2017/08/31 - Amazon Elastic Compute Cloud - 2 new 6 updated api methods
Changes Descriptions for Security Group Rules enables customers to be able to define a description for ingress and egress security group rules . The Descriptions for Security Group Rules feature supports one description field per Security Group rule for both ingress and egress rules . Descriptions for Security Group Rules provides a simple way to describe the purpose or function of a Security Group Rule allowing for easier customer identification of configuration elements . Prior to the release of Descriptions for Security Group Rules , customers had to maintain a separate system outside of AWS if they wanted to track Security Group Rule mapping and their purpose for being implemented. If a security group rule has already been created and you would like to update or change your description for that security group rule you can use the UpdateSecurityGroupRuleDescription API.
Updates the description of an ingress (inbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously.
You specify the description as part of the IP permissions structure. You can remove a description for a security group rule by omitting the description parameter in the request.
See also: AWS API Documentation
Request Syntax
client.update_security_group_rule_descriptions_ingress(
DryRun=True|False,
GroupId='string',
GroupName='string',
IpPermissions=[
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
]
)
boolean
Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .
string
The ID of the security group. You must specify either the security group ID or the security group name in the request. For security groups in a nondefault VPC, you must specify the security group ID.
string
[EC2-Classic, default VPC] The name of the security group. You must specify either the security group ID or the security group name in the request.
list
[REQUIRED]
The IP permissions for the security group rule.
(dict) --
Describes a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
dict
Response Syntax
{
'Return': True|False
}
Response Structure
(dict) --
Contains the output of UpdateSecurityGroupRuleDescriptionsIngress.
Return (boolean) --
Returns true if the request succeeds; otherwise, returns an error.
[EC2-VPC only] Updates the description of an egress (outbound) security group rule. You can replace an existing description, or add a description to a rule that did not have one previously.
You specify the description as part of the IP permissions structure. You can remove a description for a security group rule by omitting the description parameter in the request.
See also: AWS API Documentation
Request Syntax
client.update_security_group_rule_descriptions_egress(
DryRun=True|False,
GroupId='string',
GroupName='string',
IpPermissions=[
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
]
)
boolean
Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .
string
The ID of the security group. You must specify either the security group ID or the security group name in the request. For security groups in a nondefault VPC, you must specify the security group ID.
string
[Default VPC] The name of the security group. You must specify either the security group ID or the security group name in the request.
list
[REQUIRED]
The IP permissions for the security group rule.
(dict) --
Describes a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
dict
Response Syntax
{
'Return': True|False
}
Response Structure
(dict) --
Contains the output of UpdateSecurityGroupRuleDescriptionsEgress.
Return (boolean) --
Returns true if the request succeeds; otherwise, returns an error.
{'IpPermissions': {'IpRanges': {'Description': 'string'},
'Ipv6Ranges': {'Description': 'string'},
'PrefixListIds': {'Description': 'string'},
'UserIdGroupPairs': {'Description': 'string'}}}
[EC2-VPC only] Adds one or more egress rules to a security group for use with a VPC. Specifically, this action permits instances to send traffic to one or more destination IPv4 or IPv6 CIDR address ranges, or to one or more destination security groups for the same VPC. This action doesn't apply to security groups for use in EC2-Classic. For more information, see Security Groups for Your VPC in the Amazon Virtual Private Cloud User Guide . For more information about security group limits, see Amazon VPC Limits .
Each rule consists of the protocol (for example, TCP), plus either a CIDR range or a source group. For the TCP and UDP protocols, you must also specify the destination port or port range. For the ICMP protocol, you must also specify the ICMP type and code. You can use -1 for the type or code to mean all types or all codes. You can optionally specify a description for the rule.
Rule changes are propagated to affected instances as quickly as possible. However, a small delay might occur.
See also: AWS API Documentation
Request Syntax
client.authorize_security_group_egress(
DryRun=True|False,
GroupId='string',
IpPermissions=[
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
CidrIp='string',
FromPort=123,
IpProtocol='string',
ToPort=123,
SourceSecurityGroupName='string',
SourceSecurityGroupOwnerId='string'
)
boolean
Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .
string
[REQUIRED]
The ID of the security group.
list
A set of IP permissions. You can't specify a destination security group and a CIDR IP address range.
