Class CfnSecurityGroupIngress
- All Implemented Interfaces:
IConstruct
,IDependable
,IInspectable
,software.amazon.jsii.JsiiSerializable
,software.constructs.IConstruct
AWS::EC2::SecurityGroupIngress
.
Adds an inbound rule to a security group.
An inbound rule permits instances to receive traffic from the specified IPv4 or IPv6 CIDR address range, or from the instances associated with the specified security group.
You must specify only one of the following properties: CidrIp
, CidrIpv6
, SourcePrefixListId
, SourceSecurityGroupId
, or SourceSecurityGroupName
.
You specify a protocol for each rule (for example, TCP). For TCP and UDP, you must also specify a port or port range. For ICMP/ICMPv6, you must also specify the ICMP/ICMPv6 type and code. You can use -1 to mean all types or all codes.
You must specify a source security group ( SourcePrefixListId
, SourceSecurityGroupId
, or SourceSecurityGroupName
) or a CIDR range ( CidrIp
or CidrIpv6
). If you do not specify one of these parameters, the stack will launch successfully but the rule will not be added to the security group.
Rule changes are propagated to instances within the security group as quickly as possible. However, a small delay might occur.
Example:
// The code below shows an example of how to instantiate this type. // The values are placeholders you should change. import software.amazon.awscdk.services.ec2.*; CfnSecurityGroupIngress cfnSecurityGroupIngress = CfnSecurityGroupIngress.Builder.create(this, "MyCfnSecurityGroupIngress") .ipProtocol("ipProtocol") // the properties below are optional .cidrIp("cidrIp") .cidrIpv6("cidrIpv6") .description("description") .fromPort(123) .groupId("groupId") .groupName("groupName") .sourcePrefixListId("sourcePrefixListId") .sourceSecurityGroupId("sourceSecurityGroupId") .sourceSecurityGroupName("sourceSecurityGroupName") .sourceSecurityGroupOwnerId("sourceSecurityGroupOwnerId") .toPort(123) .build();
-
Nested Class Summary
Modifier and TypeClassDescriptionstatic final class
A fluent builder forCfnSecurityGroupIngress
.Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject
software.amazon.jsii.JsiiObject.InitializationMode
Nested classes/interfaces inherited from interface software.amazon.awscdk.core.IConstruct
IConstruct.Jsii$Default
Nested classes/interfaces inherited from interface software.constructs.IConstruct
software.constructs.IConstruct.Jsii$Default
Nested classes/interfaces inherited from interface software.amazon.awscdk.core.IInspectable
IInspectable.Jsii$Default, IInspectable.Jsii$Proxy
-
Field Summary
Modifier and TypeFieldDescriptionstatic final String
The CloudFormation resource type name for this resource class. -
Constructor Summary
ModifierConstructorDescriptionCfnSecurityGroupIngress
(Construct scope, String id, CfnSecurityGroupIngressProps props) Create a newAWS::EC2::SecurityGroupIngress
.protected
CfnSecurityGroupIngress
(software.amazon.jsii.JsiiObject.InitializationMode initializationMode) protected
CfnSecurityGroupIngress
(software.amazon.jsii.JsiiObjectRef objRef) -
Method Summary
Modifier and TypeMethodDescriptionThe IPv4 address range, in CIDR format.The IPv6 address range, in CIDR format.Updates the description of an ingress (inbound) security group rule.The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number.The ID of the security group.The name of the security group.The ID of a prefix list.The ID of the security group.[Default VPC] The name of the source security group.[nondefault VPC] The AWS account ID for the source security group, if the source security group is in a different account.The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.void
inspect
(TreeInspector inspector) Examines the CloudFormation resource and discloses attributes.renderProperties
(Map<String, Object> props) void
The IPv4 address range, in CIDR format.void
setCidrIpv6
(String value) The IPv6 address range, in CIDR format.void
setDescription
(String value) Updates the description of an ingress (inbound) security group rule.void
setFromPort
(Number value) The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number.void
