SecurityGroup

class aws_cdk.aws_ec2.SecurityGroup(scope, id, *, vpc, allow_all_outbound=None, description=None, security_group_name=None)

Bases: aws_cdk.core.Resource

Creates an Amazon EC2 security group within a VPC.

This class has an additional optimization over imported security groups that it can also create inline ingress and egress rule (which saves on the total number of resources inside the template).

__init__(scope, id, *, vpc, allow_all_outbound=None, description=None, security_group_name=None)
Parameters
  • scope (Construct) –

  • id (str) –

  • props

  • vpc (IVpc) – The VPC in which to create the security group.

  • allow_all_outbound (Optional[bool]) – Whether to allow all outbound traffic by default. If this is set to true, there will only be a single egress rule which allows all outbound traffic. If this is set to false, no outbound traffic will be allowed by default and all egress traffic must be explicitly authorized. Default: true

  • description (Optional[str]) – A description of the security group. Default: The default name will be the construct’s CDK path.

  • security_group_name (Optional[str]) – The name of the security group. For valid values, see the GroupName parameter of the CreateSecurityGroup action in the Amazon EC2 API Reference. It is not recommended to use an explicit group name. Default: If you don’t specify a GroupName, AWS CloudFormation generates a unique physical ID and uses that ID for the group name.

Return type

None

Methods

add_egress_rule(peer, connection, description=None, remote_rule=None)

Add an egress rule for the current security group.

remoteRule controls where the Rule object is created if the peer is also a securityGroup and they are in different stack. If false (default) the rule object is created under the current SecurityGroup object. If true and the peer is also a SecurityGroup, the rule object is created under the remote SecurityGroup object.

Parameters
  • peer (IPeer) –

  • connection (Port) –

  • description (Optional[str]) –

  • remote_rule (Optional[bool]) –

Return type

None

add_ingress_rule(peer, connection, description=None, remote_rule=None)

Add an ingress rule for the current security group.

remoteRule controls where the Rule object is created if the peer is also a securityGroup and they are in different stack. If false (default) the rule object is created under the current SecurityGroup object. If true and the peer is also a SecurityGroup, the rule object is created under the remote SecurityGroup object.

Parameters
  • peer (IPeer) –

  • connection (Port) –

  • description (Optional[str]) –

  • remote_rule (Optional[bool]) –

Return type

None

to_egress_rule_config()

Produce the egress rule JSON for the given connection.

Return type

Any

to_ingress_rule_config()

Produce the ingress rule JSON for the given connection.

Return type

Any

to_string()

Returns a string representation of this construct.

Return type

str

Attributes

can_inline_rule

Whether the rule can be inlined into a SecurityGroup or not.

Return type

bool

connections
Return type

Connections

default_port
Return type

Optional[Port]

node

Construct tree node which offers APIs for interacting with the construct tree.

Return type

ConstructNode

security_group_id

The ID of the security group.

attribute: :attribute:: true

Return type

str

security_group_name

An attribute that represents the security group name.

attribute: :attribute:: true

Return type

str

security_group_vpc_id

The VPC ID this security group is part of.

attribute: :attribute:: true

Return type

str

stack

The stack in which this resource is defined.

Return type

Stack

unique_id

A unique identifier for this connection peer.

Return type

str

Static Methods

classmethod from_security_group_id(scope, id, security_group_id, *, allow_all_outbound=None, mutable=None)

Import an existing security group into this app.

Parameters
  • scope (Construct) –

  • id (str) –

  • security_group_id (str) –

  • options

  • allow_all_outbound (Optional[bool]) – Mark the SecurityGroup as having been created allowing all outbound traffic. Only if this is set to false will egress rules be added to this security group. Be aware, this would undo any potential “all outbound traffic” default. Default: true

  • mutable (Optional[bool]) – If a SecurityGroup is mutable CDK can add rules to existing groups. Beware that making a SecurityGroup immutable might lead to issue due to missing ingress/egress rules for new resources. Default: true

Return type

ISecurityGroup

classmethod is_construct(x)

Return whether the given object is a Construct.

Parameters

x (Any) –

Return type

bool

classmethod is_security_group(x)

Return whether the indicated object is a security group.

Parameters

x (Any) –

Return type

bool