Repository: klothoplatform/klotho
Pull request #871 (2024-01-12 22:00:54)

Vis ignore descendants
## Before
![image](https://github.com/klothoplatform/klotho/assets/90645437/9721fc1e-5a77-42c6-92df-ff174fef137c)

## After
![image](https://github.com/klothoplatform/klotho/assets/90645437/1dfef7a9-ba1a-4fce-baa2-ea4f0144fce7)



Patch:
diff --git a/pkg/engine2/visualizer.go b/pkg/engine2/visualizer.go
index 0f6cdf18..990f56c9 100644
--- a/pkg/engine2/visualizer.go
+++ b/pkg/engine2/visualizer.go
@@ -139,17 +139,8 @@ func (e *Engine) makeEdges(
 	view View,
 	viewDag visualizer.VisGraph,
 	id construct.ResourceId,
-) (err error) {
-	ancestors := make(set.Set[construct.ResourceId])
-	for ancestor := id; !ancestor.IsZero() && err == nil; {
-		ancestors.Add(ancestor)
-
-		var ancestorVert *visualizer.VisResource
-		ancestorVert, err = viewDag.Vertex(ancestor)
-		if ancestorVert != nil {
-			ancestor = ancestorVert.Parent
-		}
-	}
+) error {
+	ancestors, err := visualizer.VertexAncestors(viewDag, id)
 	if err != nil {
 		return err
 	}
@@ -165,6 +156,15 @@ func (e *Engine) makeEdges(
 			// Don't draw edges from a node to its ancestors, since it already lives inside of them
 			continue
 		}
+		targetAncestors, err := visualizer.VertexAncestors(viewDag, target)
+		if err != nil {
+			errs = errors.Join(errs, err)
+			continue
+		}
+		if targetAncestors.Contains(id) {
+			// Don't draw edges from a node to its descendants
+			continue
+		}
 
 		_, targetErr := viewDag.Vertex(target)
 		if errors.Is(targetErr, graph.ErrVertexNotFound) {
diff --git a/pkg/visualizer2/vis_graph.go b/pkg/visualizer2/vis_graph.go
index c4abe6eb..4f66e4d3 100644
--- a/pkg/visualizer2/vis_graph.go
+++ b/pkg/visualizer2/vis_graph.go
@@ -68,3 +68,18 @@ func (d VisEdgeData) MarshalYAML() (interface{}, error) {
 		"path": res,
 	}, nil
 }
+
+func VertexAncestors(g VisGraph, id construct.ResourceId) (set.Set[construct.ResourceId], error) {
+	ancestors := make(set.Set[construct.ResourceId])
+	var err error
+	for ancestor := id; !ancestor.IsZero() && err == nil; {
+		ancestors.Add(ancestor)
+
+		var ancestorVert *VisResource
+		ancestorVert, err = g.Vertex(ancestor)
+		if ancestorVert != nil {
+			ancestor = ancestorVert.Parent
+		}
+	}
+	return ancestors, err
+}


Test patch:
diff --git a/pkg/engine2/testdata/2_routes.dataflow-viz.yaml b/pkg/engine2/testdata/2_routes.dataflow-viz.yaml
index 60abd522..c36389dc 100755
--- a/pkg/engine2/testdata/2_routes.dataflow-viz.yaml
+++ b/pkg/engine2/testdata/2_routes.dataflow-viz.yaml
@@ -1,12 +1,5 @@
 provider: aws
 resources:
-  lambda_function/lambda_function_0:
-    children:
-        - aws:ecr_image:lambda_function_0-image
-        - aws:ecr_repo:ecr_repo-0
-        - aws:iam_role:lambda_function_0-ExecutionRole
-    tag: big
-
   lambda_function/lambda_function_1:
     children:
         - aws:ecr_image:lambda_function_1-image
@@ -14,22 +7,13 @@ resources:
         - aws:iam_role:lambda_function_1-ExecutionRole
     tag: big
 
-  aws:api_integration:rest_api_1/integ0:
-    parent: rest_api/rest_api_1
-    tag: big
-
-  aws:api_integration:rest_api_1/integ0 -> lambda_function/lambda_function_0:
-    path:
-        - aws:lambda_permission:integ0-lambda_function_0
-
-  aws:api_integration:rest_api_1/integ1:
-    parent: rest_api/rest_api_1
+  lambda_function/lambda_function_0:
+    children:
+        - aws:ecr_image:lambda_function_0-image
+        - aws:ecr_repo:ecr_repo-0
+        - aws:iam_role:lambda_function_0-ExecutionRole
     tag: big
 
-  aws:api_integration:rest_api_1/integ1 -> lambda_function/lambda_function_1:
-    path:
-        - aws:lambda_permission:integ1-lambda_function_1
-
   rest_api/rest_api_1:
     children:
         - aws:api_deployment:rest_api_1:api_deployment-0
@@ -44,15 +28,19 @@ resources:
         - aws:api_stage:rest_api_1:api_stage-0
     tag: parent
 
