Easily Manage Security Group Rules with the New Security Group Rule ID

At AWS, we tirelessly innovate to let you give attention to your online business, not its underlying IT infrastructure. Generally we launch a brand new service or a serious functionality. Generally we give attention to particulars that make your skilled life simpler.

At this time, I’m completely satisfied to announce one in every of these small particulars that makes a distinction: VPC safety group rule IDs.

A safety group acts as a digital firewall in your cloud assets, equivalent to an Amazon Elastic Compute Cloud (Amazon EC2) occasion or a Amazon Relational Database Service (RDS) database. It controls ingress and egress community visitors. Safety teams are made up of safety group guidelines, a mixture of protocol, supply or vacation spot IP tackle and port quantity, and an elective description.

Whenever you use the AWS Command Line Interface (CLI) or API to switch a safety group rule, you should specify all these parts to determine the rule. This produces lengthy CLI instructions which are cumbersome to kind or learn and error-prone. For instance:

aws ec2 revoke-security-group-egress 
         --group-id sg-0xxx6          
         --ip-permissions IpProtocol=tcp, FromPort=22, ToPort=22, IpRanges="[CidrIp=192.168.0.0/0, ]"

What’s New?
A safety group rule ID is an distinctive identifier for a safety group rule. Whenever you add a rule to a safety group, these identifiers are created and added to safety group guidelines mechanically. Safety group IDs are distinctive in an AWS Area. Right here is the Edit inbound guidelines web page of the Amazon VPC console:

As talked about already, whenever you create a rule, the identifier is added mechanically. For instance, once I’m utilizing the CLI:

aws ec2 authorize-security-group-egress                                  
        --group-id sg-0xxx6                                              
        --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=22,           
                         IpRanges=[CidrIp=1.2.3.4/32]
        --tag-specifications                                             
                         ResourceType="security-group-rule",             
                         "Tags": [                                      
                           "Key": "usage", "Value": "bastion"            
                         ]

The up to date AuthorizeSecurityGroupEgress API motion now returns particulars in regards to the safety group rule, together with the safety group rule ID:

"SecurityGroupRules": [
    
        "SecurityGroupRuleId": "sgr-abcdefghi01234561",
        "GroupId": "sg-0xxx6",
        "GroupOwnerId": "6800000000003",
        "IsEgress": false,
        "IpProtocol": "tcp",
        "FromPort": 22,
        "ToPort": 22,
        "CidrIpv4": "1.2.3.4/32",
        "Tags": [
            
        ]
    
]

We’re additionally including two API actions: DescribeSecurityGroupRules and ModifySecurityGroupRules to the VPC APIs. You need to use these to checklist or modify safety group guidelines respectively.

What are the advantages ?
The primary good thing about a safety group rule ID is simplifying your CLI instructions. For instance, the RevokeSecurityGroupEgress command used earlier could be now be expressed as:

aws ec2 revoke-security-group-egress 
         --group-id sg-0xxx6         
         --security-group-rule-ids "sgr-abcdefghi01234561"

Shorter and simpler, isn’t it?

The second profit is that safety group guidelines can now be tagged, identical to many different AWS assets. You need to use tags to rapidly checklist or determine a set of safety group guidelines, throughout a number of safety teams.

Within the earlier instance, I used the tag-on-create method so as to add tags with --tag-specifications on the time I created the safety group rule. I may add tags at a later stage, on an current safety group rule, utilizing its ID:

aws ec2 create-tags                         
        --resources sgr-abcdefghi01234561   
        --tags "Key=utilization,Worth=bastion"

Let’s say my firm authorizes entry to a set of EC2 cases, however solely when the community connection is initiated from an on-premises bastion host. The safety group rule can be IpProtocol=tcp, FromPort=22, ToPort=22, IpRanges="[]" the place 1.2.three.four is the IP tackle of the on-premises bastion host. This rule could be replicated in lots of safety teams.

What if the on-premises bastion host IP tackle adjustments? I would like to vary the IpRanges parameter in all of the affected guidelines. By tagging the safety group guidelines with utilization : bastion, I can now use the DescribeSecurityGroupRules API motion to checklist the safety group guidelines utilized in my AWS account’s safety teams, after which filter the outcomes on the utilization : bastion tag. By doing so, I used to be in a position to rapidly determine the safety group guidelines I need to replace.

aws ec2 describe-security-group-rules 
        --max-results 100 
        --filters "Identify=tag-key,Values=utilization" --filters "Identify=tag-value,Values=bastion" 

This provides me the next output:

    "SecurityGroupRules": [
        
    ],
    "NextToken": "ey...J9"

As regular, you’ll be able to handle outcomes pagination by issuing the identical API name once more passing the worth of NextToken with --next-token.

Availability
Safety group rule IDs can be found for VPC safety teams guidelines, in all industrial AWS Areas, for free of charge.

It would appear like a small, incremental change, however this truly creates the muse for future extra capabilities to handle safety teams and safety group guidelines. Keep tuned!

— seb