Security Group Ingress Rule Args
Manages an inbound (ingress) rule for a security group. When specifying an inbound rule for your security group in a VPC, the configuration must include a source for the traffic.
NOTE: Using
aws.vpc.SecurityGroupEgressRule
andaws.vpc.SecurityGroupIngressRule
resources is the current best practice. Avoid using theaws.ec2.SecurityGroupRule
resource and theingress
andegress
arguments of theaws.ec2.SecurityGroup
resource for configuring in-line rules, as they struggle with managing multiple CIDR blocks, and tags and descriptions due to the historical lack of unique IDs. !>WARNING: You should not use theaws.vpc.SecurityGroupEgressRule
andaws.vpc.SecurityGroupIngressRule
resources in conjunction with theaws.ec2.SecurityGroup
resource with in-line rules (using theingress
andegress
arguments ofaws.ec2.SecurityGroup
) or theaws.ec2.SecurityGroupRule
resource. Doing so may cause rule conflicts, perpetual differences, and result in rules being overwritten.
Example Usage
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.ec2.SecurityGroup("example", {
name: "example",
description: "example",
vpcId: main.id,
tags: {
Name: "example",
},
});
const exampleSecurityGroupIngressRule = new aws.vpc.SecurityGroupIngressRule("example", {
securityGroupId: example.id,
cidrIpv4: "10.0.0.0/8",
fromPort: 80,
ipProtocol: "tcp",
toPort: 80,
});
import pulumi
import pulumi_aws as aws
example = aws.ec2.SecurityGroup("example",
name="example",
description="example",
vpc_id=main["id"],
tags={
"Name": "example",
})
example_security_group_ingress_rule = aws.vpc.SecurityGroupIngressRule("example",
security_group_id=example.id,
cidr_ipv4="10.0.0.0/8",
from_port=80,
ip_protocol="tcp",
to_port=80)
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var example = new Aws.Ec2.SecurityGroup("example", new()
{
Name = "example",
Description = "example",
VpcId = main.Id,
Tags =
{
{ "Name", "example" },
},
});
var exampleSecurityGroupIngressRule = new Aws.Vpc.SecurityGroupIngressRule("example", new()
{
SecurityGroupId = example.Id,
CidrIpv4 = "10.0.0.0/8",
FromPort = 80,
IpProtocol = "tcp",
ToPort = 80,
});
});
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/ec2"
"github.com/pulumi/pulumi-aws/sdk/v6/go/aws/vpc"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
example, err := ec2.NewSecurityGroup(ctx, "example", &ec2.SecurityGroupArgs{
Name: pulumi.String("example"),
Description: pulumi.String("example"),
VpcId: pulumi.Any(main.Id),
Tags: pulumi.StringMap{
"Name": pulumi.String("example"),
},
})
if err != nil {
return err
}
_, err = vpc.NewSecurityGroupIngressRule(ctx, "example", &vpc.SecurityGroupIngressRuleArgs{
SecurityGroupId: example.ID(),
CidrIpv4: pulumi.String("10.0.0.0/8"),
FromPort: pulumi.Int(80),
IpProtocol: pulumi.String("tcp"),
ToPort: pulumi.Int(80),
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.ec2.SecurityGroup;
import com.pulumi.aws.ec2.SecurityGroupArgs;
import com.pulumi.aws.vpc.SecurityGroupIngressRule;
import com.pulumi.aws.vpc.SecurityGroupIngressRuleArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new SecurityGroup("example", SecurityGroupArgs.builder()
.name("example")
.description("example")
.vpcId(main.id())
.tags(Map.of("Name", "example"))
.build());
var exampleSecurityGroupIngressRule = new SecurityGroupIngressRule("exampleSecurityGroupIngressRule", SecurityGroupIngressRuleArgs.builder()
.securityGroupId(example.id())
.cidrIpv4("10.0.0.0/8")
.fromPort(80)
.ipProtocol("tcp")
.toPort(80)
.build());
}
}
resources:
example:
type: aws:ec2:SecurityGroup
properties:
name: example
description: example
vpcId: ${main.id}
tags:
Name: example
exampleSecurityGroupIngressRule:
type: aws:vpc:SecurityGroupIngressRule
name: example
properties:
securityGroupId: ${example.id}
cidrIpv4: 10.0.0.0/8
fromPort: 80
ipProtocol: tcp
toPort: 80
Import
Using pulumi import
, import security group ingress rules using the security_group_rule_id
. For example:
$ pulumi import aws:vpc/securityGroupIngressRule:SecurityGroupIngressRule example sgr-02108b27edd666983
Constructors
Properties
The security group rule description.
The IP protocol name or number. Use -1
to specify all protocols. Note that if ip_protocol
is set to -1
, it translates to all protocols, all port ranges, and from_port
and to_port
values should not be defined.
The ID of the source prefix list.
The source security group that is referenced in the rule.
The ID of the security group.