setGroupId
(String value) The ID of the security group.void
setGroupName
(String value) The name of the security group.void
setIpProtocol
(String value) void
setSourcePrefixListId
(String value) The ID of a prefix list.void
setSourceSecurityGroupId
(String value) The ID of the security group.void
setSourceSecurityGroupName
(String value) [Default VPC] The name of the source security group.void
[nondefault VPC] The AWS account ID for the source security group, if the source security group is in a different account.void
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.Methods inherited from class software.amazon.awscdk.core.CfnResource
addDeletionOverride, addDependsOn, addMetadata, addOverride, addPropertyDeletionOverride, addPropertyOverride, applyRemovalPolicy, applyRemovalPolicy, applyRemovalPolicy, getAtt, getCfnOptions, getCfnResourceType, getMetadata, getUpdatedProperites, isCfnResource, shouldSynthesize, toString, validateProperties
Methods inherited from class software.amazon.awscdk.core.CfnRefElement
getRef
Methods inherited from class software.amazon.awscdk.core.CfnElement
getCreationStack, getLogicalId, getStack, isCfnElement, overrideLogicalId
Methods inherited from class software.amazon.awscdk.core.Construct
getNode, isConstruct, onPrepare, onSynthesize, onValidate, prepare, synthesize, validate
Methods inherited from class software.amazon.jsii.JsiiObject
jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait
Methods inherited from interface software.amazon.jsii.JsiiSerializable
$jsii$toJson
-
Field Details
-
CFN_RESOURCE_TYPE_NAME
The CloudFormation resource type name for this resource class.
-
-
Constructor Details
-
CfnSecurityGroupIngress
protected CfnSecurityGroupIngress(software.amazon.jsii.JsiiObjectRef objRef) -
CfnSecurityGroupIngress
protected CfnSecurityGroupIngress(software.amazon.jsii.JsiiObject.InitializationMode initializationMode) -
CfnSecurityGroupIngress
@Stability(Stable) public CfnSecurityGroupIngress(@NotNull Construct scope, @NotNull String id, @NotNull CfnSecurityGroupIngressProps props) Create a newAWS::EC2::SecurityGroupIngress
.- Parameters:
scope
-- scope in which this resource is defined.
id
-- scoped id of the resource.
props
-- resource properties.
-
-
Method Details
-
inspect
Examines the CloudFormation resource and discloses attributes.- Specified by:
inspect
in interfaceIInspectable
- Parameters:
inspector
-- tree inspector to collect and process attributes.
-
renderProperties
@Stability(Stable) @NotNull protected Map<String,Object> renderProperties(@NotNull Map<String, Object> props) - Overrides:
renderProperties
in classCfnResource
- Parameters:
props
- This parameter is required.
-
getCfnProperties
- Overrides:
getCfnProperties
in classCfnResource
-
getIpProtocol
The IP protocol name (tcp
,udp
,icmp
,icmpv6
) or number (see Protocol Numbers ).Use
-1
to specify all protocols. When authorizing security group rules, specifying-1
or a protocol number other thantcp
,udp
,icmp
, oricmpv6
allows traffic on all ports, regardless of any port range you specify. Fortcp
,udp
, andicmp
, you must specify a port range. Foricmpv6
, the port range is optional; if you omit the port range, traffic for all types and codes is allowed. -
setIpProtocol
The IP protocol name (tcp
,udp
,icmp
,icmpv6
) or number (see Protocol Numbers ).Use
-1
to specify all protocols. When authorizing security group rules, specifying-1
or a protocol number other thantcp
,udp
,icmp
, oricmpv6
allows traffic on all ports, regardless of any port range you specify. Fortcp
,udp
, andicmp
, you must specify a port range. Foricmpv6
, the port range is optional; if you omit the port range, traffic for all types and codes is allowed. -
getCidrIp
The IPv4 address range, in CIDR format.You must specify a source security group (
SourcePrefixListId
orSourceSecurityGroupId
) or a CIDR range (CidrIp
orCidrIpv6
).For examples of rules that you can add to security groups for specific access scenarios, see Security group rules for different use cases in the Amazon EC2 User Guide .