(dict) --
Describes a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
string
The CIDR IPv4 address range. We recommend that you specify the CIDR range in a set of IP permissions instead.
integer
The start of port range for the TCP and UDP protocols, or an ICMP type number. We recommend that you specify the port range in a set of IP permissions instead.
string
The IP protocol name or number. We recommend that you specify the protocol in a set of IP permissions instead.
integer
The end of port range for the TCP and UDP protocols, or an ICMP type number. We recommend that you specify the port range in a set of IP permissions instead.
string
The name of a destination security group. To authorize outbound access to a destination security group, we recommend that you use a set of IP permissions instead.
string
The AWS account number for a destination security group. To authorize outbound access to a destination security group, we recommend that you use a set of IP permissions instead.
None
{'IpPermissions': {'IpRanges': {'Description': 'string'},
'Ipv6Ranges': {'Description': 'string'},
'PrefixListIds': {'Description': 'string'},
'UserIdGroupPairs': {'Description': 'string'}}}
Adds one or more ingress rules to a security group.
Rule changes are propagated to instances within the security group as quickly as possible. However, a small delay might occur.
[EC2-Classic] This action gives one or more IPv4 CIDR address ranges permission to access a security group in your account, or gives one or more security groups (called the source groups ) permission to access a security group for your account. A source group can be for your own AWS account, or another. You can have up to 100 rules per group.
[EC2-VPC] This action gives one or more IPv4 or IPv6 CIDR address ranges permission to access a security group in your VPC, or gives one or more other security groups (called the source groups ) permission to access a security group for your VPC. The security groups must all be for the same VPC or a peer VPC in a VPC peering connection. For more information about VPC security group limits, see Amazon VPC Limits .
You can optionally specify a description for the security group rule.
See also: AWS API Documentation
Request Syntax
client.authorize_security_group_ingress(
CidrIp='string',
FromPort=123,
GroupId='string',
GroupName='string',
IpPermissions=[
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
IpProtocol='string',
SourceSecurityGroupName='string',
SourceSecurityGroupOwnerId='string',
ToPort=123,
DryRun=True|False
)
string
The CIDR IPv4 address range. You can't specify this parameter when specifying a source security group.
integer
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. For the ICMP/ICMPv6 type number, use -1 to specify all types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
string
The ID of the security group. You must specify either the security group ID or the security group name in the request. For security groups in a nondefault VPC, you must specify the security group ID.
string
[EC2-Classic, default VPC] The name of the security group. You must specify either the security group ID or the security group name in the request.
list
A set of IP permissions. Can be used to specify multiple rules in a single command.
(dict) --
Describes a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
string
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ). (VPC only) Use -1 to specify all protocols. If you specify -1 , or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6), traffic on all ports is allowed, regardless of any ports you specify. For tcp , udp , and icmp , you must specify a port range. For protocol 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed.
string
[EC2-Classic, default VPC] The name of the source security group. You can't specify this parameter in combination with the following parameters: the CIDR IP address range, the start of the port range, the IP protocol, and the end of the port range. Creates rules that grant full ICMP, UDP, and TCP access. To create a rule with a specific IP protocol and port range, use a set of IP permissions instead. For EC2-VPC, the source security group must be in the same VPC.
string
[EC2-Classic] The AWS account number for the source security group, if the source security group is in a different account. You can't specify this parameter in combination with the following parameters: the CIDR IP address range, the IP protocol, the start of the port range, and the end of the port range. Creates rules that grant full ICMP, UDP, and TCP access. To create a rule with a specific IP protocol and port range, use a set of IP permissions instead.
integer
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code number. For the ICMP/ICMPv6 code number, use -1 to specify all codes. If you specify all ICMP/ICMPv6 types, you must specify all codes.
boolean
Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .
