[EC2 driver] Only open SSH, docker and swarm ports on the first security group

[gilbsgilbs]

Hi,

PR #3111 enabled the EC2 driver to handle setting multiple security groups on EC2 instances. Yet, this also opens SSH, docker and swarm ports for each security group set using --amazonec2-security-group flag which (I think) is useless and unexpected. Setting the rule on one security group only would be sufficient, proper and safer.

This PR opens the required ports on the first security group provided only. Therefore, this makes the CLI options order-sensitive (I don't know if it is already). Maybe that's not what is expected either.
If this is problematic, another solution I could implement could be to set the main security group using the --amazonec2-security-group docker-sg flag and set extra security groups using some kind of --amazonec2-extra-security-group some-extra-sg flag. This would mean that only one --amazonec2-security-group flag could be accepted, but multiple --amazonec2-extra-security-group flags could be provided (with no order consideration).
Another (less intrusive) solution that would address my issue as a side-effect would be to add a flag that would make the driver trust the security groups provided and not try to update them. You'd have to pre-configure them using the AWS CLI.

Please, let me know what is acceptable to you, and tell me where and how I can document this if ever it's needed.

Thank you.

[nathanleclaire]

Cool, thanks for the PR. Might take a minute to review properly.

Another (less intrusive) solution that would address my issue as a side-effect would be to add a flag that would make the driver trust the security groups provided and not try to update them. You'd have to pre-configure them using the AWS CLI.

Yeah, that was somewhat the original intention, that if you skip the default security group, you'd be responsible for opening those yourself, but it was somewhat confusing to users.

[gilbsgilbs]

Do you want me to open an issue so that we can discuss on this ? Let me know what I should do.

[gilbsgilbs]

Bump. Any update on this?

[gilbsgilbs]

Any news on this? Thanks!