# agent's firewall rule change applied to the wrong security group: how to verify

## TL;DR

The agent applied the firewall change to a similarly named security group. Verify by ID, not name: resolve the group ID fresh, show the diff before applying, and re-read the group after. Names collide; IDs do not.

```text
agent's firewall rule change applied to the wrong security group
```

## Steps

1. Identify both groups: the intended one and the one that got the rule.
   Expected: The mixup is mapped.

2. Remove the rule from the wrong group and apply it to the right one.
   Expected: The state is corrected.

3. Change the workflow to resolve security group IDs fresh and display the group name, VPC, and ID before applying.
   Expected: The target is unambiguous.

4. Require a plan/apply two-step: show the diff, then apply.
   Expected: Changes are reviewed.

5. Audit recent rule changes for other misapplications.
   Expected: The full extent is known.

## When to use

- firewall rules appear in unexpected groups
- groups have similar names
- automation manages rules

## When not to use

- the rule is correct in the right group (verify before assuming a mixup)
- groups are selected by ID already (check the resolution code)
- the change was manual (different review)

## Tool compatibility

- AWS security groups (any cloud firewall)
- IaC-managed rules

## Variant phrasings

- "firewall rule wrong security group"
- "security group mixup rule change"
- "verify firewall rule target"

## Why it happens

Security groups have human-friendly names that collide across VPCs and accounts, and automation that resolves by name inherits the ambiguity. A firewall rule in the wrong group is either an outage (blocked traffic) or a breach (opened traffic). The plan/apply pattern exists to catch exactly this.

## Edge cases

- the plan must show the group ID, not just the name
- stale caches of group IDs are their own hazard; resolve fresh
- the blast radius of a wrong-group rule depends on direction; audit both

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ek3c376VCeU-en24OgWF6A