db_security_groups

Creates, updates, deletes, gets or lists a db_security_groups resource.

Overview

Name	db_security_groups
Type	Resource
Id	aws.rds.db_security_groups

Fields

The following fields are returned by SELECT queries:

describe_db_security_groups

Name	Datatype	Description
db_security_group_arn	string	The Amazon Resource Name (ARN) for the DB security group.
db_security_group_description	string	Provides the description of the DB security group.
db_security_group_name	string	Specifies the name of the DB security group.
ec2_security_groups	string	Contains a list of EC2SecurityGroup elements.
ip_ranges	string	Contains a list of IPRange elements.
owner_id	string	Provides the Amazon Web Services ID of the owner of a specific DB security group.
vpc_id	string	Provides the VpcId of the DB security group.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_db_security_groups	select	region	DBSecurityGroupName, Filters, MaxRecords, Marker	Returns a list of DBSecurityGroup descriptions. If a DBSecurityGroupName is specified, the list will contain only the descriptions of the specified DB security group. EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.
create_db_security_group	insert	DBSecurityGroupName, DBSecurityGroupDescription, region	Tags	Creates a new DB security group. DB security groups control access to a DB instance. A DB security group controls access to EC2-Classic DB instances that are not in a VPC. EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.
authorize_db_security_group_ingress	update	DBSecurityGroupName, region	CIDRIP, EC2SecurityGroupName, EC2SecurityGroupId, EC2SecurityGroupOwnerId	Enables ingress to a DBSecurityGroup using one of two forms of authorization. First, EC2 or VPC security groups can be added to the DBSecurityGroup if the application using the database is running on EC2 or VPC instances. Second, IP ranges are available if the application accessing your database is running on the internet. Required parameters for this API are one of CIDR range, EC2SecurityGroupId for VPC, or (EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId for non-VPC). You can't authorize ingress from an EC2 security group in one Amazon Web Services Region to an Amazon RDS DB instance in another. You can't authorize ingress from a VPC security group in one VPC to an Amazon RDS DB instance in another. For an overview of CIDR ranges, go to the Wikipedia Tutorial. EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.
delete_db_security_group	delete	DBSecurityGroupName, region		Deletes a DB security group. The specified DB security group must not be associated with any DB instances. EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.
revoke_db_security_group_ingress	exec	DBSecurityGroupName, region	CIDRIP, EC2SecurityGroupName, EC2SecurityGroupId, EC2SecurityGroupOwnerId	Revokes ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC security groups. Required parameters for this API are one of CIDRIP, EC2SecurityGroupId for VPC, or (EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId). EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
DBSecurityGroupDescription	string	The description for the DB security group.
DBSecurityGroupName	string	The name of the DB security group to revoke ingress from.
region	string	AWS region (default: us-east-1)
CIDRIP	string	The IP range to revoke access from. Must be a valid CIDR range. If CIDRIP is specified, EC2SecurityGroupName, EC2SecurityGroupId and EC2SecurityGroupOwnerId can't be provided.
DBSecurityGroupName	string	The name of the DB security group to return details for.
EC2SecurityGroupId	string	The id of the EC2 security group to revoke access from. For VPC DB security groups, EC2SecurityGroupId must be provided. Otherwise, EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId must be provided.
EC2SecurityGroupName	string	The name of the EC2 security group to revoke access from. For VPC DB security groups, EC2SecurityGroupId must be provided. Otherwise, EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId must be provided.
EC2SecurityGroupOwnerId	string	The Amazon Web Services account number of the owner of the EC2 security group specified in the EC2SecurityGroupName parameter. The Amazon Web Services access key ID isn't an acceptable value. For VPC DB security groups, EC2SecurityGroupId must be provided. Otherwise, EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId must be provided.
Filters	array	This parameter isn't currently supported.
Marker	string	An optional pagination token provided by a previous DescribeDBSecurityGroups request. If this parameter is specified, the response includes only records beyond the marker, up to the value specified by MaxRecords.
MaxRecords	integer	The maximum number of records to include in the response. If more records exist than the specified MaxRecords value, a pagination token called a marker is included in the response so that you can retrieve the remaining results. Default: 100 Constraints: Minimum 20, maximum 100.
Tags	array	Tags to assign to the DB security group.

SELECT examples

describe_db_security_groups

Returns a list of DBSecurityGroup descriptions. If a DBSecurityGroupName is specified, the list will contain only the descriptions of the specified DB security group. EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.

