.3 prompt/off
cdk --version
2.110.1
npm --version
9.6.6
Note: The issue is seen only when cdk ls is run inside the docker container and not locally.