cluster_security_groups

Creates, updates, deletes, gets or lists a cluster_security_groups resource.

Overview

Name	cluster_security_groups
Type	Resource
Id	aws.redshift.cluster_security_groups

Fields

The following fields are returned by SELECT queries:

describe_cluster_security_groups

Name	Datatype	Description
cluster_security_group_name	string	The name of the cluster security group to which the operation was applied.
description	string	A description of the security group.
ec2_security_groups	string	A list of EC2 security groups that are permitted to access clusters associated with this cluster security group.
ip_ranges	string	A list of IP ranges (CIDR blocks) that are permitted to access clusters associated with this cluster security group.
tags	string	The list of tags for the cluster security group.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_cluster_security_groups	select	region	ClusterSecurityGroupName, MaxRecords, Marker, TagKeys, TagValues	Returns information about Amazon Redshift security groups. If the name of a security group is specified, the response will contain only information about only that security group. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all security groups that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all security groups that have any combination of those values are returned. If both tag keys and values are omitted from the request, security groups are returned regardless of whether they have tag keys or values associated with them.
create_cluster_security_group	insert	ClusterSecurityGroupName, region	Description, Tags	Creates a new Amazon Redshift security group. You use security groups to control access to non-VPC clusters. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide.
authorize_cluster_security_group_ingress	update	ClusterSecurityGroupName, region	CIDRIP, EC2SecurityGroupName, EC2SecurityGroupOwnerId	Adds an inbound (ingress) rule to an Amazon Redshift security group. Depending on whether the application accessing your cluster is running on the Internet or an Amazon EC2 instance, you can authorize inbound access to either a Classless Interdomain Routing (CIDR)/Internet Protocol (IP) range or to an Amazon EC2 security group. You can add as many as 20 ingress rules to an Amazon Redshift security group. If you authorize access to an Amazon EC2 security group, specify EC2SecurityGroupName and EC2SecurityGroupOwnerId. The Amazon EC2 security group and Amazon Redshift cluster must be in the same Amazon Web Services Region. If you authorize access to a CIDR/IP address range, specify CIDRIP. For an overview of CIDR blocks, see the Wikipedia article on Classless Inter-Domain Routing. You must also associate the security group with a cluster so that clients running on these IP addresses or the EC2 instance are authorized to connect to the cluster. For information about managing security groups, go to Working with Security Groups in the Amazon Redshift Cluster Management Guide.
delete_cluster_security_group	delete	ClusterSecurityGroupName, region		Deletes an Amazon Redshift security group. You cannot delete a security group that is associated with any clusters. You cannot delete the default security group. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide.
revoke_cluster_security_group_ingress	exec	ClusterSecurityGroupName, region	CIDRIP, EC2SecurityGroupName, EC2SecurityGroupOwnerId	Revokes an ingress rule in an Amazon Redshift security group for a previously authorized IP range or Amazon EC2 security group. To add an ingress rule, see AuthorizeClusterSecurityGroupIngress. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
ClusterSecurityGroupName	string	The name of the security Group from which to revoke the ingress rule.
region	string	AWS region (default: us-east-1)
CIDRIP	string	The IP range for which to revoke access. This range must be a valid Classless Inter-Domain Routing (CIDR) block of IP addresses. If CIDRIP is specified, EC2SecurityGroupName and EC2SecurityGroupOwnerId cannot be provided.
ClusterSecurityGroupName	string	The name of a cluster security group for which you are requesting details. You must specify either the Marker parameter or a ClusterSecurityGroupName parameter, but not both. Example: securitygroup1
Description	string	A description for the security group.
EC2SecurityGroupName	string	The name of the EC2 Security Group whose access is to be revoked. If EC2SecurityGroupName is specified, EC2SecurityGroupOwnerId must also be provided and CIDRIP cannot be provided.
EC2SecurityGroupOwnerId	string	The Amazon Web Services account number of the owner of the security group specified in the EC2SecurityGroupName parameter. The Amazon Web Services access key ID is not an acceptable value. If EC2SecurityGroupOwnerId is specified, EC2SecurityGroupName must also be provided. and CIDRIP cannot be provided. Example: 111122223333
Marker	string	An optional parameter that specifies the starting point to return a set of response records. When the results of a DescribeClusterSecurityGroups request exceed the value specified in MaxRecords, Amazon Web Services returns a value in the Marker field of the response. You can retrieve the next set of response records by providing the returned marker value in the Marker parameter and retrying the request. Constraints: You must specify either the ClusterSecurityGroupName parameter or the Marker parameter, but not both.
MaxRecords	integer	The maximum number of response records to return in each call. If the number of remaining response records exceeds the specified MaxRecords value, a value is returned in a marker field of the response. You can retrieve the next set of records by retrying the command with the returned marker value. Default: 100 Constraints: minimum 20, maximum 100.
TagKeys	array	A tag key or keys for which you want to return all matching cluster security groups that are associated with the specified key or keys. For example, suppose that you have security groups that are tagged with keys called owner and environment. If you specify both of these tag keys in the request, Amazon Redshift returns a response with the security groups that have either or both of these tag keys associated with them.
TagValues	array	A tag value or values for which you want to return all matching cluster security groups that are associated with the specified tag value or values. For example, suppose that you have security groups that are tagged with values called admin and test. If you specify both of these tag values in the request, Amazon Redshift returns a response with the security groups that have either or both of these tag values associated with them.
Tags	array	A list of tag instances.

