ec2: CloudFormation-Validate::W3687 false positive for ICMPv6 in security group rule

[Tietew]

Describe the bug

CloudFormation-Validate::W3687 is reported when ec2.Port.allIcmpV6() is used in EC2 security group rules.

declare const securityGroup: ec2.SecurityGroup;
securityGroup.addIngressRule(ec2.Peer.anyIpv6(), ec2.Port.allIcmpV6());

WARNING FromPort: ['FromPort', 'ToPort'] are ignored when using 'IpProtocol' value 'icmpv6' (CloudFormation Validate)
... aws-cdk-lib.aws_ec2.CfnSecurityGroupIngress
Acknowledge with 'CloudFormation-Validate::W3687'

-1 should be allowed at FromPort and ToPort for ICMPv6.

https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-ec2-securitygroupingress.html#cfn-ec2-securitygroupingress-fromport

A value of -1 indicates all ICMP/ICMPv6 types.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

No warnings are reported.

Current Behavior

See description above.

Reproduction Steps

See description above.

Possible Solution

No response

Additional Information/Context

We can safely acknowledge this warning.

AWS CDK Library version (aws-cdk-lib)

2.262.1

AWS CDK CLI version

2.1133.0 (build 712d792)

Node.js Version

v24.18.0

OS

Linux

Language

TypeScript

Language Version

No response

Other information

No response

[pahud]

Hi @Tietew

This is a good catch — I was able to reproduce it locally on aws-cdk-lib@2.262.1 with your exact snippet: synth emits the W3687 warning against the template output {"IpProtocol": "icmpv6", "FromPort": -1, "ToPort": -1}, which is exactly what Port.allIcmpV6() is designed to render. As you noted, the CloudFormation docs are explicit that -1 means all ICMP/ICMPv6 types, so the rule's claim that the ports are "ignored" is incorrect for icmp/icmpv6 — those fields carry the ICMP type/code.

Good news: the root-cause fix has already been merged upstream in cfn-lint#4600, which adds the icmpv6 protocol variants to W3687's exclusion allowlist. It isn't in a cfn-lint release yet, and it then needs to flow through the bundled validation engine into aws-cdk-lib, so it will take a couple of releases to reach cdk synth.

Until that lands, acknowledging with CloudFormation-Validate::W3687 (as you're already doing) is safe here.

[pahud]

I am closing this issue as the fix is merged from the upstream and should land very soon. Feel free to reopen if there's any concern.

[github-actions]

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.