# CfnSecurityGroupProps

Properties for defining a `CfnSecurityGroup`.

Extends: CfnSecurityGroupProps
Used as props by: CfnSecurityGroup

- Source: Generated code
- Type last changed: v2.227.0 · 21 Nov 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_ec2 as ec2 } from 'aws-cdk-lib';
const cfnSecurityGroupProps: ec2.CfnSecurityGroupProps = {
  groupDescription: 'groupDescription',

  // the properties below are optional
  groupName: 'groupName',
  securityGroupEgress: [{
    ipProtocol: 'ipProtocol',

    // the properties below are optional
    cidrIp: 'cidrIp',
    cidrIpv6: 'cidrIpv6',
    description: 'description',
    destinationPrefixListId: 'destinationPrefixListId',
    destinationSecurityGroupId: 'destinationSecurityGroupId',
    fromPort: 123,
    toPort: 123,
  }],
  securityGroupIngress: [{
    ipProtocol: 'ipProtocol',

    // the properties below are optional
    cidrIp: 'cidrIp',
    cidrIpv6: 'cidrIpv6',
    description: 'description',
    fromPort: 123,
    sourcePrefixListId: 'sourcePrefixListId',
    sourceSecurityGroupId: 'sourceSecurityGroupId',
    sourceSecurityGroupName: 'sourceSecurityGroupName',
    sourceSecurityGroupOwnerId: 'sourceSecurityGroupOwnerId',
    toPort: 123,
  }],
  tags: [{
    key: 'key',
    value: 'value',
  }],
  vpcId: 'vpcId',
};
```

## Properties

- `groupDescription`: string (required) — A description for the security group.

  Constraints: Up to 255 characters in length

  Valid characters: a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=&;{}!$*

- `groupName`: string — The name of the security group. Names are case-insensitive and must be unique within the VPC.

  Constraints: Up to 255 characters in length. Can't start with `sg-` .

  Valid characters: a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=&;{}!$*

- `securityGroupEgress`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnSecurityGroup.EgressProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnSecurityGroup.EgressProperty.html)[] — The outbound rules associated with the security group.

- `securityGroupIngress`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnSecurityGroup.IngressProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.CfnSecurityGroup.IngressProperty.html)[] — The inbound rules associated with the security group.

- `tags`: [CfnTag](/cdk/api/v2/docs/aws-cdk-lib.CfnTag.html)[] — Any tags assigned to the security group.

- `vpcId`: string | [IVPCRef](/cdk/api/v2/docs/aws-cdk-lib.interfaces.aws_ec2.IVPCRef.html) — The ID of the VPC for the security group.

  If you do not specify a VPC, the default is to use the default VPC for the Region. If there's no specified VPC and no default VPC, security group creation fails.