{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/1313","labels_url":"https://api.github.com/repos/hashicorp/terraform/issues/1313/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/terraform/issues/1313/comments","events_url":"https://api.github.com/repos/hashicorp/terraform/issues/1313/events","html_url":"https://github.com/hashicorp/terraform/issues/1313","id":64572756,"number":1313,"title":"Security Groups do not allow ICMP","user":{"login":"wazoo","id":216878,"avatar_url":"https://avatars.githubusercontent.com/u/216878?v=3","gravatar_id":"","url":"https://api.github.com/users/wazoo","html_url":"https://github.com/wazoo","followers_url":"https://api.github.com/users/wazoo/followers","following_url":"https://api.github.com/users/wazoo/following{/other_user}","gists_url":"https://api.github.com/users/wazoo/gists{/gist_id}","starred_url":"https://api.github.com/users/wazoo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wazoo/subscriptions","organizations_url":"https://api.github.com/users/wazoo/orgs","repos_url":"https://api.github.com/users/wazoo/repos","events_url":"https://api.github.com/users/wazoo/events{/privacy}","received_events_url":"https://api.github.com/users/wazoo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hashicorp/terraform/labels/enhancement","name":"enhancement","color":"d4c5f9"},{"url":"https://api.github.com/repos/hashicorp/terraform/labels/provider/aws","name":"provider/aws","color":"bfdadc"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-03-26T16:26:01Z","updated_at":"2015-06-01T16:20:28Z","closed_at":null,"body":"I was trying to create a security group with the following configuration:\r\n\r\n```\r\ningress {\r\n  protocol = \"icmp\"\r\n  security_groups = [\"${aws_security_group.sgr_test_nodes.id}\"]\r\n}\r\n```\r\nand I get the following error:\r\n```\r\nErrors:\r\n\r\n  * 'aws_security_group.sgr_test_nodes' error: ingress.2.from_port: required field is not set\r\n  * 'aws_security_group.sgr_test_nodes' error: ingress.2.to_port: required field is not set\r\n```\r\nWhile I understand why this error is happening, ICMP doesn't really have a port and if you try to specify one you get this error from amazon:\r\n\r\n```\r\nError applying plan:\r\n\r\n1 error(s) occurred:\r\n\r\n* Error revoking security group ingress rules: ICMP code (65535) out of range (InvalidParameterValue)\r\n```\r\nIs there a specific way to configure ICMP?  From looking at [resource_aws_security_group.go](https://github.com/hashicorp/terraform/blob/master/builtin/providers/aws/resource_aws_security_group.go) it didn't look that way so this may be a feature request, maybe a rule type or something so that way we could accomplish the ability to do \"all tcp\" or whatever without having to specify ports."},"comment":{"url":"https://api.github.com/repos/hashicorp/terraform/issues/comments/107619807","html_url":"https://github.com/hashicorp/terraform/issues/1313#issuecomment-107619807","issue_url":"https://api.github.com/repos/hashicorp/terraform/issues/1313","id":107619807,"user":{"login":"ltcdnunez","id":742870,"avatar_url":"https://avatars.githubusercontent.com/u/742870?v=3","gravatar_id":"","url":"https://api.github.com/users/ltcdnunez","html_url":"https://github.com/ltcdnunez","followers_url":"https://api.github.com/users/ltcdnunez/followers","following_url":"https://api.github.com/users/ltcdnunez/following{/other_user}","gists_url":"https://api.github.com/users/ltcdnunez/gists{/gist_id}","starred_url":"https://api.github.com/users/ltcdnunez/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ltcdnunez/subscriptions","organizations_url":"https://api.github.com/users/ltcdnunez/orgs","repos_url":"https://api.github.com/users/ltcdnunez/repos","events_url":"https://api.github.com/users/ltcdnunez/events{/privacy}","received_events_url":"https://api.github.com/users/ltcdnunez/received_events","type":"User","site_admin":false},"created_at":"2015-06-01T16:20:28Z","updated_at":"2015-06-01T16:20:28Z","body":"I think I just sorted this out. As it happens, Amazon uses the same interface for CloudFormation and there is some documentation on how to use ICMP. The `from_port` is the ICMP type number and the `to_port` is the ICMP code (which does not exist for may types and should be either 0 or -1 in that case). See the [Amazon CloudFormation Documentation](http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ec2-security-group-ingress.html) for details. And here are the [ICMP types/codes](http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml).\r\n\r\nHere's an example of how to allow inbound echo requests:\r\n\r\n```\r\ningress {\r\n  protocol = 200\r\n  cidr_block = \"10.0.1.0/24\"\r\n  protocol = \"icmp\"\r\n  from_port = 8\r\n  to_port = 0\r\n}\r\n```"}}