2017/10/20 - Amazon Elastic Compute Cloud - 1 updated api methods
Changes Adding pagination support for DescribeSecurityGroups for EC2 Classic and VPC Security Groups
{'MaxResults': 'integer', 'NextToken': 'string'}
Response {'NextToken': 'string'}
Describes one or more of your security groups.
A security group is for use with instances either in the EC2-Classic platform or in a specific VPC. For more information, see Amazon EC2 Security Groups in the Amazon Elastic Compute Cloud User Guide and Security Groups for Your VPC in the Amazon Virtual Private Cloud User Guide .
See also: AWS API Documentation
Request Syntax
client.describe_security_groups(
Filters=[
{
'Name': 'string',
'Values': [
'string',
]
},
],
GroupIds=[
'string',
],
GroupNames=[
'string',
],
DryRun=True|False,
NextToken='string',
MaxResults=123
)
list
One or more filters. If using multiple filters for rules, the results include security groups for which any combination of rules - not necessarily a single rule - match all filters.
description - The description of the security group.
egress.ip-permission.prefix-list-id - The ID (prefix) of the AWS service to which the security group allows access.
group-id - The ID of the security group.
group-name - The name of the security group.
ip-permission.cidr - An IPv4 CIDR range that has been granted permission in a security group rule.
ip-permission.from-port - The start of port range for the TCP and UDP protocols, or an ICMP type number.
ip-permission.group-id - The ID of a security group that has been granted permission.
ip-permission.group-name - The name of a security group that has been granted permission.
ip-permission.ipv6-cidr - An IPv6 CIDR range that has been granted permission in a security group rule.
ip-permission.protocol - The IP protocol for the permission (tcp | udp | icmp or a protocol number).
ip-permission.to-port - The end of port range for the TCP and UDP protocols, or an ICMP code.
ip-permission.user-id - The ID of an AWS account that has been granted permission.
owner-id - The AWS account ID of the owner of the security group.
tag-key - The key of a tag assigned to the security group.
tag-value - The value of a tag assigned to the security group.
vpc-id - The ID of the VPC specified when the security group was created.
(dict) --
A filter name and value pair that is used to return a more specific list of results. Filters can be used to match a set of resources by various criteria, such as tags, attributes, or IDs.
Name (string) --
The name of the filter. Filter names are case-sensitive.
Values (list) --
One or more filter values. Filter values are case-sensitive.
(string) --
list
One or more security group IDs. Required for security groups in a nondefault VPC.
Default: Describes all your security groups.
(string) --
list
[EC2-Classic and default VPC only] One or more security group names. You can specify either the security group name or the security group ID. For security groups in a nondefault VPC, use the group-name filter to describe security groups by name.
Default: Describes all your security groups.
(string) --
boolean
Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .
string
The token to request the next page of results.
integer
The maximum number of results to return in a single call. To retrieve the remaining results, make another request with the returned NextToken value. This value can be between 5 and 1000.
dict
Response Syntax
{
'SecurityGroups': [
{
'Description': 'string',
'GroupName': 'string',
'IpPermissions': [
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
'OwnerId': 'string',
'GroupId': 'string',
'IpPermissionsEgress': [
{
'FromPort': 123,
'IpProtocol': 'string',
'IpRanges': [
{
'CidrIp': 'string',
'Description': 'string'
},
],
'Ipv6Ranges': [
{
'CidrIpv6': 'string',
'Description': 'string'
},
],
'PrefixListIds': [
{
'Description': 'string',
'PrefixListId': 'string'
},
],
'ToPort': 123,
'UserIdGroupPairs': [
{
'Description': 'string',
'GroupId': 'string',
'GroupName': 'string',
'PeeringStatus': 'string',
'UserId': 'string',
'VpcId': 'string',
'VpcPeeringConnectionId': 'string'
},
]
},
],
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
],
'VpcId': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
Contains the output of DescribeSecurityGroups.
SecurityGroups (list) --
Information about one or more security groups.
(dict) --
Describes a security group
Description (string) --
A description of the security group.
GroupName (string) --
The name of the security group.
IpPermissions (list) --
One or more inbound rules associated with the security group.
(dict) --
Describes a set of permissions for a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix length.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix length.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
OwnerId (string) --
The AWS account ID of the owner of the security group.
GroupId (string) --
The ID of the security group.
IpPermissionsEgress (list) --
[EC2-VPC] One or more outbound rules associated with the security group.
(dict) --
Describes a set of permissions for a security group rule.
FromPort (integer) --
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of -1 indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.
IpProtocol (string) --
The IP protocol name (tcp , udp , icmp ) or number (see Protocol Numbers ).
[EC2-VPC only] Use -1 to specify all protocols. When authorizing security group rules, specifying -1 or a protocol number other than tcp , udp , icmp , or 58 (ICMPv6) allows traffic on all ports, regardless of any port range you specify. For tcp , udp , and icmp , you must specify a port range. For 58 (ICMPv6), you can optionally specify a port range; if you don't, traffic for all types and codes is allowed when authorizing rules.
IpRanges (list) --
One or more IPv4 ranges.
(dict) --
Describes an IPv4 range.
CidrIp (string) --
The IPv4 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv4 address, use the /32 prefix length.
Description (string) --
A description for the security group rule that references this IPv4 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
Ipv6Ranges (list) --
[EC2-VPC only] One or more IPv6 ranges.
(dict) --
[EC2-VPC only] Describes an IPv6 range.
CidrIpv6 (string) --
The IPv6 CIDR range. You can either specify a CIDR range or a source security group, not both. To specify a single IPv6 address, use the /128 prefix length.
Description (string) --
A description for the security group rule that references this IPv6 address range.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListIds (list) --
(Valid for AuthorizeSecurityGroupEgress , RevokeSecurityGroupEgress and DescribeSecurityGroups only) One or more prefix list IDs for an AWS service. In an AuthorizeSecurityGroupEgress request, this is the AWS service that you want to access through a VPC endpoint from instances associated with the security group.
(dict) --
The ID of the prefix.
Description (string) --
A description for the security group rule that references this prefix list ID.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
PrefixListId (string) --
The ID of the prefix.
ToPort (integer) --
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1 indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.
UserIdGroupPairs (list) --
One or more security group and AWS account ID pairs.
(dict) --
Describes a security group and AWS account ID pair.
Description (string) --
A description for the security group rule that references this user ID group pair.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
GroupId (string) --
The ID of the security group.
GroupName (string) --
The name of the security group. In a request, use this parameter for a security group in EC2-Classic or a default VPC only. For a security group in a nondefault VPC, use the security group ID.
PeeringStatus (string) --
The status of a VPC peering connection, if applicable.
UserId (string) --
The ID of an AWS account. For a referenced security group in another VPC, the account ID of the referenced security group is returned.
[EC2-Classic] Required when adding or removing rules that reference a security group in another AWS account.
VpcId (string) --
The ID of the VPC for the referenced security group, if applicable.
VpcPeeringConnectionId (string) --
The ID of the VPC peering connection, if applicable.
Tags (list) --
Any tags assigned to the security group.
(dict) --
Describes a tag.
Key (string) --
The key of the tag.
Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws:
Value (string) --
The value of the tag.
Constraints: Tag values are case-sensitive and accept a maximum of 255 Unicode characters.
VpcId (string) --
[EC2-VPC] The ID of the VPC for the security group.
NextToken (string) --
The token to use to retrieve the next page of results. This value is null when there are no more results to return.