Machine: selecting an existing AWS security group does not work

[jalbstmeijer]

tested with 0.7.0 and 0.8.0-rc2.

problem 1;

env variable AWS_SECURITY_GROUP gets ignored.
When this is set to an alternative security group, docker-machine still uses security group 'docker-machine'.

problem 2;

when specifying a --amazonec2-security-group, i get the following error;

Error creating machine: Error in driver during machine creation: InvalidPermission.Duplicate: the specified rule "peer: 0.0.0.0/0, TCP, from port: 2376, to port: 2376, ALLOW" already exists

[fideloper]

Would be great (amazing) if some of these actions could be a bit more idempotent, like checking if that security group permission existed before attempting to create a rule.

Some of this is unfortunate circumstances with AWS's API, and puts the onus on docker-machine to improve on. (e.g., the AWS API would ideally see that the rule already exists and just ignore the update, rather than returning an error).

@jalbstmeijer You may need to delete the inbound rule created by docker-machine on that security group and then try again. (Altho since this is 17 days later, you probably figured that out)

[nrvale0]

Deleting the previously created SG entry and re-running the 'create' results in the same duplicate error.

Is there a way to tell the driver to leave the SGs be? If so, I'll just setup the required rules in another provisioning stage.

[nrvale0]

As it turns out, the easiest thing to do without sending a PR is to make sure your SG already has rules for tcp/22 and tcp/2376 before spinning the machine:

https://github.com/docker/machine/blob/master/drivers/amazonec2/amazonec2.go#L1075

[dwilson6]

I ran into this same problem. It looks like the amazonec2 driver was updated to support multiple security groups a while back and that's likely what broke the environment variable option.

[jurajseffer]

Specifying --amazonec2-security-group and passing in an id of a SG that has 22 and 2376 open but not to 0.0.0.0/0 results in DM creating a new security group.

[kevinheins]

Specifying --amazonec2-security-group and passing in an id of a SG that has 22 and 2376 open but not to 0.0.0.0/0 results in DM creating a new security group.

For anyone coming here in 2018, check that you are passing in the correct amazonec2-vpc-id and amazonec2-subnet-id. I just ran into this myself and realized it was duplicating the security group because it was using my default VPC and Subnet/

[f3lang]

Also small side note here. If you specify the security group by id, it tries to recreate it. If you specify it by the name, it works. dm tries to find the security group by name and not by id.