-  rest_api/rest_api_1 -> aws:api_integration:rest_api_1/integ0:
+  aws:api_integration:rest_api_1/integ1:
+    parent: rest_api/rest_api_1
+    tag: big
+
+  aws:api_integration:rest_api_1/integ1 -> lambda_function/lambda_function_1:
     path:
-        - aws:api_method:rest_api_1:integ0-api_method
-        - aws:api_resource:rest_api_1:api_resource-0
-        - aws:api_resource:rest_api_1:lambda0
+        - aws:lambda_permission:integ1-lambda_function_1
+
+  aws:api_integration:rest_api_1/integ0:
+    parent: rest_api/rest_api_1
+    tag: big
 
-  rest_api/rest_api_1 -> aws:api_integration:rest_api_1/integ1:
+  aws:api_integration:rest_api_1/integ0 -> lambda_function/lambda_function_0:
     path:
-        - aws:api_method:rest_api_1:integ1-api_method
-        - aws:api_resource:rest_api_1:api_resource-1
-        - aws:api_resource:rest_api_1:lambda1
+        - aws:lambda_permission:integ0-lambda_function_0
 
diff --git a/pkg/engine2/testdata/cf_distribution.expect.yaml b/pkg/engine2/testdata/cf_distribution.expect.yaml
index 5dcba5de..ce720395 100755
--- a/pkg/engine2/testdata/cf_distribution.expect.yaml
+++ b/pkg/engine2/testdata/cf_distribution.expect.yaml
@@ -24,10 +24,6 @@ resources:
             ViewerProtocolPolicy: allow-all
         Enabled: true
         Origins:
-            - DomainName: aws:s3_bucket:s3-bucket-3#BucketRegionalDomainName
-              OriginId: s3-bucket-3
-              S3OriginConfig:
-                OriginAccessIdentity: aws:cloudfront_origin_access_identity:cloudfront_origin_access_identity-0#CloudfrontAccessIdentityPath
             - CustomOriginConfig:
                 HttpPort: 80
                 HttpsPort: 443
@@ -40,6 +36,10 @@ resources:
               DomainName: aws:api_stage:rest_api_1:cloudfront_distribution_2-rest_api_1#StageInvokeUrl
               OriginId: cloudfront_distribution_2-rest_api_1
               OriginPath: /stage
+            - DomainName: aws:s3_bucket:s3-bucket-3#BucketRegionalDomainName
+              OriginId: s3-bucket-3
+              S3OriginConfig:
+                OriginAccessIdentity: aws:cloudfront_origin_access_identity:cloudfront_origin_access_identity-0#CloudfrontAccessIdentityPath
         Restrictions:
             GeoRestriction:
                 RestrictionType: none
diff --git a/pkg/engine2/testdata/delete_resource_and_iacdeps.dataflow-viz.yaml b/pkg/engine2/testdata/delete_resource_and_iacdeps.dataflow-viz.yaml
index 731a2dbf..c3a3924f 100644
--- a/pkg/engine2/testdata/delete_resource_and_iacdeps.dataflow-viz.yaml
+++ b/pkg/engine2/testdata/delete_resource_and_iacdeps.dataflow-viz.yaml
@@ -1,9 +1,5 @@
 provider: aws
 resources:
-  aws:api_integration:rest_api_0/rest_api_0_integration_0:
-    parent: rest_api/rest_api_0
-    tag: big
-
   rest_api/rest_api_0:
     children:
         - aws:api_deployment:rest_api_0:api_deployment-0
@@ -13,8 +9,7 @@ resources:
         - aws:api_stage:rest_api_0:api_stage-0
     tag: parent
 
-  rest_api/rest_api_0 -> aws:api_integration:rest_api_0/rest_api_0_integration_0:
-    path:
-        - aws:api_method:rest_api_0:rest_api_0_integration_0_method
-        - aws:api_resource:rest_api_0:api_resource-0
+  aws:api_integration:rest_api_0/rest_api_0_integration_0:
+    parent: rest_api/rest_api_0
+    tag: big
 
diff --git a/pkg/engine2/testdata/ecs_rds.expect.yaml b/pkg/engine2/testdata/ecs_rds.expect.yaml
index 7a20d6dc..674b9038 100755
--- a/pkg/engine2/testdata/ecs_rds.expect.yaml
+++ b/pkg/engine2/testdata/ecs_rds.expect.yaml
@@ -169,11 +169,6 @@ resources:
               Protocol: "-1"
               ToPort: 0
         IngressRules:
-            - Description: Allow ingress traffic from within the same security group
-              FromPort: 0
-              Protocol: "-1"
-              Self: true
-              ToPort: 0
             - CidrBlocks:
                 - 10.0.128.0/18
               Description: Allow ingress traffic from ip addresses within the subnet subnet-0
@@ -186,6 +181,11 @@ resources:
               FromPort: 0
               Protocol: "-1"
               ToPort: 0
+            - Description: Allow ingress traffic from within the same security group
+              FromPort: 0
+              Protocol: "-1"
+              Self: true
+              ToPort: 0
         Vpc: aws:vpc:vpc-0
     aws:route_table:vpc-0:subnet-0-route_table:
         Routes:
diff --git a/pkg/engine2/testdata/extend_graph.dataflow-viz.yaml b/pkg/engine2/testdata/extend_graph.dataflow-viz.yaml
index a93075e5..a43ab65d 100755
--- a/pkg/engine2/testdata/extend_graph.dataflow-viz.yaml
+++ b/pkg/engine2/testdata/extend_graph.dataflow-viz.yaml
@@ -7,14 +7,6 @@ resources:
         - aws:iam_role:lambda_function_0-ExecutionRole
     tag: big
 