SELECT
db_security_group_arn,
db_security_group_description,
db_security_group_name,
ec2_security_groups,
ip_ranges,
owner_id,
vpc_id
FROM aws.rds.db_security_groups
WHERE region = '{{ region }}' -- required
AND DBSecurityGroupName = '{{ DBSecurityGroupName }}'
AND Filters = '{{ Filters }}'
AND MaxRecords = '{{ MaxRecords }}'
AND Marker = '{{ Marker }}'
;

INSERT examples

create_db_security_group

Creates a new DB security group. DB security groups control access to a DB instance. A DB security group controls access to EC2-Classic DB instances that are not in a VPC. EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.

INSERT INTO aws.rds.db_security_groups (
DBSecurityGroupName,
DBSecurityGroupDescription,
region,
Tags
)
SELECT 
'{{ DBSecurityGroupName }}',
'{{ DBSecurityGroupDescription }}',
'{{ region }}',
'{{ Tags }}'
RETURNING
db_security_group_arn,
db_security_group_description,
db_security_group_name,
ec2_security_groups,
ip_ranges,
owner_id,
vpc_id
;

Manifest

# Description fields are for documentation purposes
- name: db_security_groups
props:
  - name: DBSecurityGroupName
    value: "{{ DBSecurityGroupName }}"
    description: Required parameter for the db_security_groups resource.
  - name: DBSecurityGroupDescription
    value: "{{ DBSecurityGroupDescription }}"
    description: Required parameter for the db_security_groups resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the db_security_groups resource.
  - name: Tags
    value: "{{ Tags }}"
    description: Tags to assign to the DB security group.
    description: Tags to assign to the DB security group.

UPDATE examples

authorize_db_security_group_ingress

Enables ingress to a DBSecurityGroup using one of two forms of authorization. First, EC2 or VPC security groups can be added to the DBSecurityGroup if the application using the database is running on EC2 or VPC instances. Second, IP ranges are available if the application accessing your database is running on the internet. Required parameters for this API are one of CIDR range, EC2SecurityGroupId for VPC, or (EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId for non-VPC). You can't authorize ingress from an EC2 security group in one Amazon Web Services Region to an Amazon RDS DB instance in another. You can't authorize ingress from a VPC security group in one VPC to an Amazon RDS DB instance in another. For an overview of CIDR ranges, go to the Wikipedia Tutorial. EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.

UPDATE aws.rds.db_security_groups
SET 
-- No updatable properties
WHERE 
DBSecurityGroupName = '{{ DBSecurityGroupName }}' --required
AND region = '{{ region }}' --required
AND CIDRIP = '{{ CIDRIP}}'
AND EC2SecurityGroupName = '{{ EC2SecurityGroupName}}'
AND EC2SecurityGroupId = '{{ EC2SecurityGroupId}}'
AND EC2SecurityGroupOwnerId = '{{ EC2SecurityGroupOwnerId}}'
RETURNING
db_security_group_arn,
db_security_group_description,
db_security_group_name,
ec2_security_groups,
ip_ranges,
owner_id,
vpc_id;

DELETE examples

delete_db_security_group

Deletes a DB security group. The specified DB security group must not be associated with any DB instances. EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.

DELETE FROM aws.rds.db_security_groups
WHERE DBSecurityGroupName = '{{ DBSecurityGroupName }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

revoke_db_security_group_ingress

Revokes ingress from a DBSecurityGroup for previously authorized IP ranges or EC2 or VPC security groups. Required parameters for this API are one of CIDRIP, EC2SecurityGroupId for VPC, or (EC2SecurityGroupOwnerId and either EC2SecurityGroupName or EC2SecurityGroupId). EC2-Classic was retired on August 15, 2022. If you haven't migrated from EC2-Classic to a VPC, we recommend that you migrate as soon as possible. For more information, see Migrate from EC2-Classic to a VPC in the Amazon EC2 User Guide, the blog EC2-Classic Networking is Retiring – Here’s How to Prepare, and Moving a DB instance not in a VPC into a VPC in the Amazon RDS User Guide.

EXEC aws.rds.db_security_groups.revoke_db_security_group_ingress 
@DBSecurityGroupName='{{ DBSecurityGroupName }}' --required, 
@region='{{ region }}' --required, 
@CIDRIP='{{ CIDRIP }}', 
@EC2SecurityGroupName='{{ EC2SecurityGroupName }}', 
@EC2SecurityGroupId='{{ EC2SecurityGroupId }}', 
@EC2SecurityGroupOwnerId='{{ EC2SecurityGroupOwnerId }}'
;