lib/sync_security_group_rules.js
// some permissions to authorize and some to revoke.
some permissions to authorize and some to revoke.
some permissions to authorize and some to revoke .
function _diffIpPermission(srcIpPermission, dstIpPermission, classicToVpcGroupIdMap, vpcToClassicGroupIdMap, pair) {
    var authorize = _copyToBlankPermission(srcIpPermission);
    var revoke = _copyToBlankPermission(dstIpPermission);
    srcCidrMap = Map.fromSecurityGroupRuleValues(srcIpPermission.IpRanges);
    dstCidrMap = Map.fromSecurityGroupRuleValues(dstIpPermission.IpRanges);
    authorize.IpRanges = srcCidrMap.minusValues(dstCidrMap);
    revoke.IpRanges = dstCidrMap.minusValues(srcCidrMap);
     For references to EC2-Classic Security Groups that are not
     managed by ClassicLink Mirror (i.e. not in classicToVpcGroupIdMap),
     ignore them, because they don't correspond to anything in the VPC.
     For references to VPC Security Groups that are not managed by
     ClassicLink Mirror (i.e., not in vpcToClasssicGroupIdMap), ignore
     them.
     That means that if we find such a reference in the VPC Security
     Group, we don't clean it up.  This is to allow scenarios such as
     allowing a new VPC Elastic Load Balancer Security Group in the VPC,
     where the Classic equivalent (the amazon-elb-sg group) is not
     managed by ClassicLink.
    var srcGroupMap = Map.fromSecurityGroupRuleValues(srcIpPermission.UserIdGroupPairs.map(function(groupPair) {
        return {
            UserId: groupPair.UserId,
            GroupId: classicToVpcGroupIdMap[groupPair.GroupId]
        };
    }).filter(function(groupPair) {
        return groupPair.GroupId;
    }));
    var dstGroupMap = Map.fromSecurityGroupRuleValues(dstIpPermission.UserIdGroupPairs.filter(function(groupPair) {
        return vpcToClassicGroupIdMap[groupPair.GroupId];
    }));
    authorize.UserIdGroupPairs = srcGroupMap.minusValues(dstGroupMap);
    revoke.UserIdGroupPairs = dstGroupMap.minusValues(srcGroupMap);
    if ((authorize.IpRanges.length > 0) || (authorize.UserIdGroupPairs.length > 0)) {
        pair.toAuthorize.push(authorize);
        console.log('SyncSecurityGroupRules: ' + pair.classicSecurityGroup.GroupId + '-->' + pair.vpcSecurityGroup.GroupId + ': AUTHORIZE ' + JSON.stringify(authorize));
    }
    if ((revoke.IpRanges.length > 0) || (revoke.UserIdGroupPairs.length > 0)) {
        pair.toRevoke.push(revoke);
        console.log('SyncSecurityGroupRules: ' + pair.classicSecurityGroup.GroupId + '-->' + pair.vpcSecurityGroup.GroupId + ': REVOKE ' + JSON.stringify(revoke));
    }
}
function _diffIpPermission ( srcIpPermission , dstIpPermission , classicToVpcGroupIdMap , vpcToClassicGroupIdMap , pair ) { var authorize = _copyToBlankPermission ( srcIpPermission ) ; var revoke = _copyToBlankPermission ( dstIpPermission ) ; srcCidrMap = Map . fromSecurityGroupRuleValues ( srcIpPermission . IpRanges ) ; dstCidrMap = Map . fromSecurityGroupRuleValues ( dstIpPermission . IpRanges ) ; authorize . IpRanges = srcCidrMap . minusValues ( dstCidrMap ) ; revoke . IpRanges = dstCidrMap . minusValues ( srcCidrMap ) ; var srcGroupMap = Map . fromSecurityGroupRuleValues ( srcIpPermission . UserIdGroupPairs . map ( function ( groupPair ) { return { UserId : groupPair . UserId , GroupId : classicToVpcGroupIdMap [ groupPair . GroupId ] } ; } ) . filter ( function ( groupPair ) { return groupPair . GroupId ; } ) ) ; var dstGroupMap = Map . fromSecurityGroupRuleValues ( dstIpPermission . UserIdGroupPairs . filter ( function ( groupPair ) { return vpcToClassicGroupIdMap [ groupPair . GroupId ] ; } ) ) ; authorize . UserIdGroupPairs = srcGroupMap . minusValues ( dstGroupMap ) ; revoke . UserIdGroupPairs = dstGroupMap . minusValues ( srcGroupMap ) ; if ( ( authorize . IpRanges . length > 0 ) || ( authorize . UserIdGroupPairs . length > 0 ) ) { pair . toAuthorize . push ( authorize ) ; console . log ( 'SyncSecurityGroupRules: ' + pair . classicSecurityGroup . GroupId + '-->' + pair . vpcSecurityGroup . GroupId + ': AUTHORIZE ' + JSON . stringify ( authorize ) ) ; } if ( ( revoke . IpRanges . length > 0 ) || ( revoke . UserIdGroupPairs . length > 0 ) ) { pair . toRevoke . push ( revoke ) ; console . log ( 'SyncSecurityGroupRules: ' + pair . classicSecurityGroup . GroupId + '-->' + pair . vpcSecurityGroup . GroupId + ': REVOKE ' + JSON . stringify ( revoke ) ) ; } }
some permissions to authorize and some to revoke.
some permissions to authorize and some to revoke .
// If it's in the source (Classic) rules but not the destination // (VPC), we will authorize it. // If it's in the destination (VPC) rules but not the source // (Classic), we will revoke it. // UserIdGroupPairs: Sort on GroupId.  The EC2-Classic Security // Groups first need to be mapped to their VPC counterparts, when // they exist. // // For references to EC2-Classic Security Groups that are not // managed by ClassicLink Mirror (i.e. not in classicToVpcGroupIdMap), // ignore them, because they don't correspond to anything in the VPC. // // For references to VPC Security Groups that are not managed by // ClassicLink Mirror (i.e., not in vpcToClasssicGroupIdMap), ignore // them. // That means that if we find such a reference in the VPC Security // Group, we don't clean it up.  This is to allow scenarios such as // allowing a new VPC Elastic Load Balancer Security Group in the VPC, // where the Classic equivalent (the amazon-elb-sg group) is not // managed by ClassicLink. // If it's in the source (Classic) rules but not the destination // (VPC), we will authorize it. // If it's in the destination (VPC) rules but not the source // (Classic), we will revoke it.