fix(elasticache): security group for ServerlessCache does not use default endpoint port

[go-to-k]

Issue # (if applicable)

N/A

Reason for this change

A security group ingress for the new ServerlessCache construct does not use an endpoint port.

The following CDK code generates an INVALID CFn template with null for FromPort and ToPort:

    const cache = new ServerlessCache(this, 'ServerlessCache', {
      vpc,
    });
    const sg = new SecurityGroup(this, 'SecurityGroup', {
      vpc,
    });
    sg.connections.allowToDefaultPort(cache);

  "SecurityGroupfromawscdkserverlesscacheClientSG6D18D5F9IndirectPortFE633A67": {
   "Type": "AWS::EC2::SecurityGroupIngress",
   "Properties": {
    // ...
    // ...
    "FromPort": null,
    // ...
    // ...
    "ToPort": null
   },

An expected template:

  "SecurityGroupfromawscdkserverlesscacheClientSG6D18D5F9IndirectPortFE633A67": {
   "Type": "AWS::EC2::SecurityGroupIngress",
   "Properties": {
    // ...
    // ...
    "FromPort": {
     "Fn::GetAtt": [
      "Cache18F6EE16",
      "Endpoint.Port"
     ]
    },
    // ...
    // ...
    "ToPort": {
     "Fn::GetAtt": [
      "Cache18F6EE16",
      "Endpoint.Port"
     ]
    }
   }
  },

FYI: The method cache.connections.defaultPort?.toRuleJson() outputs {"Value":{"ipProtocol":"tcp","fromPort":null,"toPort":null}}. But we expect {"Value":{"ipProtocol":"tcp","fromPort":{"Fn::GetAtt":["Cache18F6EE16","Endpoint.Port"]},"toPort":{"Fn::GetAtt":["Cache18F6EE16","Endpoint.Port"]}}}.

Description of changes

Use Token.asNumber for the defaultPort of Connections in ServerlessCache:

    this.connections = new ec2.Connections({
      securityGroups: this.securityGroups,
-      defaultPort: ec2.Port.tcp(Lazy.number({ produce: () => parseInt(this.serverlessCacheEndpointPort) })),
+      defaultPort: ec2.Port.tcp(Token.asNumber(this.serverlessCacheEndpointPort)),
    });

Describe any new or updated permissions being added

Description of how you validated changes

Both an unit test and an integ test.

Checklist

• My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[mazyu36]

Thank you for the fix!

Pull request has been modified.

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results

[github-actions]

⚠️ Experimental Feature: This security report is currently in experimental phase. Results may include false positives and the rules are being actively refined.
Please try merge from main to avoid findings unrelated to the PR.

---

	Tests	Passed ✅	Skipped	Failed
Security Guardian Results with resolved templates	48 ran	48 passed

Test	Result
No test annotations available

• View Security Guardian Results with resolved templates

[go-to-k]

@Mergifyio update

[mergify]

update

✅ Branch has been successfully updated

[go-to-k]

@gasolima Thanks for your approval. Could you please approve again?

[gasolima]

@go-to-k approved, i was testing the new workflow that deploy the integration test 😅 and it worked!

[go-to-k]

@Mergifyio update

[mergify]

update

✅ Branch has been successfully updated

[go-to-k]

@gasolima Could you please merge?

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[mergify]

Merge Queue Status

✅ The pull request has been merged at 9d2091d

This pull request spent 40 minutes 35 seconds in the queue, including 40 minutes 24 seconds running CI.
The checks were run in-place.

Required conditions to merge

• #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • fix(elasticache): security group for ServerlessCache does not use default endpoint port #35738
• #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • fix(elasticache): security group for ServerlessCache does not use default endpoint port #35738
• any of [🛡 GitHub branch protection]:
  • check-success = validate-pr
  • check-neutral = validate-pr
  • check-skipped = validate-pr
• any of [🛡 GitHub branch protection]:
  • check-success = build
  • check-neutral = build
  • check-skipped = build

[mergify]

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.