-  aws:api_integration:rest_api_1/rest_api_1_integration_0:
-    parent: rest_api/rest_api_1
-    tag: big
-
-  aws:api_integration:rest_api_1/rest_api_1_integration_0 -> lambda_function/lambda_function_0:
-    path:
-        - aws:lambda_permission:rest_api_1_integration_0_lambda_function_0
-
   rest_api/rest_api_1:
     children:
         - aws:api_deployment:rest_api_1:api_deployment-0
@@ -24,11 +16,14 @@ resources:
         - aws:api_stage:rest_api_1:api_stage-0
     tag: parent
 
-  rest_api/rest_api_1 -> aws:api_integration:rest_api_1/rest_api_1_integration_0:
-    path:
-        - aws:api_method:rest_api_1:rest_api_1_integration_0_method
-        - aws:api_resource:rest_api_1:api_resource-0
-
   dynamodb_table/dynamodb_table_3:
     tag: big
 
+  aws:api_integration:rest_api_1/rest_api_1_integration_0:
+    parent: rest_api/rest_api_1
+    tag: big
+
+  aws:api_integration:rest_api_1/rest_api_1_integration_0 -> lambda_function/lambda_function_0:
+    path:
+        - aws:lambda_permission:rest_api_1_integration_0_lambda_function_0
+
diff --git a/pkg/engine2/testdata/k8s_api.dataflow-viz.yaml b/pkg/engine2/testdata/k8s_api.dataflow-viz.yaml
index ace9d8af..9cfab9ef 100755
--- a/pkg/engine2/testdata/k8s_api.dataflow-viz.yaml
+++ b/pkg/engine2/testdata/k8s_api.dataflow-viz.yaml
@@ -2,82 +2,77 @@ provider: aws
 resources:
   kubernetes:pod:eks_cluster-0/pod2:
     children:
-      - aws:iam_role:ClusterRole-eks_cluster-0
+        - aws:iam_role:ClusterRole-eks_cluster-0
     parent: eks_cluster/eks_cluster-0
     tag: big
 
   load_balancer/rest-api-4-integbcc77100:
     children:
-      - aws:load_balancer_listener:rest-api-4-integbcc77100:rest_api_4_integration_0-pod2
+        - aws:load_balancer_listener:rest-api-4-integbcc77100:rest_api_4_integration_0-pod2
     parent: vpc/vpc-0
     tag: parent
 
   load_balancer/rest-api-4-integbcc77100 -> kubernetes:pod:eks_cluster-0/pod2:
     path:
-      - aws:load_balancer_listener:rest-api-4-integbcc77100:rest_api_4_integration_0-pod2
-      - aws:security_group:vpc-0:eks_cluster-0-security_group
-      - aws:target_group:rest-api-4-integbcc77100
-      - kubernetes:service:eks_cluster-0:restapi4integration0-pod2
-      - kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2
-
-  aws:api_integration:rest_api_4/rest_api_4_integration_0:
-    parent: rest_api/rest_api_4
-    tag: big
-
-  aws:api_integration:rest_api_4/rest_api_4_integration_0 -> load_balancer/rest-api-4-integbcc77100:
-    path:
-      - aws:vpc_link:rest_api_4_integration_0-pod2
+        - aws:load_balancer_listener:rest-api-4-integbcc77100:rest_api_4_integration_0-pod2
+        - aws:security_group:vpc-0:eks_cluster-0-security_group
+        - aws:target_group:rest-api-4-integbcc77100
+        - kubernetes:service:eks_cluster-0:restapi4integration0-pod2
+        - kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2
 
   kubernetes:helm_chart:eks_cluster-0/metricsserver:
     children:
-      - aws:iam_role:ClusterRole-eks_cluster-0
+        - aws:iam_role:ClusterRole-eks_cluster-0
     parent: eks_cluster/eks_cluster-0
     tag: big
 
   kubernetes:helm_chart:eks_cluster-0/aws-load-balancer-controller:
     children:
-      - aws:iam_role:ClusterRole-eks_cluster-0
+        - aws:iam_role:ClusterRole-eks_cluster-0
     parent: eks_cluster/eks_cluster-0
     tag: big
 
   vpc/vpc-0:
     children:
-      - aws:internet_gateway:vpc-0:internet_gateway-0
-      - aws:route_table:vpc-0:subnet-0-route_table
-      - aws:route_table:vpc-0:subnet-1-route_table
-      - aws:route_table:vpc-0:subnet-2-route_table
-      - aws:route_table:vpc-0:subnet-3-route_table
-      - aws:security_group:vpc-0:eks_cluster-0-security_group
-      - aws:subnet:vpc-0:subnet-0
-      - aws:subnet:vpc-0:subnet-1
-      - aws:subnet:vpc-0:subnet-2
-      - aws:subnet:vpc-0:subnet-3
+        - aws:internet_gateway:vpc-0:internet_gateway-0
+        - aws:route_table:vpc-0:subnet-0-route_table
+        - aws:route_table:vpc-0:subnet-1-route_table
+        - aws:route_table:vpc-0:subnet-2-route_table
+        - aws:route_table:vpc-0:subnet-3-route_table
+        - aws:security_group:vpc-0:eks_cluster-0-security_group
+        - aws:subnet:vpc-0:subnet-0
+        - aws:subnet:vpc-0:subnet-1
+        - aws:subnet:vpc-0:subnet-2
+        - aws:subnet:vpc-0:subnet-3
     tag: parent
 
