Security Group Ingress failure for tcp/udp/icmp

[kddejong]

Is this feature request related to a new rule or cfn-lint capabilities?

rules

Describe the feature you'd like to request

When deploying the provided template you will get the errorInvalid value for portRange. Must specify both from and to ports with ICMP

Describe the solution you'd like

When using tcp, udp, and icmp a port range must be specified.

Additional context

Resources:
  IngressRule:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: 'Security Group Vpc'
      VpcId: "vpc-redacted"
      SecurityGroupIngress:
      -
        IpProtocol: 1
        SourceSecurityGroupName: default

Docs: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-securitygroup-ingress.html#cfn-ec2-securitygroup-ingress-ipprotocol

Is this something that you'd be interested in working on?

• 👋 I may be able to implement this feature request

Would this feature include a breaking change?

• ⚠️ This feature might incur a breaking change

[kddejong]

IpProtocol of 1, icmp, icmpv6 can use FromPort to -1 and ToPort to -1 if one of the values is -1 the other one has to be -1

[kddejong]

In this example to and from ports are ignored. This should be warning. The same holds for IpProtocol when it isn't icmp,icmpv6,tcp,udp

Resources:
  SG1:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "some_group_desc"
      VpcId: vpc-0a3447fff60767d73
      SecurityGroupIngress:
        - IpProtocol: -1
          CidrIp: 10.0.0.0/8
          FromPort: 1
          ToPort: 65535