How to Resolve AWS CDK and Pulumi Security Group Conflicts

Select Language:

If you’re working with resources that were originally created using Pulumi and now want to manage new resources with AWS CDK, you might encounter some challenges, especially related to resource management and updates.

First, it’s important to understand that Pulumi and CDK independently manage cloud resource configurations. When both tools are used on the same resources, they can sometimes conflict because each tool believes it has control over certain aspects of the infrastructure. This can lead to situations where one tool overwrites or removes changes made by the other.

In your case, you noticed that deploying your CDK stack creates or updates resources like security groups, but it also removes the outbound rules set on a security group created by Pulumi. This is because CDK’s deployment process tends to replace or modify resource configurations to match your current code, which can unintentionally overwrite existing settings.

To avoid these kinds of conflicts, here are some tips:

Separate Resource Management: Try to have one tool manage a particular resource at a time. If Pulumi created the load balancer’s security group with specific outbound rules, consider managing those rules directly in Pulumi, not in CDK.
Import Existing Resources: When creating new CDK resources that need to reference existing resources (like the security group from Pulumi), import those resources into your CDK app. This way, CDK will recognize that they already exist and won’t try to overwrite them. Use the from_lookup or from_security_group_id methods in CDK to import existing security groups.
Careful Configuration: When defining security groups and rules in CDK, avoid policies that could replace existing rules unless necessary. If certain outbound rules are critical, manage them outside of CDK or import them as existing resources.
Document and Coordinate: Keep track of which tool manages which resource. Clear documentation helps prevent accidental overwrites.
Test Changes: Before deploying significant updates, test in a staging environment to see how changes might impact existing resources.

In summary, yes, resources managed by Pulumi and CDK can conflict if not carefully coordinated. The best practice is to import existing resources into CDK rather than recreating or modifying them directly, and to keep resource management consistent within one tool whenever possible. This approach will help prevent unintended deletions or modifications of resource rules and ensure your infrastructure remains stable and predictable.