   rest_api/rest_api_4:
     children:
-      - aws:api_deployment:rest_api_4:api_deployment-0
-      - aws:api_integration:rest_api_4:rest_api_4_integration_0
-      - aws:api_method:rest_api_4:rest_api_4_integration_0_method
-      - aws:api_resource:rest_api_4:api_resource-0
-      - aws:api_stage:rest_api_4:api_stage-0
+        - aws:api_deployment:rest_api_4:api_deployment-0
+        - aws:api_integration:rest_api_4:rest_api_4_integration_0
+        - aws:api_method:rest_api_4:rest_api_4_integration_0_method
+        - aws:api_resource:rest_api_4:api_resource-0
+        - aws:api_stage:rest_api_4:api_stage-0
     tag: parent
 
-  rest_api/rest_api_4 -> aws:api_integration:rest_api_4/rest_api_4_integration_0:
-    path:
-      - aws:api_method:rest_api_4:rest_api_4_integration_0_method
-      - aws:api_resource:rest_api_4:api_resource-0
-
   eks_cluster/eks_cluster-0:
     children:
-      - aws:iam_role:ClusterRole-eks_cluster-0
-      - kubernetes:helm_chart:eks_cluster-0:aws-load-balancer-controller
-      - kubernetes:helm_chart:eks_cluster-0:metricsserver
-      - kubernetes:pod:eks_cluster-0:pod2
-      - kubernetes:service:eks_cluster-0:restapi4integration0-pod2
-      - kubernetes:service_account:eks_cluster-0:aws-load-balancer-controller
-      - kubernetes:service_account:eks_cluster-0:pod2
-      - kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2
+        - aws:iam_role:ClusterRole-eks_cluster-0
+        - kubernetes:helm_chart:eks_cluster-0:aws-load-balancer-controller
+        - kubernetes:helm_chart:eks_cluster-0:metricsserver
+        - kubernetes:pod:eks_cluster-0:pod2
+        - kubernetes:service:eks_cluster-0:restapi4integration0-pod2
+        - kubernetes:service_account:eks_cluster-0:aws-load-balancer-controller
+        - kubernetes:service_account:eks_cluster-0:pod2
+        - kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2
     parent: vpc/vpc-0
     tag: parent
 
