AWS::EC2::SecurityGroupIngress
The AWS::EC2::SecurityGroupIngress
resource adds an ingress rule to an Amazon EC2
or Amazon VPC security group.
Important
Use AWS::EC2::SecurityGroupIngress
and
AWS::EC2::SecurityGroupEgress
only when necessary, typically to allow
security groups to reference each other in ingress and egress rules. Otherwise, use
the
embedded ingress and egress rules of AWS::EC2::SecurityGroup. For more information, see Amazon EC2 Security
Groups.
Topics
Syntax
To declare this entity in your AWS CloudFormation template, use the following syntax:
JSON
{ "Type" : "AWS::EC2::SecurityGroupIngress", "Properties" : { "CidrIp" :
String
, "CidrIpv6" :String
, "Description" :String
, "FromPort" :Integer
, "GroupId" :String
, "GroupName" :String
, "IpProtocol" :String
, "SourcePrefixListId" :String
, "SourceSecurityGroupName" :String
, "SourceSecurityGroupId" :String
, "SourceSecurityGroupOwnerId" :String
, "ToPort" :Integer
} }
YAML
Type: AWS::EC2::SecurityGroupIngress Properties: CidrIp:
String
CidrIpv6:String
Description:String
FromPort:Integer
GroupId:String
GroupName:String
IpProtocol:String
SourcePrefixListId:String
SourceSecurityGroupName:String
SourceSecurityGroupId:String
SourceSecurityGroupOwnerId:String
ToPort:Integer
Properties
For more information about adding ingress rules to Amazon EC2 or VPC security groups, see AuthorizeSecurityGroupIngress in the Amazon EC2 API Reference.
Note
If you change this resource's logical ID, you must also update a property value in order to trigger an update for this resource.
CidrIp
-
An IPv4 CIDR range.
For an overview of CIDR ranges, go to the Wikipedia Tutorial.
Type: String
Required: Conditional. You must specify a source security group (
SourceSecurityGroupName
orSourceSecurityGroupId
) or a CIDR range (CidrIp
orCidrIpv6
).Update requires: Replacement
CidrIpv6
-
An IPv6 CIDR range.
Type: String
Required: Conditional. You must specify a source security group (
SourceSecurityGroupName
orSourceSecurityGroupId
) or a CIDR range (CidrIp
orCidrIpv6
).Update requires: Replacement
Description
-
Description of the ingress rule.
Required: No
Type: String
Update requires: No interruption
FromPort
-
Start of port range for the TCP and UDP protocols, or an ICMP type number. If you specify
icmp
for theIpProtocol
property, you can specify -1 as a wildcard (i.e., any ICMP type number).Type: Integer
Required: Yes, for ICMP and any protocol that uses ports.
Update requires: Replacement
GroupId
-
ID of the Amazon EC2 or VPC security group to modify. The group must belong to your account.
Type: String
Required: Conditional. You must specify the
GroupName
property or theGroupId
property. For security groups that are in a VPC, you must use theGroupId
property. For example, EC2-VPC accounts must use theGroupId
property.Update requires: Replacement
GroupName
-
Name of the Amazon EC2 security group (non-VPC security group) to modify. This value can be a reference to an AWS::EC2::SecurityGroup resource or the name of an existing Amazon EC2 security group.
Type: String
Required: Conditional. You must specify the
GroupName
property or theGroupId
property. For security groups that are in a VPC, you must use theGroupId
property. For example, EC2-VPC accounts must use theGroupId
property.Update requires: Replacement
IpProtocol
-
IP protocol name or number. For valid values, see the IpProtocol parameter in AuthorizeSecurityGroupIngress
Type: String
Required: Yes
Update requires: Replacement
SourcePrefixListId
-
The AWS service prefix of an Amazon VPC endpoint. For more information, see VPC Endpoints in the Amazon VPC User Guide.