-
setCidrIp
The IPv4 address range, in CIDR format.You must specify a source security group (
SourcePrefixListId
orSourceSecurityGroupId
) or a CIDR range (CidrIp
orCidrIpv6
).For examples of rules that you can add to security groups for specific access scenarios, see Security group rules for different use cases in the Amazon EC2 User Guide .
-
getCidrIpv6
The IPv6 address range, in CIDR format.You must specify a source security group (
SourcePrefixListId
orSourceSecurityGroupId
) or a CIDR range (CidrIp
orCidrIpv6
).For examples of rules that you can add to security groups for specific access scenarios, see Security group rules for different use cases in the Amazon EC2 User Guide .
-
setCidrIpv6
The IPv6 address range, in CIDR format.You must specify a source security group (
SourcePrefixListId
orSourceSecurityGroupId
) or a CIDR range (CidrIp
orCidrIpv6
).For examples of rules that you can add to security groups for specific access scenarios, see Security group rules for different use cases in the Amazon EC2 User Guide .
-
getDescription
Updates the description of an ingress (inbound) security group rule.You can replace an existing description, or add a description to a rule that did not have one previously.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
-
setDescription
Updates the description of an ingress (inbound) security group rule.You can replace an existing description, or add a description to a rule that did not have one previously.
Constraints: Up to 255 characters in length. Allowed characters are a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=;{}!$*
-
getFromPort
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number.A value of
-1
indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.Use this for ICMP and any protocol that uses ports.
-
setFromPort
The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number.A value of
-1
indicates all ICMP/ICMPv6 types. If you specify all ICMP/ICMPv6 types, you must specify all codes.Use this for ICMP and any protocol that uses ports.
-
getGroupId
The ID of the security group. -
setGroupId
The ID of the security group. -
getGroupName
The name of the security group.Constraints: Up to 255 characters in length. Cannot start with
sg-
.Valid characters: a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=&;{}!$*
-
setGroupName
The name of the security group.Constraints: Up to 255 characters in length. Cannot start with
sg-
.Valid characters: a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=&;{}!$*
-
getSourcePrefixListId
The ID of a prefix list. -
setSourcePrefixListId
The ID of a prefix list. -
getSourceSecurityGroupId
The ID of the security group.You must specify either the security group ID or the security group name. For security groups in a nondefault VPC, you must specify the security group ID.
-
setSourceSecurityGroupId
The ID of the security group.You must specify either the security group ID or the security group name. For security groups in a nondefault VPC, you must specify the security group ID.
-
getSourceSecurityGroupName
[Default VPC] The name of the source security group.You must specify either the security group ID or the security group name. You can't specify the group name in combination with an IP address range. Creates rules that grant full ICMP, UDP, and TCP access.
For security groups in a nondefault VPC, you must specify the group ID.
-
setSourceSecurityGroupName
[Default VPC] The name of the source security group.You must specify either the security group ID or the security group name. You can't specify the group name in combination with an IP address range. Creates rules that grant full ICMP, UDP, and TCP access.
For security groups in a nondefault VPC, you must specify the group ID.
-
getSourceSecurityGroupOwnerId
[nondefault VPC] The AWS account ID for the source security group, if the source security group is in a different account.You can't specify this property with an IP address range. Creates rules that grant full ICMP, UDP, and TCP access.
If you specify
SourceSecurityGroupName
orSourceSecurityGroupId
and that security group is owned by a different account than the account creating the stack, you must specifySourceSecurityGroupOwnerId
; otherwise, this property is optional. -
setSourceSecurityGroupOwnerId
[nondefault VPC] The AWS account ID for the source security group, if the source security group is in a different account.You can't specify this property with an IP address range. Creates rules that grant full ICMP, UDP, and TCP access.
If you specify
SourceSecurityGroupName
orSourceSecurityGroupId
and that security group is owned by a different account than the account creating the stack, you must specifySourceSecurityGroupOwnerId
; otherwise, this property is optional. -
getToPort
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.A value of
-1
indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.Use this for ICMP and any protocol that uses ports.
-
setToPort
The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.A value of
-1
indicates all ICMP/ICMPv6 codes for the specified ICMP type. If you specify all ICMP/ICMPv6 types, you must specify all codes.Use this for ICMP and any protocol that uses ports.
-