+  aws:api_integration:rest_api_4/rest_api_4_integration_0:
+    parent: rest_api/rest_api_4
+    tag: big
+
+  aws:api_integration:rest_api_4/rest_api_4_integration_0 -> load_balancer/rest-api-4-integbcc77100:
+    path:
+        - aws:vpc_link:rest_api_4_integration_0-pod2
+
diff --git a/pkg/engine2/testdata/k8s_api.expect.yaml b/pkg/engine2/testdata/k8s_api.expect.yaml
index dfdbfdde..5e5e0ba3 100755
--- a/pkg/engine2/testdata/k8s_api.expect.yaml
+++ b/pkg/engine2/testdata/k8s_api.expect.yaml
@@ -28,29 +28,29 @@ resources:
         apiVersion: v1
         clusters:
             - cluster:
-                  certificateAuthorityData: aws:eks_cluster:eks_cluster-0#CertificateAuthorityData
-                  server: aws:eks_cluster:eks_cluster-0#ClusterEndpoint
+                certificateAuthorityData: aws:eks_cluster:eks_cluster-0#CertificateAuthorityData
+                server: aws:eks_cluster:eks_cluster-0#ClusterEndpoint
               name: aws:eks_cluster:eks_cluster-0#Name
         contexts:
             - context:
-                  cluster: aws:eks_cluster:eks_cluster-0#Name
-                  user: aws:eks_cluster:eks_cluster-0#Name
+                cluster: aws:eks_cluster:eks_cluster-0#Name
+                user: aws:eks_cluster:eks_cluster-0#Name
               name: aws:eks_cluster:eks_cluster-0#Name
         currentContext: aws:eks_cluster:eks_cluster-0#Name
         kind: Config
         users:
             - name: aws:eks_cluster:eks_cluster-0#Name
               user:
-                  exec:
-                      apiVersion: client.authentication.k8s.io/v1beta1
-                      args:
-                          - eks
-                          - get-token
-                          - --cluster-name
-                          - aws:eks_cluster:eks_cluster-0#Name
-                          - --region
-                          - aws:region:region-0#Name
-                      command: aws
+                exec:
+                    apiVersion: client.authentication.k8s.io/v1beta1
+                    args:
+                        - eks
+                        - get-token
+                        - --cluster-name
+                        - aws:eks_cluster:eks_cluster-0#Name
+                        - --region
+                        - aws:region:region-0#Name
+                    command: aws
     aws:api_deployment:rest_api_4:api_deployment-0:
         RestApi: aws:rest_api:rest_api_4
         Triggers:
@@ -60,15 +60,15 @@ resources:
         AssumeRolePolicyDoc:
             Statement:
                 - Action:
-                      - sts:AssumeRoleWithWebIdentity
+                    - sts:AssumeRoleWithWebIdentity
                   Effect: Allow
                   Principal:
-                      Federated:
-                          - aws:iam_oidc_provider:eks_cluster-0#Arn
+                    Federated:
+                        - aws:iam_oidc_provider:eks_cluster-0#Arn
             Version: "2012-10-17"
         ManagedPolicies:
-            - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
             - arn:aws:iam::aws:policy/AWSXrayWriteOnlyAccess
+            - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
     aws:rest_api:rest_api_4:
         BinaryMediaTypes:
             - application/octet-stream
@@ -205,20 +205,20 @@ resources:
                     - image: aws:ecr_image:pod2-ecr_image#ImageName
                       name: pod2
                       ports:
-                          - containerPort: 80
-                            hostPort: 80
-                            name: default-tcp
-                            protocol: TCP
+                        - containerPort: 80
+                          hostPort: 80
+                          name: default-tcp
+                          protocol: TCP
                 serviceAccountName: kubernetes:service_account:eks_cluster-0:pod2
     aws:iam_role:aws-load-balancer-controller:
         AssumeRolePolicyDoc:
             Statement:
                 - Action:
-                      - sts:AssumeRoleWithWebIdentity
+                    - sts:AssumeRoleWithWebIdentity
                   Effect: Allow
                   Principal:
-                      Federated:
-                          - aws:iam_oidc_provider:eks_cluster-0#Arn
+                    Federated:
+                        - aws:iam_oidc_provider:eks_cluster-0#Arn
             Version: "2012-10-17"
     aws:ecr_image:pod2-ecr_image:
         Context: .
@@ -260,174 +260,174 @@ resources:
         AssumeRolePolicyDoc:
             Statement:
                 - Action:
-                      - sts:AssumeRole
+                    - sts:AssumeRole
                   Effect: Allow
                   Principal:
-                      Service:
-                          - ec2.amazonaws.com
+                    Service:
+                        - ec2.amazonaws.com
             Version: "2012-10-17"
         ManagedPolicies:
-            - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
-            - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
             - arn:aws:iam::aws:policy/AmazonEKSWorkerNodePolicy
             - arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryReadOnly
             - arn:aws:iam::aws:policy/AmazonEKS_CNI_Policy
             - arn:aws:iam::aws:policy/AWSCloudMapFullAccess
+            - arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy
+            - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
     aws:iam_role:pod2:
         AssumeRolePolicyDoc:
             Statement:
                 - Action:
-                      - sts:AssumeRoleWithWebIdentity
+                    - sts:AssumeRoleWithWebIdentity
                   Effect: Allow
                   Principal:
-                      Federated:
-                          - aws:iam_oidc_provider:eks_cluster-0#Arn
+                    Federated:
+                        - aws:iam_oidc_provider:eks_cluster-0#Arn
             Version: "2012-10-17"
     aws:iam_policy:iam_policy-0:
         Policy:
             Statement:
                 - Action:
