SecurityGroup

class aws_cdk.aws_ec2.SecurityGroup(scope, id, *, vpc, allow_all_outbound=None, description=None, security_group_name=None)

Bases: aws_cdk.core.Resource

Creates an Amazon EC2 security group within a VPC.

Security Groups act like a firewall with a set of rules, and are associated with any AWS resource that has or creates Elastic Network Interfaces (ENIs). A typical example of a resource that has a security group is an Instance (or Auto Scaling Group of instances)

If you are defining new infrastructure in CDK, there is a good chance you won’t have to interact with this class at all. Like IAM Roles, Security Groups need to exist to control access between AWS resources, but CDK will automatically generate and populate them with least-privilege permissions for you so you can concentrate on your business logic.

All Constructs that require Security Groups will create one for you if you don’t specify one at construction. After construction, you can selectively allow connections to and between constructs via–for example– the instance.connections object. Think of it as “allowing connections to your instance”, rather than “adding ingress rules a security group”. See the Allowing Connections section in the library documentation for examples.

Direct manipulation of the Security Group through addIngressRule and addEgressRule is possible, but mutation through the .connections object is recommended. If you peer two constructs with security groups this way, appropriate rules will be created in both.

If you have an existing security group you want to use in your CDK application, you would import it like this:

# Example automatically generated without compilation. See https://github.com/aws/jsii/issues/826
security_group = SecurityGroup.from_security_group_id(self, "SG", "sg-12345",
    mutable=False
)
__init__(scope, id, *, vpc, allow_all_outbound=None, description=None, security_group_name=None)
Parameters
  • scope (Construct) –

  • id (str) –

  • vpc (IVpc) – The VPC in which to create the security group.

  • allow_all_outbound (Optional[bool]) – Whether to allow all outbound traffic by default. If this is set to true, there will only be a single egress rule which allows all outbound traffic. If this is set to false, no outbound traffic will be allowed by default and all egress traffic must be explicitly authorized. Default: true

  • description (Optional[str]) – A description of the security group. Default: The default name will be the construct’s CDK path.

  • security_group_name (Optional[str]) – The name of the security group. For valid values, see the GroupName parameter of the CreateSecurityGroup action in the Amazon EC2 API Reference. It is not recommended to use an explicit group name. Default: If you don’t specify a GroupName, AWS CloudFormation generates a unique physical ID and uses that ID for the group name.

Return type

None

Methods

add_egress_rule(peer, connection, description=None, remote_rule=None)

Add an egress rule for the current security group.

remoteRule controls where the Rule object is created if the peer is also a securityGroup and they are in different stack. If false (default) the rule object is created under the current SecurityGroup object. If true and the peer is also a SecurityGroup, the rule object is created under the remote SecurityGroup object.

Parameters
  • peer (IPeer) –

  • connection (Port) –

  • description (Optional[str]) –

  • remote_rule (Optional[bool]) –

Return type

None

add_ingress_rule(peer, connection, description=None, remote_rule=None)

Add an ingress rule for the current security group.

remoteRule controls where the Rule object is created if the peer is also a securityGroup and they are in different stack. If false (default) the rule object is created under the current SecurityGroup object. If true and the peer is also a SecurityGroup, the rule object is created under the remote SecurityGroup object.

Parameters
  • peer (IPeer) –

  • connection (Port) –

  • description (Optional[str]) –

  • remote_rule (Optional[bool]) –

Return type

None

to_egress_rule_config()

Produce the egress rule JSON for the given connection.

Return type

Any

to_ingress_rule_config()

Produce the ingress rule JSON for the given connection.

Return type

Any

to_string()

Returns a string representation of this construct.

Return type

str

Attributes

allow_all_outbound

Whether the SecurityGroup has been configured to allow all outbound traffic.

Return type

bool

can_inline_rule

Whether the rule can be inlined into a SecurityGroup or not.

Return type

bool

connections
Return type

Connections

default_port
Return type

Optional[Port]

node

Construct tree node which offers APIs for interacting with the construct tree.

Return type

ConstructNode

security_group_id

The ID of the security group.

attribute: :attribute:: true

Return type

str

security_group_name

An attribute that represents the security group name.

attribute: :attribute:: true

Return type

str

security_group_vpc_id

The VPC ID this security group is part of.

attribute: :attribute:: true

Return type

str

stack

The stack in which this resource is defined.

Return type

Stack

unique_id

A unique identifier for this connection peer.

Return type

str

Static Methods

classmethod from_security_group_id(scope, id, security_group_id, *, allow_all_outbound=None, mutable=None)

Import an existing security group into this app.

Parameters
  • scope (Construct) –

  • id (str) –

  • security_group_id (str) –

  • allow_all_outbound (Optional[bool]) – Mark the SecurityGroup as having been created allowing all outbound traffic. Only if this is set to false will egress rules be added to this security group. Be aware, this would undo any potential “all outbound traffic” default. Default: true

  • mutable (Optional[bool]) – If a SecurityGroup is mutable CDK can add rules to existing groups. Beware that making a SecurityGroup immutable might lead to issue due to missing ingress/egress rules for new resources. Default: true

Return type

ISecurityGroup

classmethod is_construct(x)

Return whether the given object is a Construct.

Parameters

x (Any) –

Return type

bool

classmethod is_security_group(x)

Return whether the indicated object is a security group.

Parameters

x (Any) –

Return type

bool