SELECT examples

describe_cluster_security_groups

Returns information about Amazon Redshift security groups. If the name of a security group is specified, the response will contain only information about only that security group. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide. If you specify both tag keys and tag values in the same request, Amazon Redshift returns all security groups that match any combination of the specified keys and values. For example, if you have owner and environment for tag keys, and admin and test for tag values, all security groups that have any combination of those values are returned. If both tag keys and values are omitted from the request, security groups are returned regardless of whether they have tag keys or values associated with them.

SELECT
cluster_security_group_name,
description,
ec2_security_groups,
ip_ranges,
tags
FROM aws.redshift.cluster_security_groups
WHERE region = '{{ region }}' -- required
AND ClusterSecurityGroupName = '{{ ClusterSecurityGroupName }}'
AND MaxRecords = '{{ MaxRecords }}'
AND Marker = '{{ Marker }}'
AND TagKeys = '{{ TagKeys }}'
AND TagValues = '{{ TagValues }}'
;

INSERT examples

create_cluster_security_group

Creates a new Amazon Redshift security group. You use security groups to control access to non-VPC clusters. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide.

INSERT INTO aws.redshift.cluster_security_groups (
ClusterSecurityGroupName,
region,
Description,
Tags
)
SELECT 
'{{ ClusterSecurityGroupName }}',
'{{ region }}',
'{{ Description }}',
'{{ Tags }}'
RETURNING
cluster_security_group_name,
description,
ec2_security_groups,
ip_ranges,
tags
;

Manifest

# Description fields are for documentation purposes
- name: cluster_security_groups
props:
  - name: ClusterSecurityGroupName
    value: "{{ ClusterSecurityGroupName }}"
    description: Required parameter for the cluster_security_groups resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the cluster_security_groups resource.
  - name: Description
    value: "{{ Description }}"
    description: A description for the security group.
    description: A description for the security group.
  - name: Tags
    value: "{{ Tags }}"
    description: A list of tag instances.
    description: A list of tag instances.

UPDATE examples

authorize_cluster_security_group_ingress

Adds an inbound (ingress) rule to an Amazon Redshift security group. Depending on whether the application accessing your cluster is running on the Internet or an Amazon EC2 instance, you can authorize inbound access to either a Classless Interdomain Routing (CIDR)/Internet Protocol (IP) range or to an Amazon EC2 security group. You can add as many as 20 ingress rules to an Amazon Redshift security group. If you authorize access to an Amazon EC2 security group, specify EC2SecurityGroupName and EC2SecurityGroupOwnerId. The Amazon EC2 security group and Amazon Redshift cluster must be in the same Amazon Web Services Region. If you authorize access to a CIDR/IP address range, specify CIDRIP. For an overview of CIDR blocks, see the Wikipedia article on Classless Inter-Domain Routing. You must also associate the security group with a cluster so that clients running on these IP addresses or the EC2 instance are authorized to connect to the cluster. For information about managing security groups, go to Working with Security Groups in the Amazon Redshift Cluster Management Guide.

UPDATE aws.redshift.cluster_security_groups
SET 
-- No updatable properties
WHERE 
ClusterSecurityGroupName = '{{ ClusterSecurityGroupName }}' --required
AND region = '{{ region }}' --required
AND CIDRIP = '{{ CIDRIP}}'
AND EC2SecurityGroupName = '{{ EC2SecurityGroupName}}'
AND EC2SecurityGroupOwnerId = '{{ EC2SecurityGroupOwnerId}}'
RETURNING
cluster_security_group_name,
description,
ec2_security_groups,
ip_ranges,
tags;

DELETE examples

delete_cluster_security_group

Deletes an Amazon Redshift security group. You cannot delete a security group that is associated with any clusters. You cannot delete the default security group. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide.

DELETE FROM aws.redshift.cluster_security_groups
WHERE ClusterSecurityGroupName = '{{ ClusterSecurityGroupName }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

revoke_cluster_security_group_ingress

Revokes an ingress rule in an Amazon Redshift security group for a previously authorized IP range or Amazon EC2 security group. To add an ingress rule, see AuthorizeClusterSecurityGroupIngress. For information about managing security groups, go to Amazon Redshift Cluster Security Groups in the Amazon Redshift Cluster Management Guide.

EXEC aws.redshift.cluster_security_groups.revoke_cluster_security_group_ingress 
@ClusterSecurityGroupName='{{ ClusterSecurityGroupName }}' --required, 
@region='{{ region }}' --required, 
@CIDRIP='{{ CIDRIP }}', 
@EC2SecurityGroupName='{{ EC2SecurityGroupName }}', 
@EC2SecurityGroupOwnerId='{{ EC2SecurityGroupOwnerId }}'
;