Newly deployed VM from Aria Automation cannot be added to non-empty security group in NSX

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When a virtual machine (VM) is deployed via Aria Automation and assigned to an existing security group in NSX-T, the deployment may complete with a "SUCCESS" status, but the newly deployed VM is missing from the security group's member list in the NSX-T GUI.

This issue typically occurs when:
* The target security group is non-empty.
* All existing members in the group are of the "Virtual Machine" type.
* There are no "Virtual Network Interface" (VIF) type members present in the group.

The following log is observed in provisioning-service-app.log:

<YYYY-MM-DD>T<HH:MM:SS> INFO provisioning [host='provisioning-service-app-#########-#####' thread='xn-index-queries-18' user='' org='' trace='' parent='' span=''] c.v.m.a.n.u.NsxTPolicySecurityGroupUtils.updateGroupExpressionIfExists:456 - No update-able group expressions found for group [<SECURITY-GROUP-NAME>].

Environment

VMware Aria Automation 8.x

VMware NSX

Cause

Aria Automation requires an existing NSX-T security group to either be completely empty or contain "Virtual Network Interface" (VIF) type members to successfully perform an "ADD" operation via the Policy API. 

Resolution

To resolve this issue, implement one of the following workarounds in NSX-T Manager UI:

1.  Add a VIF Member: Manually add at least one member to the target security group using the "VIFs" category instead of the "Virtual Machines" category within the NSX-T Manager UI.  (See details in Click Members to add static members in the group)

Or

2.  Clear the security group to ensure it is empty.