cloud template_error ai_generated true

Circular dependency between resources: [SecurityGroup, LaunchTemplate, SecurityGroup]

ID: cloud/aws-cloudformation-circular-dependency

Also available as: JSON · Markdown
85%Fix Rate
88%Confidence
3Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

CloudFormation circular dependencies often arise from security groups referencing each other, or EC2 instances referencing their own security group. The error message lists the cycle but the fix requires restructuring.

generic

Workarounds

  1. 95% success Use SecurityGroupIngress/Egress as separate resources to break SG cycles 
    Instead of inline ingress in SG, create separate AWS::EC2::SecurityGroupIngress resource referencing both SGs
  2. 82% success Split the stack into nested stacks with cross-stack references 
    Create SGs in one stack, reference them via Fn::ImportValue in another stack
  3. 88% success Use Fn::GetAtt and separate the creation from the rule attachment 
    Create SGs with no rules -> Create rules as separate resources referencing SG IDs

Dead Ends

Common approaches that don't work:

  1. Add explicit DependsOn to break the cycle 88% fail

    DependsOn only adds dependencies, never removes them. Adding more DependsOn to a cycle makes it worse.

  2. Merge the circular resources into one resource 72% fail

    Merging security groups loses fine-grained access control and makes the template harder to maintain.