-                      - ec2:DescribeAccountAttributes
-                      - ec2:DescribeAddresses
-                      - ec2:DescribeAvailabilityZones
-                      - ec2:DescribeInternetGateways
-                      - ec2:DescribeVpcs
-                      - ec2:DescribeVpcPeeringConnections
-                      - ec2:DescribeSubnets
-                      - ec2:DescribeSecurityGroups
-                      - ec2:DescribeInstances
-                      - ec2:DescribeNetworkInterfaces
-                      - ec2:DescribeTags
-                      - ec2:GetCoipPoolUsage
-                      - ec2:DescribeCoipPools
-                      - elasticloadbalancing:DescribeLoadBalancers
-                      - elasticloadbalancing:DescribeLoadBalancerAttributes
-                      - elasticloadbalancing:DescribeListeners
-                      - elasticloadbalancing:DescribeListenerCertificates
-                      - elasticloadbalancing:DescribeSSLPolicies
-                      - elasticloadbalancing:DescribeRules
-                      - elasticloadbalancing:DescribeTargetGroups
-                      - elasticloadbalancing:DescribeTargetGroupAttributes
-                      - elasticloadbalancing:DescribeTargetHealth
-                      - elasticloadbalancing:DescribeTags
-                      - elasticloadbalancing:CreateListener
-                      - elasticloadbalancing:DeleteListener
-                      - elasticloadbalancing:CreateRule
-                      - elasticloadbalancing:DeleteRule
+                    - ec2:DescribeAccountAttributes
+                    - ec2:DescribeAddresses
+                    - ec2:DescribeAvailabilityZones
+                    - ec2:DescribeInternetGateways
+                    - ec2:DescribeVpcs
+                    - ec2:DescribeVpcPeeringConnections
+                    - ec2:DescribeSubnets
+                    - ec2:DescribeSecurityGroups
+                    - ec2:DescribeInstances
+                    - ec2:DescribeNetworkInterfaces
+                    - ec2:DescribeTags
+                    - ec2:GetCoipPoolUsage
+                    - ec2:DescribeCoipPools
+                    - elasticloadbalancing:DescribeLoadBalancers
+                    - elasticloadbalancing:DescribeLoadBalancerAttributes
+                    - elasticloadbalancing:DescribeListeners
+                    - elasticloadbalancing:DescribeListenerCertificates
+                    - elasticloadbalancing:DescribeSSLPolicies
+                    - elasticloadbalancing:DescribeRules
+                    - elasticloadbalancing:DescribeTargetGroups
+                    - elasticloadbalancing:DescribeTargetGroupAttributes
+                    - elasticloadbalancing:DescribeTargetHealth
+                    - elasticloadbalancing:DescribeTags
+                    - elasticloadbalancing:CreateListener
+                    - elasticloadbalancing:DeleteListener
+                    - elasticloadbalancing:CreateRule
+                    - elasticloadbalancing:DeleteRule
                   Effect: Allow
                   Resource:
-                      - '*'
+                    - '*'
                 - Action:
-                      - cognito-idp:DescribeUserPoolClient
-                      - acm:ListCertificates
-                      - acm:DescribeCertificate
-                      - iam:ListServerCertificates
-                      - iam:GetServerCertificate
-                      - waf-regional:GetWebACL
-                      - waf-regional:GetWebACLForResource
-                      - waf-regional:AssociateWebACL
-                      - waf-regional:DisassociateWebACL
-                      - wafv2:GetWebACL
-                      - wafv2:GetWebACLForResource
-                      - wafv2:AssociateWebACL
-                      - wafv2:DisassociateWebACL
-                      - shield:GetSubscriptionState
-                      - shield:DescribeProtection
-                      - shield:CreateProtection
-                      - shield:DeleteProtection
+                    - cognito-idp:DescribeUserPoolClient
+                    - acm:ListCertificates
+                    - acm:DescribeCertificate
+                    - iam:ListServerCertificates
+                    - iam:GetServerCertificate
+                    - waf-regional:GetWebACL
+                    - waf-regional:GetWebACLForResource
+                    - waf-regional:AssociateWebACL
+                    - waf-regional:DisassociateWebACL
+                    - wafv2:GetWebACL
+                    - wafv2:GetWebACLForResource
+                    - wafv2:AssociateWebACL
+                    - wafv2:DisassociateWebACL
+                    - shield:GetSubscriptionState
+                    - shield:DescribeProtection
+                    - shield:CreateProtection
+                    - shield:DeleteProtection
                   Effect: Allow
                   Resource:
-                      - '*'
+                    - '*'
                 - Action:
-                      - iam:CreateServiceLinkedRole
+                    - iam:CreateServiceLinkedRole
                   Effect: Allow
                   Resource:
-                      - '*'
+                    - '*'
                 - Action:
-                      - ec2:AuthorizeSecurityGroupIngress
-                      - ec2:RevokeSecurityGroupIngress
+                    - ec2:AuthorizeSecurityGroupIngress
+                    - ec2:RevokeSecurityGroupIngress
                   Effect: Allow
                   Resource:
-                      - '*'
+                    - '*'
                 - Action:
-                      - ec2:CreateSecurityGroup
+                    - ec2:CreateSecurityGroup
                   Effect: Allow
                   Resource:
-                      - '*'
+                    - '*'
                 - Action:
-                      - ec2:CreateTags
+                    - ec2:CreateTags
                   Condition: {}
                   Effect: Allow
                   Resource:
-                      - arn:aws:ec2:*:*:security-group/*
