SecurityGroup userIdGroupPairs groupRef does not use the referenced id

[kejne]

Describe the bug

Checked out the fairly new issue #2058 that was closed and followed that information (the information on https://aws-controllers-k8s.github.io/community/reference/ec2/v1alpha1/securitygroup/ seems to be outdated - so something seems to not work with the publishing)

Tried it out, but it seems like it is not able to translate into the groupID when using the AWS API.

The resulting crd when applying the changes:

apiVersion: ec2.services.k8s.aws/v1alpha1
kind: SecurityGroup
metadata:
...
spec:
  ingressRules:
    - fromPort: 443
      ipProtocol: tcp
      toPort: 443
      userIDGroupPairs:
        - groupRef:
            from:
              name: sgName
          userID: 'account'
  name: aSgGroup
  vpcRef:
    - from:
        name: ourVpc
status:
  ackResourceMetadata:
    ownerAccountID: 'account'
    region: eu-west-1
  conditions:
    - lastTransitionTime: '2024-06-27T11:13:07Z'
      status: 'True'
      type: ACK.ReferencesResolved
    - message: "VPCIdNotSpecified: No default VPC for this user\n\tstatus code: 400, request id: 089a7ea4-5ff7-4bc1-987f-d73d87f398f1"
      status: 'True'
      type: ACK.Recoverable
    - lastTransitionTime: '2024-06-27T11:13:08Z'
      message: >-
        Unable to determine if desired resource state matches latest observed
        state
      reason: "VPCIdNotSpecified: No default VPC for this user\n\tstatus code: 400, request id: 089a7ea4-5ff7-4bc1-987f-d73d87f398f1"
      status: Unknown
      type: ACK.ResourceSynced
  id: theSgGroupId

Cloudtrail excerpt:

 "requestParameters": {
        "groupId": "sg-0b059064b8e4e4620",
        "ipPermissions": {
            "items": [
                {
                    "ipProtocol": "tcp",
                    "fromPort": 443,
                    "toPort": 443,
                    "groups": {
                        "items": [
                            {
                                "userId": "account",
                                "groupName": "sgName",
                                "vpcId": "vpc-XXXXXXXXXXX"
                            }
                        ]
                    },
                    "ipRanges": {},
                    "ipv6Ranges": {},
                    "prefixListIds": {}
                }
            ]
        }
    },

Steps to reproduce
Create a securityGroup within a VPC

apiVersion: ec2.services.k8s.aws/v1alpha1
kind: VPC
metadata:
  name: default
spec:
  amazonProvidedIPv6CIDRBlock: false
  cidrBlocks:
    - 10.124.0.0/21
    - 100.64.0.0/16
  enableDNSHostnames: true
  enableDNSSupport: true
  tags:
    - key: Name
      value: default
---
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: SecurityGroup
metadata:
  name: default-cluster
spec:
  description: "Allow traffic to the VPC endpoint from the VPC" 
  name: default-cluster
  vpcRef:
     from:
       name: default
  egressRules:
    - ipProtocol: "-1"
      fromPort: 0
      toPort: 65535
      ipRanges:
      - cidrIP: "0.0.0.0/0"
        description: Internet
  ingressRules:
    - ipProtocol: "-1"
      fromPort: 0
      toPort: 65535
      ipRanges:
        - cidrIP: 10.124.0.0/21
          description: default CIDR
---
apiVersion: ec2.services.k8s.aws/v1alpha1
kind: SecurityGroup
metadata:
  name: default-cluster-additional
spec:
  name: default-cluster-additional
  vpcID: vpc-02f8b2038f5d17119
  ingressRules:
    - ipProtocol: "tcp"
      fromPort: 443
      toPort: 443
      userIDGroupPairs:
        - groupRef: 
            from:
              name: default-cluster
          vpcRef:
            from:
              name: default
          userID: "default"

Expected outcome
The AWS API is called using the security group id rather than the name.
The request towards AWS should be similar to:

 "requestParameters": {
        "groupId": "sg-0b059064b8e4e4620",
        "ipPermissions": {
            "items": [
                {
                    "ipProtocol": "tcp",
                    "fromPort": 443,
                    "toPort": 443,
                    "groups": {
                        "items": [
                            {
                                "userId": "account",
# This should contain "groupId": "sgXXXXXXXX"
                                "vpcId": "vpc-XXXXXXXXXXXXX"
                            }
                        ]
                    },
                    "ipRanges": {},
                    "ipv6Ranges": {},
                    "prefixListIds": {}
                }
            ]
        }
    },

Environment

• Kubernetes version 1.30
• Using eks.2
• EC2 - SecurityGroup
• Provider version 1.2.12

[kejne]

Provided a PR which should give the proper behavior

[kejne]

Confirmed to work after fix!