None
{'SecurityGroups': {'IpPermissions': {'IpRanges': {'Description': 'string'},
'Ipv6Ranges': {'Description': 'string'},
'PrefixListIds': {'Description': 'string'},
'UserIdGroupPairs': {'Description': 'string'}},
'IpPermissionsEgress': {'IpRanges': {'Description': 'string'},
'Ipv6Ranges': {'Description': 'string'},
'PrefixListIds': {'Description': 'string'},
'UserIdGroupPairs': {'Description': 'string'}}}}
Describes one or more of your security groups.
A security group is for use with instances either in the EC2-Classic platform or in a specific VPC. For more information, see Amazon EC2 Security Groups in the Amazon Elastic Compute Cloud User Guide and Security Groups for Your VPC in the Amazon Virtual Private Cloud User Guide .
See also: AWS API Documentation
Request Syntax
client.describe_security_groups(
Filters=[
{
'Name': 'string',
'Values': [
'string',
]
},
],
GroupIds=[
'string',
],
GroupNames=[
'string',
],
DryRun=True|False
)
list
One or more filters. If using multiple filters for rules, the results include security groups for which any combination of rules - not necessarily a single rule - match all filters.
description - The description of the security group.
egress.ip-permission.prefix-list-id - The ID (prefix) of the AWS service to which the security group allows access.
group-id - The ID of the security group.
group-name - The name of the security group.
ip-permission.cidr - An IPv4 CIDR range that has been granted permission in a security group rule.
ip-permission.from-port - The start of port range for the TCP and UDP protocols, or an ICMP type number.
ip-permission.group-id - The ID of a security group that has been granted permission.
ip-permission.group-name - The name of a security group that has been granted permission.
ip-permission.ipv6-cidr - An IPv6 CIDR range that has been granted permission in a security group rule.
ip-permission.protocol - The IP protocol for the permission (tcp | udp | icmp or a protocol number).
ip-permission.to-port - The end of port range for the TCP and UDP protocols, or an ICMP code.
ip-permission.user-id - The ID of an AWS account that has been granted permission.
owner-id - The AWS account ID of the owner of the security group.
tag-key - The key of a tag assigned to the security group.
tag-value - The value of a tag assigned to the security group.
vpc-id - The ID of the VPC specified when the security group was created.
(dict) --
A filter name and value pair that is used to return a more specific list of results. Filters can be used to match a set of resources by various criteria, such as tags, attributes, or IDs.
Name (string) --
The name of the filter. Filter names are case-sensitive.
Values (list) --
One or more filter values. Filter values are case-sensitive.
(string) --
list
One or more security group IDs. Required for security groups in a nondefault VPC.
Default: Describes all your security groups.
(string) --
list
[EC2-Classic and default VPC only] One or more security group names. You can specify either the security group name or the security group ID. For security groups in a nondefault VPC, use the group-name filter to describe security groups by name.
Default: Describes all your security groups.
(string) --
boolean
Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .
dict
Response Syntax
{
'SecurityGroups': [
{
'Description': 'string',
'GroupName': 'string',
'IpPermissions': [
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
'OwnerId': 'string',
'GroupId': 'string',
'IpPermissionsEgress': [
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'VpcId': 'string'
},
]
}
Response Structure
(dict) --
Contains the output of DescribeSecurityGroups.
SecurityGroups (list) --
Information about one or more security groups.
(dict) --
Describes a security group
Description (string) --
A description of the security group.
GroupName (string) --
The name of the security group.
IpPermissions (list) --
One or more inbound rules associated with the security group.
(dict) --
Describes a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
OwnerId (string) --
The AWS account ID of the owner of the security group.
GroupId (string) --
The ID of the security group.
IpPermissionsEgress (list) --
[EC2-VPC] One or more outbound rules associated with the security group.
(dict) --
Describes a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
Tags (list) --
Any tags assigned to the security group.
(dict) --
Describes a tag.
Key (string) --
The key of the tag.
Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws:
Value (string) --
The value of the tag.
Constraints: Tag values are case-sensitive and accept a maximum of 255 Unicode characters.