+                    - arn:aws:ec2:*:*:security-group/*
                 - Action:
-                      - ec2:CreateTags
-                      - ec2:DeleteTags
+                    - ec2:CreateTags
+                    - ec2:DeleteTags
                   Condition: {}
                   Effect: Allow
                   Resource:
-                      - arn:aws:ec2:*:*:security-group/*
+                    - arn:aws:ec2:*:*:security-group/*
                 - Action:
-                      - ec2:AuthorizeSecurityGroupIngress
-                      - ec2:RevokeSecurityGroupIngress
-                      - ec2:DeleteSecurityGroup
+                    - ec2:AuthorizeSecurityGroupIngress
+                    - ec2:RevokeSecurityGroupIngress
+                    - ec2:DeleteSecurityGroup
                   Condition: {}
                   Effect: Allow
                   Resource:
-                      - arn:aws:ec2:*:*:security-group/*
+                    - arn:aws:ec2:*:*:security-group/*
                 - Action:
-                      - elasticloadbalancing:CreateLoadBalancer
-                      - elasticloadbalancing:CreateTargetGroup
+                    - elasticloadbalancing:CreateLoadBalancer
+                    - elasticloadbalancing:CreateTargetGroup
                   Condition: {}
                   Effect: Allow
                   Resource:
-                      - arn:aws:ec2:*:*:security-group/*
+                    - arn:aws:ec2:*:*:security-group/*
                 - Action:
-                      - elasticloadbalancing:AddTags
-                      - elasticloadbalancing:RemoveTags
+                    - elasticloadbalancing:AddTags
+                    - elasticloadbalancing:RemoveTags
                   Condition: {}
                   Effect: Allow
                   Resource:
-                      - arn:aws:elasticloadbalancing:*:*:targetgroup/*/*
-                      - arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*
-                      - arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*
+                    - arn:aws:elasticloadbalancing:*:*:targetgroup/*/*
+                    - arn:aws:elasticloadbalancing:*:*:loadbalancer/net/*/*
+                    - arn:aws:elasticloadbalancing:*:*:loadbalancer/app/*/*
                 - Action:
-                      - elasticloadbalancing:AddTags
-                      - elasticloadbalancing:RemoveTags
+                    - elasticloadbalancing:AddTags
+                    - elasticloadbalancing:RemoveTags
                   Effect: Allow
                   Resource:
-                      - arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*
-                      - arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*
-                      - arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*
-                      - arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*
+                    - arn:aws:elasticloadbalancing:*:*:listener/net/*/*/*
+                    - arn:aws:elasticloadbalancing:*:*:listener/app/*/*/*
+                    - arn:aws:elasticloadbalancing:*:*:listener-rule/net/*/*/*
+                    - arn:aws:elasticloadbalancing:*:*:listener-rule/app/*/*/*
                 - Action:
-                      - elasticloadbalancing:ModifyLoadBalancerAttributes
-                      - elasticloadbalancing:SetIpAddressType
-                      - elasticloadbalancing:SetSecurityGroups
-                      - elasticloadbalancing:SetSubnets
-                      - elasticloadbalancing:DeleteLoadBalancer
-                      - elasticloadbalancing:ModifyTargetGroup
-                      - elasticloadbalancing:ModifyTargetGroupAttributes
-                      - elasticloadbalancing:DeleteTargetGroup
+                    - elasticloadbalancing:ModifyLoadBalancerAttributes
+                    - elasticloadbalancing:SetIpAddressType
+                    - elasticloadbalancing:SetSecurityGroups
+                    - elasticloadbalancing:SetSubnets
+                    - elasticloadbalancing:DeleteLoadBalancer
+                    - elasticloadbalancing:ModifyTargetGroup
+                    - elasticloadbalancing:ModifyTargetGroupAttributes
+                    - elasticloadbalancing:DeleteTargetGroup
                   Condition: {}
                   Effect: Allow
                   Resource:
-                      - '*'
+                    - '*'
                 - Action:
-                      - elasticloadbalancing:RegisterTargets
-                      - elasticloadbalancing:DeregisterTargets
+                    - elasticloadbalancing:RegisterTargets
+                    - elasticloadbalancing:DeregisterTargets
                   Effect: Allow
                   Resource:
-                      - arn:aws:elasticloadbalancing:*:*:targetgroup/*/*
+                    - arn:aws:elasticloadbalancing:*:*:targetgroup/*/*
                 - Action:
-                      - elasticloadbalancing:SetWebAcl
-                      - elasticloadbalancing:ModifyListener
-                      - elasticloadbalancing:AddListenerCertificates
-                      - elasticloadbalancing:RemoveListenerCertificates
-                      - elasticloadbalancing:ModifyRule
+                    - elasticloadbalancing:SetWebAcl
+                    - elasticloadbalancing:ModifyListener
+                    - elasticloadbalancing:AddListenerCertificates
+                    - elasticloadbalancing:RemoveListenerCertificates
+                    - elasticloadbalancing:ModifyRule
                   Effect: Allow
                   Resource:
-                      - '*'
+                    - '*'
             Version: "2012-10-17"
     aws:iam_oidc_provider:eks_cluster-0:
         ClientIdLists:
@@ -447,11 +447,11 @@ resources:
         AssumeRolePolicyDoc:
             Statement:
                 - Action:
-                      - sts:AssumeRole
+                    - sts:AssumeRole
                   Effect: Allow
                   Principal:
-                      Service:
-                          - eks.amazonaws.com
