Built-in CloudFormationTemplate does not apply VpcCidr to SecurityGroup CIDR #3180
Description
Overview
The ROSA CLI with built-in CloudFormationTemplate does not apply VpcCidr to SecurityGroup CIDR.
Command version and operating system
→ rosa version
I: 1.2.60
I: Your ROSA CLI is up to date.
# OS
macOS Tahoe 26.2
Current behavior
After creating a VPC network for ROSA HCP using rosa-quickstart-default-vpc, the CIDR block of the SecurityGroupis different from the CIDR block of the VPC.
→ rosa create network rosa-quickstart-default-vpc --param Name=rosa-vpc-stack --param Region=us-west-2 --param AvailabilityZoneCount=1 --param VpcCidr=10.1.0.0/16
...
INFO[0139] Resource: SecurityGroup, Type: AWS::EC2::SecurityGroup, ID: sg-033db23d1005e382e
...
INFO[0139] Stack rosa-vpc-stack created
→ aws ec2 describe-vpcs --vpc-ids vpc-081f3f59a2a053596 --region us-west-2 --query 'Vpcs[].CidrBlock'
[
"10.1.0.0/16"
]
→ aws ec2 describe-security-groups --group-ids sg-033db23d1005e382e --region us-west-2 --query 'SecurityGroups[0].IpPermissions'
[
{
"IpProtocol": "-1",
"UserIdGroupPairs": [],
"IpRanges": [
{
"CidrIp": "10.0.0.0/16"
}
],
"Ipv6Ranges": [],
"PrefixListIds": []
}
]
Note that the customizable rosa/cmd/create/network/templates/rosa-quickstart-default-vpc
/cloudformation.yaml has already been updated to apply the VPC CIDR, but the built-in template has not been updated.
Expected behavior
When creating the VPC network with the --param VpcCidr=10.1.0.0/16 option, the securitygroup use the same CIDR block as the VPC.