security_group_rules

Creates, updates, deletes, gets or lists a security_group_rules resource.

Overview

Name	security_group_rules
Type	Resource
Id	aws.ec2.security_group_rules

Fields

The following fields are returned by SELECT queries:

describe_security_group_rules

Name	Datatype	Description
cidr_ipv_4	string	The IPv4 CIDR range.
cidr_ipv_6	string	The IPv6 CIDR range.
description	string	The security group rule description.
from_port	integer	If the protocol is TCP or UDP, this is the start of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP type or -1 (all ICMP types).
group_id	string	The ID of the security group.
group_owner_id	string	The ID of the Amazon Web Services account that owns the security group.
ip_protocol	string	The IP protocol name (tcp, udp, icmp, icmpv6) or number (see Protocol Numbers). Use -1 to specify all protocols.
is_egress	boolean	Indicates whether the security group rule is an outbound rule.
prefix_list_id	string	The ID of the prefix list.
referenced_group_info	string	Describes the security group that is referenced in the rule.
security_group_rule_arn	string	The ARN of the security group rule.
security_group_rule_id	string	The ID of the security group rule.
tags	string	The tags applied to the security group rule.
to_port	integer	If the protocol is TCP or UDP, this is the end of the port range. If the protocol is ICMP or ICMPv6, this is the ICMP code or -1 (all ICMP codes). If the start port is -1 (all ICMP types), then the end port must be -1 (all ICMP codes).

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_security_group_rules	select	region	Filter, SecurityGroupRuleId, DryRun, NextToken, MaxResults	Describes one or more of your security group rules.
modify_security_group_rules	update	GroupId, SecurityGroupRule, region	DryRun	Modifies the rules of a security group.
update_security_group_rule_descriptions_egress	update	region	DryRun, GroupId, GroupName, IpPermissions, SecurityGroupRuleDescription	Updates the description of an egress (outbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously. You can remove a description for a security group rule by omitting the description parameter in the request.
update_security_group_rule_descriptions_ingress	exec	region	DryRun, GroupId, GroupName, IpPermissions, SecurityGroupRuleDescription	Updates the description of an ingress (inbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously. You can remove a description for a security group rule by omitting the description parameter in the request.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
GroupId	string	The ID of the security group.
SecurityGroupRule	array	Information about the security group properties to update.
region	string	AWS region (default: us-east-1)
DryRun	boolean	Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
Filter	array	One or more filters. group-id - The ID of the security group. security-group-rule-id - The ID of the security group rule. tag:<key> - The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key Owner and the value TeamA, specify tag:Owner for the filter name and TeamA for the filter value.
GroupId	string	The ID of the security group. You must specify either the security group ID or the security group name in the request. For security groups in a nondefault VPC, you must specify the security group ID.
GroupName	string	[Default VPC] The name of the security group. You must specify either the security group ID or the security group name. For security groups in a nondefault VPC, you must specify the security group ID.
IpPermissions	array	The IP permissions for the security group rule. You must specify either IP permissions or a description.
MaxResults	integer	The maximum number of items to return for this request. To get the next page of items, make another request with the token returned in the output. This value can be between 5 and 1000. If this parameter is not specified, then all items are returned. For more information, see Pagination.
NextToken	string	The token returned from a previous paginated request. Pagination continues from the end of the items returned by the previous request.
SecurityGroupRuleDescription	array	The description for the ingress security group rules. You must specify either a description or IP permissions.
SecurityGroupRuleId	array	The IDs of the security group rules.

SELECT examples

describe_security_group_rules

Describes one or more of your security group rules.

SELECT
cidr_ipv_4,
cidr_ipv_6,
description,
from_port,
group_id,
group_owner_id,
ip_protocol,
is_egress,
prefix_list_id,
referenced_group_info,
security_group_rule_arn,
security_group_rule_id,
tags,
to_port
FROM aws.ec2.security_group_rules
WHERE region = '{{ region }}' -- required
AND Filter = '{{ Filter }}'
AND SecurityGroupRuleId = '{{ SecurityGroupRuleId }}'
AND DryRun = '{{ DryRun }}'
AND NextToken = '{{ NextToken }}'
AND MaxResults = '{{ MaxResults }}'
;

UPDATE examples

modify_security_group_rules

Modifies the rules of a security group.

UPDATE aws.ec2.security_group_rules
SET 
-- No updatable properties
WHERE 
GroupId = '{{ GroupId }}' --required
AND SecurityGroupRule = '{{ SecurityGroupRule }}' --required
AND region = '{{ region }}' --required
AND DryRun = {{ DryRun}}
RETURNING
return;

update_security_group_rule_descriptions_egress

Updates the description of an egress (outbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously. You can remove a description for a security group rule by omitting the description parameter in the request.

UPDATE aws.ec2.security_group_rules
SET 
-- No updatable properties
WHERE 
region = '{{ region }}' --required
AND DryRun = {{ DryRun}}
AND GroupId = '{{ GroupId}}'
AND GroupName = '{{ GroupName}}'
AND IpPermissions = '{{ IpPermissions}}'
AND SecurityGroupRuleDescription = '{{ SecurityGroupRuleDescription}}'
RETURNING
return;

Lifecycle Methods

update_security_group_rule_descriptions_ingress

Updates the description of an ingress (inbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously. You can remove a description for a security group rule by omitting the description parameter in the request.

EXEC aws.ec2.security_group_rules.update_security_group_rule_descriptions_ingress 
@region='{{ region }}' --required, 
@DryRun={{ DryRun }}, 
@GroupId='{{ GroupId }}', 
@GroupName='{{ GroupName }}', 
@IpPermissions='{{ IpPermissions }}', 
@SecurityGroupRuleDescription='{{ SecurityGroupRuleDescription }}'
;