+                    Service:
+                        - eks.amazonaws.com
             Version: "2012-10-17"
         ManagedPolicies:
             - arn:aws:iam::aws:policy/AmazonEKSClusterPolicy
@@ -478,14 +478,20 @@ resources:
     aws:security_group:vpc-0:eks_cluster-0-security_group:
         EgressRules:
             - CidrBlocks:
-                  - 0.0.0.0/0
+                - 0.0.0.0/0
               Description: Allows all outbound IPv4 traffic
               FromPort: 0
               Protocol: "-1"
               ToPort: 0
         IngressRules:
             - CidrBlocks:
-                  - 0.0.0.0/0
+                - 10.0.192.0/18
+              Description: Allow ingress traffic from ip addresses within the subnet subnet-1
+              FromPort: 0
+              Protocol: "-1"
+              ToPort: 0
+            - CidrBlocks:
+                - 0.0.0.0/0
               Description: Allows ingress traffic from the EKS control plane
               FromPort: 9443
               Protocol: TCP
@@ -496,17 +502,11 @@ resources:
               Self: true
               ToPort: 0
             - CidrBlocks:
-                  - 10.0.128.0/18
+                - 10.0.128.0/18
               Description: Allow ingress traffic from ip addresses within the subnet subnet-0
               FromPort: 0
               Protocol: "-1"
               ToPort: 0
-            - CidrBlocks:
-                  - 10.0.192.0/18
-              Description: Allow ingress traffic from ip addresses within the subnet subnet-1
-              FromPort: 0
-              Protocol: "-1"
-              ToPort: 0
         Vpc: aws:vpc:vpc-0
     aws:route_table:vpc-0:subnet-0-route_table:
         Routes:
@@ -597,11 +597,14 @@ edges:
     aws:load_balancer_listener:rest-api-4-integbcc77100:rest_api_4_integration_0-pod2 -> aws:target_group:rest-api-4-integbcc77100:
     aws:target_group:rest-api-4-integbcc77100 -> kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2:
     kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2 -> aws:eks_cluster:eks_cluster-0:
-    kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2 -> kubernetes:helm_chart:eks_cluster-0:aws-load-balancer-controller:
-    kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2 -> kubernetes:service:eks_cluster-0:restapi4integration0-pod2:
+    ? kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2 -> kubernetes:helm_chart:eks_cluster-0:aws-load-balancer-controller
+    :
+    ? kubernetes:target_group_binding:eks_cluster-0:restapi4integration0-pod2 -> kubernetes:service:eks_cluster-0:restapi4integration0-pod2
+    :
     kubernetes:helm_chart:eks_cluster-0:aws-load-balancer-controller -> aws:eks_cluster:eks_cluster-0:
     kubernetes:helm_chart:eks_cluster-0:aws-load-balancer-controller -> aws:region:region-0:
-    kubernetes:helm_chart:eks_cluster-0:aws-load-balancer-controller -> kubernetes:service_account:eks_cluster-0:aws-load-balancer-controller:
+    ? kubernetes:helm_chart:eks_cluster-0:aws-load-balancer-controller -> kubernetes:service_account:eks_cluster-0:aws-load-balancer-controller
+    :
     kubernetes:service:eks_cluster-0:restapi4integration0-pod2 -> aws:eks_cluster:eks_cluster-0:
     kubernetes:service:eks_cluster-0:restapi4integration0-pod2 -> kubernetes:pod:eks_cluster-0:pod2:
     kubernetes:service_account:eks_cluster-0:aws-load-balancer-controller -> aws:eks_cluster:eks_cluster-0:
diff --git a/pkg/engine2/testdata/lambda_efs.expect.yaml b/pkg/engine2/testdata/lambda_efs.expect.yaml
index 01220380..5f816909 100755
--- a/pkg/engine2/testdata/lambda_efs.expect.yaml
+++ b/pkg/engine2/testdata/lambda_efs.expect.yaml
@@ -145,6 +145,12 @@ resources:
               Protocol: "-1"
               ToPort: 0
         IngressRules:
+            - CidrBlocks:
+                - 10.0.128.0/18
+              Description: Allow ingress traffic from ip addresses within the subnet subnet-1
+              FromPort: 0
+              Protocol: "-1"
+              ToPort: 0
             - CidrBlocks:
                 - 10.0.192.0/18
               Description: Allow ingress traffic from ip addresses within the subnet lambda_test_app-test-efs-fs
@@ -156,12 +162,6 @@ resources:
               Protocol: "-1"
               Self: true
               ToPort: 0
-            - CidrBlocks:
-                - 10.0.128.0/18
-              Description: Allow ingress traffic from ip addresses within the subnet subnet-1
-              FromPort: 0
-              Protocol: "-1"
-              ToPort: 0
         Vpc: aws:vpc:vpc-0
     aws:security_group:vpc-0:subnet-1-test-efs-fs:
         EgressRules:
@@ -172,17 +172,17 @@ resources:
               Protocol: "-1"
               ToPort: 0
         IngressRules:
-            - Description: Allow ingress traffic from within the same security group
-              FromPort: 0
-              Protocol: "-1"
-              Self: true
-              ToPort: 0
             - CidrBlocks:
                 - 10.0.128.0/18
               Description: Allow ingress traffic from ip addresses within the subnet subnet-1
               FromPort: 0
               Protocol: "-1"
               ToPort: 0
+            - Description: Allow ingress traffic from within the same security group
+              FromPort: 0
+              Protocol: "-1"
+              Self: true
+              ToPort: 0
         Vpc: aws:vpc:vpc-0
     aws:route_table:vpc-0:subnet-1-route_table:
         Routes:
diff --git a/pkg/engine2/testdata/vpc_import_to_lambda.expect.yaml b/pkg/engine2/testdata/vpc_import_to_lambda.expect.yaml
index 32b7551f..9181f1ad 100644
--- a/pkg/engine2/testdata/vpc_import_to_lambda.expect.yaml
+++ b/pkg/engine2/testdata/vpc_import_to_lambda.expect.yaml
@@ -48,8 +48,8 @@ resources:
                         - lambda.amazonaws.com
             Version: "2012-10-17"
         ManagedPolicies:
-            - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
             - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
+            - arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole
     aws:subnet:subnet2:
         Type: private
         Vpc: aws:vpc:vpc