Type: String
Required: Conditional. You must specify a source security group (
SourcePrefixListId
,SourceSecurityGroupId
, orSourceSecurityGroupName
) or a CIDR range (CidrIp
orCidrIpv6
).Update requires: Replacement
SourceSecurityGroupId
-
Specifies the ID of the source security group or uses the
Ref
intrinsic function to refer to the logical ID of a security group defined in the same template.Type: String
Required: Conditional. You must specify a source security group (
SourcePrefixListId
,SourceSecurityGroupId
, orSourceSecurityGroupName
) or a CIDR range (CidrIp
orCidrIpv6
).Update requires: Replacement
SourceSecurityGroupName
-
Specifies the name of the Amazon EC2 security group (non-VPC security group) to allow access or use the
Ref
intrinsic function to refer to the logical ID of a security group defined in the same template. For instances in a VPC, specify theSourceSecurityGroupId
property.Type: String
Required: Conditional. You must specify a source security group (
SourcePrefixListId
,SourceSecurityGroupId
, orSourceSecurityGroupName
) or a CIDR range (CidrIp
orCidrIpv6
).Update requires: Replacement
SourceSecurityGroupOwnerId
-
Specifies the AWS Account ID of the owner of the Amazon EC2 security group specified in the
SourceSecurityGroupName
property.Type: String
Required: Conditional. If you specify
SourceSecurityGroupName
and that security group is owned by a different account than the account creating the stack, you must specify theSourceSecurityGroupOwnerId
; otherwise, this property is optional.Update requires: Replacement
ToPort
-
End of port range for the TCP and UDP protocols, or an ICMP code. If you specify
icmp
for theIpProtocol
property, you can specify -1 as a wildcard (i.e., any ICMP code).Type: Integer
Required: Yes, for ICMP and any protocol that uses ports.
Update requires: Replacement
Examples
EC2 Security Group and Ingress Rule
To create an Amazon EC2 (non-VPC) security group and an ingress rule, use the SourceSecurityGroupName
property in the ingress rule.
The following template snippet creates an EC2 security group with an ingress rule
that allows incoming traffic on port 80 from any other host in the security group.
The snippet uses the intrinsic function Ref to specify the value for SourceSecurityGroupName
.
JSON
{ "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "SGBase": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "GroupDescription": "Base Security Group", "SecurityGroupIngress": [ { "IpProtocol": "tcp", "CidrIp": "<IP_ADDRESS>/0", "FromPort": 22, "ToPort": 22 } ] } }, "SGBaseIngress": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "GroupName": { "Ref": "SGBase" }, "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "SourceSecurityGroupId": { "Ref": "SGBase" } } } } }
YAML
AWSTemplateFormatVersion: 2010-09-09 Resources: SGBase: Type: 'AWS::EC2::SecurityGroup' Properties: GroupDescription: Base Security Group SecurityGroupIngress: - IpProtocol: tcp CidrIp: <IP_ADDRESS>/0 FromPort: 22 ToPort: 22 SGBaseIngress: Type: 'AWS::EC2::SecurityGroupIngress' Properties: GroupName: !Ref SGBase IpProtocol: tcp FromPort: 80 ToPort: 80 SourceSecurityGroupId: !Ref SGBase
VPC Security Groups with Egress and Ingress Rules
In some cases, you might have an originating (source) security group to which you
want to add an outbound rule that allows traffic to a destination (target) security
group. The target security group also needs an inbound rule that allows traffic from
the source security group. Note that you cannot use the Ref
function to specify the outbound and inbound rules for each security group. Doing
so creates a circular dependency; you cannot have two resources that depend on
each other. Instead, use the egress and ingress resources to declare these outbound
and inbound rules, as shown in the following template snippet.