VpcId (string) --
[EC2-VPC] The ID of the VPC for the security group.
{'StaleSecurityGroupSet': {'StaleIpPermissions': {'UserIdGroupPairs': {'Description': 'string'}},
'StaleIpPermissionsEgress': {'UserIdGroupPairs': {'Description': 'string'}}}}
[EC2-VPC only] Describes the stale security group rules for security groups in a specified VPC. Rules are stale when they reference a deleted security group in a peer VPC, or a security group in a peer VPC for which the VPC peering connection has been deleted.
See also: AWS API Documentation
Request Syntax
client.describe_stale_security_groups(
DryRun=True|False,
MaxResults=123,
NextToken='string',
VpcId='string'
)
boolean
Checks whether you have the required permissions for the operation, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
integer
The maximum number of items to return for this request. The request returns a token that you can specify in a subsequent call to get the next set of results.
string
The token for the next set of items to return. (You received this token from a prior call.)
string
[REQUIRED]
The ID of the VPC.
dict
Response Syntax
{
'NextToken': 'string',
'StaleSecurityGroupSet': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'StaleIpPermissions': [
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
'string',
],
'PrefixListIds': [
'string',
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
'StaleIpPermissionsEgress': [
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
'string',
],
'PrefixListIds': [
'string',
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
'VpcId': 'string'
},
]
}
Response Structure
(dict) --
NextToken (string) --
The token to use when requesting the next set of items. If there are no additional items to return, the string is empty.
StaleSecurityGroupSet (list) --
Information about the stale security groups.
(dict) --
Describes a stale security group (a security group that contains stale rules).
Description (string) --
The description of the security group.
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group.
StaleIpPermissions (list) --
Information about the stale inbound rules in the security group.
(dict) --
Describes a stale rule in a security group.
FromPort (integer) --
The start of the port range for the TCP and UDP protocols, or an ICMP type number. A value of -1 indicates all ICMP types.
IpProtocol (string) --
The IP protocol name (for tcp , udp , and icmp ) or number (see Protocol Numbers) .
IpRanges (list) --
One or more IP ranges. Not applicable for stale security group rules.
(string) --
PrefixListIds (list) --
One or more prefix list IDs for an AWS service. Not applicable for stale security group rules.
(string) --
ToPort (integer) --
The end of the port range for the TCP and UDP protocols, or an ICMP type number. A value of -1 indicates all ICMP types.
UserIdGroupPairs (list) --
One or more security group pairs. Returns the ID of the referenced security group and VPC, and the ID and status of the VPC peering connection.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
StaleIpPermissionsEgress (list) --
Information about the stale outbound rules in the security group.
(dict) --
Describes a stale rule in a security group.
FromPort (integer) --
The start of the port range for the TCP and UDP protocols, or an ICMP type number. A value of -1 indicates all ICMP types.
IpProtocol (string) --
The IP protocol name (for tcp , udp , and icmp ) or number (see Protocol Numbers) .
IpRanges (list) --
One or more IP ranges. Not applicable for stale security group rules.
(string) --
PrefixListIds (list) --
One or more prefix list IDs for an AWS service. Not applicable for stale security group rules.
(string) --
ToPort (integer) --
The end of the port range for the TCP and UDP protocols, or an ICMP type number. A value of -1 indicates all ICMP types.
UserIdGroupPairs (list) --
One or more security group pairs. Returns the ID of the referenced security group and VPC, and the ID and status of the VPC peering connection.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
VpcId (string) --
The ID of the VPC for the security group.
{'IpPermissions': {'IpRanges': {'Description': 'string'},
'Ipv6Ranges': {'Description': 'string'},
'PrefixListIds': {'Description': 'string'},
'UserIdGroupPairs': {'Description': 'string'}}}
[EC2-VPC only] Removes one or more egress rules from a security group for EC2-VPC. This action doesn't apply to security groups for use in EC2-Classic. To remove a rule, the values that you specify (for example, ports) must match the existing rule's values exactly.
