| « PreviousNext » | |
  | Did this page help you? Yes | No | Tell us about it... |
ec2-authorize
Description
Adds a rule to a security group.
Important
EC2-Classic: You can have up to 100 rules per group.
EC2-VPC: You can have up to 50 rules per group (covering both ingress and egress).
A security group is for use with instances either in the EC2-Classic platform or in a specific VPC. EC2-Classic doesn't support rules for egress traffic. For more information, see Amazon EC2 Security Groups in the Amazon Elastic Compute Cloud User Guide and Security Groups for Your VPC in the Amazon Virtual Private Cloud User Guide.
Each rule consists of the protocol (for example, TCP), plus either a CIDR range, or a source group (for ingress rules) or destination group (for egress rules). For TCP and UDP, you must also specify the destination port or port ranges. You can specify -1 to mean all ports (i.e., port range 0-65535). For ICMP, you must also specify the ICMP type and code. You can use -1 for the type or code to mean all types or all codes.
EC2-Classic: This command either gives one or more CIDR IP address ranges permission to access a security group for your account, or it gives one or more security groups (called the source groups) permission to access a security group for your account. A source group can be for your own AWS account, or another.
EC2-VPC: For ingress rules, this command either gives one or more CIDR IP address ranges permission to access a security group for your VPC, or it gives one or more other security groups (called the source groups) permission to access a security group for your VPC. The groups must all be in the same VPC. For egress rules, this command permits instances in the VPC to send traffic to either one or more destination CIDR IP address ranges, or to one or more destination security groups for the same VPC.
Rule changes are propagated to affected instances as quickly as possible. However, a small delay might occur.
The short version of this command is ec2auth.
Syntax
ec2-authorize
group [--egress] [-P
protocol] (-p
port_range | -t
icmp_type_code) [-u
source_or_dest_group_owner ...] [-o
source_or_dest_group ...] [-s
source_or_dest_cidr ...]
Options
| Name | Description | |
|---|---|---|
|
|
[EC2-Classic, default VPC] The name or ID of the security group. [nondefault VPC] The ID of the security group. The group must belong to your AWS account. Type: String Default: None Required: Yes Example: websrv | |
--egress
|
[EC2-VPC] Designates the rule as an egress rule (controls traffic leaving the VPC). Default: If this option is not specified, the rule applies to ingress traffic for the specified security group. | |
|
|
The IP protocol name or number (see Protocol Numbers). Security groups for EC2-Classic can have rules only for TCP, UDP, and ICMP, whereas security groups for EC2-VPC can have rules assigned to any protocol number. When you use ec2-describe-group, the protocol value returned is
the number. Exception: For TCP, UDP, and ICMP, the value
returned is the name ( Type: String Valid values for EC2-Classic: Default for EC2-Classic: Defaults to TCP if source CIDR is specified (or implied by default), or all three protocols (TCP, UDP, and ICMP) if source group is specified (to ensure backwards compatibility). Valid values for EC2-VPC: Required: Conditional Condition: Required for EC2-VPC. Example: -P udp | |
|
|
For TCP or UDP: The range of ports to allow. Type: String Default: None Valid values: A single integer or a range (min-max). You can specify -1 to mean all ports (for example, port range 0-65535). Required: Conditional Condition: Required if specifying Example: -p 80-84 | |
|
|
For ICMP: The ICMP type and code. Use the format
Type: String Default: None Required: Conditional Condition: Required if specifying Example: -t -1:-1 | |
|
|
The ID of the AWS account that owns the source security group. If the group is in your own account, set this to your own AWS account ID. Cannot be used when specifying a CIDR IP address. Type: String Default: None Required: Conditional Condition: For EC2-Classic: Required when adding a rule that gives access to one or more source security groups. Example: -u 111122223333 | |
|
|
The source security group (for ingress rules), or destination security group (for egress rules). You can't use this option when specifying a CIDR IP address with the -s option. [nondefault VPC] You must specify the ID of the group (for example, sg-1a2b3c4d) instead of its name. Type: String Default: None Required: Conditional Condition: Required if giving access to one or more source or destination security groups. Example: -o headoffice | |
|
|
The CIDR range. Cannot be used when specifying a source or destination security group with the -o option. Type: String Default: 0.0.0.0/0 Constraints: Valid CIDR IP address range. Required: Conditional Condition: Required if giving access to one or more IP address ranges. Example: -s 205.192.8.45/24 |
