security_group_ingress

Gets or operates on an individual security_group_ingress resource, use security_group_ingresses to retrieve a list of resources or to create a resource.

Overview

Name	security_group_ingress
Type	Resource
Description	Resource Type definition for AWS::EC2::SecurityGroupIngress
Id	aws.ec2.security_group_ingress

Fields

Name	Datatype	Description
id	string	The Security Group Rule Id
cidr_ip	string	The IPv4 ranges
cidr_ipv6	string	[VPC only] The IPv6 ranges
description	string	Updates the description of an ingress (inbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously
from_port	integer	The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.<br/><br/>Use this for ICMP and any protocol that uses ports.
group_id	string	The ID of the security group. You must specify either the security group ID or the security group name in the request. For security groups in a nondefault VPC, you must specify the security group ID.<br/><br/>You must specify the GroupName property or the GroupId property. For security groups that are in a VPC, you must use the GroupId property.
group_name	string	The name of the security group.
ip_protocol	string	The IP protocol name (tcp, udp, icmp, icmpv6) or number (see Protocol Numbers).<br/><br/>[VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp, udp, icmp, or icmpv6 allows traffic on all ports, regardless of any port range you specify. For tcp, udp, and icmp, you must specify a port range. For icmpv6, the port range is optional; if you omit the port range, traffic for all types and codes is allowed.
source_prefix_list_id	string	[EC2-VPC only] The ID of a prefix list.<br/><br/>
source_security_group_id	string	The ID of the security group. You must specify either the security group ID or the security group name. For security groups in a nondefault VPC, you must specify the security group ID.
source_security_group_name	string	[EC2-Classic, default VPC] The name of the source security group.<br/><br/>You must specify the GroupName property or the GroupId property. For security groups that are in a VPC, you must use the GroupId property.
source_security_group_owner_id	string	[nondefault VPC] The AWS account ID that owns the source security group. You can't specify this property with an IP address range.<br/><br/>If you specify SourceSecurityGroupName or SourceSecurityGroupId and that security group is owned by a different account than the account creating the stack, you must specify the SourceSecurityGroupOwnerId; otherwise, this property is optional.
to_port	integer	The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.<br/><br/>Use this for ICMP and any protocol that uses ports.
region	string	AWS region.

Methods

Name	Accessible by	Required Params
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
delete_resource	DELETE	data__Identifier, region
get_resource	SELECT	data__Identifier, region

SELECT Example

SELECT
region,
id,
cidr_ip,
cidr_ipv6,
description,
from_port,
group_id,
group_name,
ip_protocol,
source_prefix_list_id,
source_security_group_id,
source_security_group_name,
source_security_group_owner_id,
to_port
FROM aws.ec2.security_group_ingress
WHERE data__Identifier = '<Id>';

Permissions

To operate on the security_group_ingress resource, the following permissions are required:

Update

ec2:UpdateSecurityGroupRuleDescriptionsIngress

Delete

ec2:DescribeSecurityGroupRules,
ec2:RevokeSecurityGroupIngress

Read

ec2:DescribeSecurityGroups,
ec2:DescribeSecurityGroupRules