security_groups

Creates, updates, deletes or gets a security_group resource or lists security_groups in a region

Overview

Name	security_groups
Type	Resource
Description	Resource Type definition for AWS::EC2::SecurityGroup
Id	aws.ec2.security_groups

Fields

Name	Datatype	Description
group_description	string	A description for the security group.
group_name	string	The name of the security group.
vpc_id	string	The ID of the VPC for the security group.
id	string	The group name or group ID depending on whether the SG is created in default or specific VPC
security_group_ingress	array	The inbound rules associated with the security group. There is a short interruption during which you cannot connect to the security group.
security_group_egress	array	[VPC only] The outbound rules associated with the security group. There is a short interruption during which you cannot connect to the security group.
tags	array	Any tags assigned to the security group.
group_id	string	The group ID of the specified security group.
region	string	AWS region.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	GroupDescription, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all security_groups in a region.

SELECT
region,
group_description,
group_name,
vpc_id,
id,
security_group_ingress,
security_group_egress,
tags,
group_id
FROM aws.ec2.security_groups
WHERE region = 'us-east-1';

Gets all properties from an individual security_group.

SELECT
region,
group_description,
group_name,
vpc_id,
id,
security_group_ingress,
security_group_egress,
tags,
group_id
FROM aws.ec2.security_groups
WHERE region = 'us-east-1' AND data__Identifier = '<Id>';

INSERT example

Use the following StackQL query and manifest file to create a new security_group resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO aws.ec2.security_groups (
 GroupDescription,
 region
)
SELECT 
'{{ GroupDescription }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO aws.ec2.security_groups (
 GroupDescription,
 GroupName,
 VpcId,
 SecurityGroupIngress,
 SecurityGroupEgress,
 Tags,
 region
)
SELECT 
 '{{ GroupDescription }}',
 '{{ GroupName }}',
 '{{ VpcId }}',
 '{{ SecurityGroupIngress }}',
 '{{ SecurityGroupEgress }}',
 '{{ Tags }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: security_group
    props:
      - name: GroupDescription
        value: '{{ GroupDescription }}'
      - name: GroupName
        value: '{{ GroupName }}'
      - name: VpcId
        value: '{{ VpcId }}'
      - name: SecurityGroupIngress
        value:
          - CidrIp: '{{ CidrIp }}'
            CidrIpv6: '{{ CidrIpv6 }}'
            Description: '{{ Description }}'
            FromPort: '{{ FromPort }}'
            SourceSecurityGroupName: '{{ SourceSecurityGroupName }}'
            ToPort: '{{ ToPort }}'
            SourceSecurityGroupOwnerId: '{{ SourceSecurityGroupOwnerId }}'
            IpProtocol: '{{ IpProtocol }}'
            SourceSecurityGroupId: '{{ SourceSecurityGroupId }}'
            SourcePrefixListId: '{{ SourcePrefixListId }}'
      - name: SecurityGroupEgress
        value:
          - CidrIp: '{{ CidrIp }}'
            CidrIpv6: '{{ CidrIpv6 }}'
            Description: '{{ Description }}'
            FromPort: '{{ FromPort }}'
            ToPort: '{{ ToPort }}'
            IpProtocol: '{{ IpProtocol }}'
            DestinationSecurityGroupId: '{{ DestinationSecurityGroupId }}'
            DestinationPrefixListId: '{{ DestinationPrefixListId }}'
      - name: Tags
        value:
          - Key: '{{ Key }}'
            Value: '{{ Value }}'

DELETE example

/*+ delete */
DELETE FROM aws.ec2.security_groups
WHERE data__Identifier = '<Id>'
AND region = 'us-east-1';

Permissions

To operate on the security_groups resource, the following permissions are required:

Read

ec2:DescribeSecurityGroups

Create

ec2:CreateSecurityGroup,
ec2:DescribeSecurityGroups,
ec2:RevokeSecurityGroupEgress,
ec2:AuthorizeSecurityGroupEgress,
ec2:AuthorizeSecurityGroupIngress,
ec2:CreateTags

Update

ec2:RevokeSecurityGroupEgress,
ec2:RevokeSecurityGroupIngress,
ec2:DescribeSecurityGroups,
ec2:AuthorizeSecurityGroupEgress,
ec2:AuthorizeSecurityGroupIngress,
ec2:CreateTags,
ec2:DeleteTags

List

ec2:DescribeSecurityGroups

Delete

ec2:DeleteSecurityGroup,
ec2:DescribeInstances