Common Options
| Option | Description |
|---|---|
|
|
Overrides the region specified by the Default: The value of the Example: |
|
|
The uniform resource locator (URL) of the Amazon EC2 web service entry point. Default: The value of the Example: |
|
|
The private key that identifies you to Amazon EC2. For more information, see Tell the Tools Who You Are. Default: The value of the Example: |
|
|
The X.509 certificate that identifies you to Amazon EC2. Default: The value of the Example: |
|
|
The access key ID associated with your AWS account. For more information, see Tell the Tools Who You Are. Default: The value of the Example: Note For more information, see the following section, Deprecated Options. |
|
|
The secret access key associated with your AWS account. Default: The value of the Example: Note For more information, see the following section, Deprecated Options. |
|
|
The AWS delegation token. Default: The value of the environment variable (if set). |
|
|
The connection timeout, in seconds. Example: |
|
|
The request timeout, in seconds. Example: |
|
|
Displays verbose output, including the API request and response on the command line. This is useful if you are building tools to talk directly to our Query API. |
|
|
Includes column headers in the command output. |
|
|
Shows empty columns as |
|
|
Omits tags for tagged resources. |
|
|
Displays internal debugging information. This can assist us when helping you troubleshooting problems. |
|
|
Displays usage information for the command. |
|
|
Reads arguments from standard input. This is useful when piping the output from one command to the input of another. Example: |
Deprecated Options
For a limited time, you can still use the private key and X.509 certificate instead of your access key ID and secret access key. However, we recommend that you start using your access key ID (-O, --aws-access-key) and secret access key (-W, --aws-secret-key) now, as the private key (-K, --private-key) and X.509 certificate (-C, --cert) won't be supported after the transition period elapses. For more information, see Tell the Tools Who You Are.
| Option | Description |
|---|---|
|
|
The private key to use when constructing requests to Amazon EC2. Default: The value of the Example: |
|
|
The X.509 certificate to use when constructing requests to Amazon EC2. Default: The value of the Example: |
Output
This command returns a table that contains the following information:
A line containing the group information. Some of these fields may be blank.
The GROUP identifier
The ID of the security group
The AWS account ID of the owner of the security group
The name of the security group
A description of the security group
[VPC only] The ID of the VPC the group belongs to
One of each of the following lines for each permission defined by the group:
The PERMISSION identifier
The AWS account ID of the owner of the group
The name of the group granting permission
The type of rule. Currently, only ALLOWS rules are supported
The protocol to allow (e.g.
tcp,udp, etc)The start of port range
The end of port range
FROM for an ingress rule or TO for an egress rule
The source type (for ingress rules) or destination type (for egress rules)
The source (for ingress rules) or destination (for egress rules)
[USER only] The name of the source or destination entity
[USER only] The group ID
Whether the rule is ingress rule or an egress rule
Amazon EC2 command line tools display errors on stderr.
Examples
Example Request
EC2 security groups: This example grants TCP port 80 access from the 192.0.2.0/24 address
range to the EC2 security group called websrv.
PROMPT> ec2-authorize websrv -P tcp -p 80 -s 192.0.2.0/24
GROUP websrv
PERMISSION websrv ALLOWS tcp 80 80 FROM CIDR 192.0.2.0/24 ingressExample Request
EC2 security groups: This example grants TCP port 80 access from the EC2 source group
called OtherAccountGroup (in AWS account 111122223333) to
your EC2 security group called websrv.
PROMPT> ec2-authorize websrv -P tcp -p 80 -u 111122223333 -o OtherAccountGroup
GROUP websrv
PERMISSION websrv ALLOWS tcp 80 80 FROM USER 111122223333 NAME OtherAccountGroup ingressExample Request
[EC2-VPC] This example grants TCP port 80 access from the 192.0.2.0/24 address range to
the security group with ID sg-1a2b3c4d.
PROMPT> ec2-authorize sg-1a2b3c4d -P tcp -p 80 -s 192.0.2.0/24
GROUP sg-1a2b3c4d
PERMISSION ALLOWS tcp 80 80 FROM CIDR 192.0.2.0/24 ingressExample Request
[EC2-VPC] This example grants egress access from the group sg-1a2b3c4d to
the destination group sg-2a2b3c4d on TCP destination port
1433.
PROMPT> ec2-authorize --egress sg-1a2b3c4d -P tcp -p 1433 -o sg-2a2b3c4d
GROUP sg-1a2b3c4d
PERMISSION ALLOWS tcp 1433 1433 TO USER ID sg-2a2b3c4d egress