JSON
{ "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "SourceSG": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "VpcId" : "vpc-1a2b3c4d", "GroupDescription": "Sample source security group" } }, "TargetSG": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "VpcId" : "vpc-1a2b3c4d", "GroupDescription": "Sample target security group" } }, "OutboundRule": { "Type": "AWS::EC2::SecurityGroupEgress", "Properties":{ "IpProtocol": "tcp", "FromPort": 0, "ToPort": 65535, "DestinationSecurityGroupId": { "Fn::GetAtt": [ "TargetSG", "GroupId" ] }, "GroupId": { "Fn::GetAtt": [ "SourceSG", "GroupId" ] } } }, "InboundRule": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties":{ "IpProtocol": "tcp", "FromPort": 0, "ToPort": 65535, "SourceSecurityGroupId": { "Fn::GetAtt": [ "SourceSG", "GroupId" ] }, "GroupId": { "Fn::GetAtt": [ "TargetSG", "GroupId" ] } } } } }
YAML
AWSTemplateFormatVersion: '2010-09-09' Resources: SourceSG: Type: AWS::EC2::SecurityGroup Properties: VpcId: vpc-1a2b3c4d GroupDescription: Sample source security group TargetSG: Type: AWS::EC2::SecurityGroup Properties: VpcId: vpc-1a2b3c4d GroupDescription: Sample target security group OutboundRule: Type: AWS::EC2::SecurityGroupEgress Properties: IpProtocol: tcp FromPort: 0 ToPort: 65535 DestinationSecurityGroupId: Fn::GetAtt: - TargetSG - GroupId GroupId: Fn::GetAtt: - SourceSG - GroupId InboundRule: Type: AWS::EC2::SecurityGroupIngress Properties: IpProtocol: tcp FromPort: 0 ToPort: 65535 SourceSecurityGroupId: Fn::GetAtt: - SourceSG - GroupId GroupId: Fn::GetAtt: - TargetSG - GroupId
Allow Traffic from a Security Group in a Peered VPC
Like the previous example, the following example allows one-way traffic from an
originating (source) security group to a destination (target) security group. However,
in
this example the security groups are in peered VPCs across AWS accounts. You might
want to
allow cross-account traffic if, for example, you create a security scanning resource
in one
AWS account that you'll use to run diagnostics in another account. This example adds
an
ingress rule to a target VPC security group that allows incoming traffic from a source
security group in a different AWS account. Note that the source security group also
needs an
egress rule that allows outgoing traffic to the target security group. Because the
source
security group is in a different account, the following example doesn't use the Ref
function
to reference the source security group ID but instead directly specifies the security
group
ID sg-12345678
.
JSON
{ "AWSTemplateFormatVersion": "2010-09-09", "Resources": { "TargetSG": { "Type": "AWS::EC2::SecurityGroup", "Properties": { "VpcId": "vpc-1a2b3c4d", "GroupDescription": "Security group allowing ingress for security scanners" } }, "InboundRule": { "Type": "AWS::EC2::SecurityGroupIngress", "Properties": { "GroupId": { "Fn::GetAtt": [ "TargetSG", "GroupId" ] }, "IpProtocol": "tcp", "FromPort": "80", "ToPort": "80", "SourceSecurityGroupId": "sg-12345678", "SourceSecurityGroupOwnerId": "123456789012" } } } }
YAML
AWSTemplateFormatVersion: 2010-09-09 Resources: TargetSG: Type: 'AWS::EC2::SecurityGroup' Properties: VpcId: vpc-1a2b3c4d GroupDescription: Security group allowing ingress for security scanners InboundRule: Type: 'AWS::EC2::SecurityGroupIngress' Properties: GroupId: !GetAtt TargetSG.GroupId IpProtocol: tcp FromPort: '80' ToPort: '80' SourceSecurityGroupId: sg-12345678 SourceSecurityGroupOwnerId: '123456789012'
Allow Ping Requests
To allow ping requests, add the ICMP protocol type and specify 8
(echo request) for the ICMP type and either 0
or -1
(all) for the ICMP code.
JSON
"SGPing" : { "Type" : "AWS::EC2::SecurityGroup", "DependsOn": "VPC", "Properties" : { "GroupDescription" : "SG to test ping", "VpcId" : {"Ref" : "VPC"}, "SecurityGroupIngress" : [ { "IpProtocol" : "tcp", "FromPort" : 22, "ToPort" : 22, "CidrIp" : "<IP_ADDRESS>/24" }, { "IpProtocol" : "icmp", "FromPort" : 8, "ToPort" : -1, "CidrIp" : "<IP_ADDRESS>/24" } ] } }
YAML
SGPing: Type: AWS::EC2::SecurityGroup DependsOn: VPC Properties: GroupDescription: SG to test ping VpcId: Ref: VPC SecurityGroupIngress: - IpProtocol: tcp FromPort: 22 ToPort: 22 CidrIp: <IP_ADDRESS>/24 - IpProtocol: icmp FromPort: 8 ToPort: -1 CidrIp: <IP_ADDRESS>/24


---
layout: post
title: Animatic layer
date: '2013-03-30T07:10:00+01:00'
categories:
- Storyboards
- Atoleiros Battle
picture_url: https://film-Storyboards.tumblr.com/post/46665176366/animatic-layer-crowd-with-knight
---
Animatic layer, crowd with knight.