Each rule consists of the protocol and the IPv4 or IPv6 CIDR range or source security group. For the TCP and UDP protocols, you must also specify the destination port or range of ports. For the ICMP protocol, you must also specify the ICMP type and code. If the security group rule has a description, you do not have to specify the description to revoke the rule.
Rule changes are propagated to instances within the security group as quickly as possible. However, a small delay might occur.
See also: AWS API Documentation
Request Syntax
client.revoke_security_group_egress(
DryRun=True|False,
GroupId='string',
IpPermissions=[
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
CidrIp='string',
FromPort=123,
IpProtocol='string',
ToPort=123,
SourceSecurityGroupName='string',
SourceSecurityGroupOwnerId='string'
)
boolean
Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .
string
[REQUIRED]
The ID of the security group.
list
A set of IP permissions. You can't specify a destination security group and a CIDR IP address range.
(dict) --
Describes a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
string
The CIDR IP address range. We recommend that you specify the CIDR range in a set of IP permissions instead.
integer
The start of port range for the TCP and UDP protocols, or an ICMP type number. We recommend that you specify the port range in a set of IP permissions instead.
string
The IP protocol name or number. We recommend that you specify the protocol in a set of IP permissions instead.
integer
The end of port range for the TCP and UDP protocols, or an ICMP type number. We recommend that you specify the port range in a set of IP permissions instead.
string
The name of a destination security group. To revoke outbound access to a destination security group, we recommend that you use a set of IP permissions instead.
string
The AWS account number for a destination security group. To revoke outbound access to a destination security group, we recommend that you use a set of IP permissions instead.
None
{'IpPermissions': {'IpRanges': {'Description': 'string'},
'Ipv6Ranges': {'Description': 'string'},
'PrefixListIds': {'Description': 'string'},
'UserIdGroupPairs': {'Description': 'string'}}}
Removes one or more ingress rules from a security group. To remove a rule, the values that you specify (for example, ports) must match the existing rule's values exactly.
Note
[EC2-Classic security groups only] If the values you specify do not match the existing rule's values, no error is returned. Use DescribeSecurityGroups to verify that the rule has been removed.
Each rule consists of the protocol and the CIDR range or source security group. For the TCP and UDP protocols, you must also specify the destination port or range of ports. For the ICMP protocol, you must also specify the ICMP type and code. If the security group rule has a description, you do not have to specify the description to revoke the rule.
Rule changes are propagated to instances within the security group as quickly as possible. However, a small delay might occur.
See also: AWS API Documentation
Request Syntax
client.revoke_security_group_ingress(
CidrIp='string',
FromPort=123,
GroupId='string',
GroupName='string',
IpPermissions=[
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
IpProtocol='string',
SourceSecurityGroupName='string',
SourceSecurityGroupOwnerId='string',
ToPort=123,
DryRun=True|False
)
string
The CIDR IP address range. You can't specify this parameter when specifying a source security group.
integer
The start of port range for the TCP and UDP protocols, or an ICMP type number. For the ICMP type number, use -1 to specify all ICMP types.
string
The ID of the security group. Required for a security group in a nondefault VPC.
string
[EC2-Classic, default VPC] The name of the security group.
list
A set of IP permissions. You can't specify a source security group and a CIDR IP address range.
(dict) --
Describes a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
string
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ). Use -1 to specify all.
string
[EC2-Classic, default VPC] The name of the source security group. You can't specify this parameter in combination with the following parameters: the CIDR IP address range, the start of the port range, the IP protocol, and the end of the port range. For EC2-VPC, the source security group must be in the same VPC. To revoke a specific rule for an IP protocol and port range, use a set of IP permissions instead.
string
[EC2-Classic] The AWS account ID of the source security group, if the source security group is in a different account. You can't specify this parameter in combination with the following parameters: the CIDR IP address range, the IP protocol, the start of the port range, and the end of the port range. To revoke a specific rule for an IP protocol and port range, use a set of IP permissions instead.
integer
The end of port range for the TCP and UDP protocols, or an ICMP code number. For the ICMP code number, use -1 to specify all ICMP codes for the ICMP type.
boolean
Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .
None