CloudOps Orchestration Service:ACS-ECS-BulkyAuthorizeSecurityGroup

Template name

ACS-ECS-BulkyAuthorizeSecurityGroup: Adds a security group rule to multiple security groups at a time.

Run now

Template description

Adds a security group rule to multiple security groups at a time.

Template type

Automation

Owner

Alibaba Cloud

Input parameters

Parameter name	Description	Type	Required	Default value	Constraints
securityGroupIds	The IDs of the security groups.	List	Yes
ipProtocol	The transport layer protocol.	String	Yes
portRange	The port range for the transport layer protocol.	String	Yes
sourceCidrIp	The source IPv4 CIDR block. Example: 10.0.0.0/8.	String	Yes
regionId	The region ID.	String	No	{{ ACS::RegionId }}
nicType	The NIC type.	String	No	intranet
policy	The access policy. Valid values: accept (allows access) and drop (denies access).	String	No	accept
priority	The priority of the security group rule. Valid values: 1 to 100.	Number	No	1
rateControl	The concurrency control settings for task execution.	Json	No	{‘Mode’: ‘Concurrency’, ‘MaxErrors’: 0, ‘Concurrency’: 10}
OOSAssumeRole	The RAM role assumed by Operation Orchestration Service (OOS).	String	No	“”

Output parameters

None

Required permissions for this template

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:AuthorizeSecurityGroup"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Details

ACS-ECS-BulkyAuthorizeSecurityGroup details

Template content

FormatVersion: OOS-2019-06-01
Description:
  en: Adds a security group policy to multiple security groups.
  name-en: ACS-ECS-BulkyAuthorizeSecurityGroup
  categories:
    - instance_manage
    - computenest
Parameters:
  regionId:
    Type: String
    Label:
      en: Region ID
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  securityGroupIds:
    Label:
      en: Security Group IDs
    Type: List
    AssociationProperty: ALIYUN::ECS::SecurityGroup::SecurityGroupId
  ipProtocol:
    Label:
      en: IP Protocol
    Type: String
    AllowedValues:
      - tcp
      - udp
      - icmp
      - gre
      - all
  portRange:
    Label:
      en: Port Range
    Description:
      en: 'The port range. Correct format: 1/200. Incorrect format: 200/1. The valid port range is 1 to 65535 for TCP and UDP protocols. For ICMP, GRE, or when IpProtocol is set to all, the port range must be -1/-1.'
    Type: String
  nicType:
    Label:
      en: NIC Type
    Description:
      en: 'The network interface controller (NIC) type. Valid values: internet (public NIC) and intranet (internal NIC).'
    Type: String
    AllowedValues:
      - internet
      - intranet
    Default: intranet
  policy:
    Label:
      en: Policy
    Description:
      en: 'The access policy. Valid values: accept (allows access) and drop (denies access).'
    Type: String
    AllowedValues:
      - accept
      - drop
    Default: accept
  priority:
    Label:
      en: Priority
    Description:
      en: 'The priority of the security group rule. Valid values: 1 to 100.'
    Type: Number
    MinValue: 1
    MaxValue: 100
    Default: 1
  sourceCidrIp:
    Label:
      en: Source CIDR Block
    Description:
      en: 'The source IPv4 CIDR block. Example: 10.0.0.0/8.'
    Type: String
  rateControl:
    Label:
      en: Rate Control
    Description:
      en: 'The concurrency rate for task execution.'
    Type: Json
    AssociationProperty: RateControl
    Default:
      Mode: Concurrency
      MaxErrors: 0
      Concurrency: 10
  OOSAssumeRole:
    Label:
      en: OOS Assume Role
    Description:
      en: 'The RAM role that OOS assumes.'
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
  - Name: AuthorizeSecurityGroup
    Action: 'ACS::ExecuteAPI'
    Description:
      en: Adds a security group policy to multiple security groups.
    Properties:
      Service: ECS
      API: AuthorizeSecurityGroup
      Parameters:
        RegionId: '{{ regionId }}'
        IpProtocol: '{{ ipProtocol }}'
        PortRange: '{{ portRange }}'
        NicType: '{{ nicType }}'
        Policy: '{{ policy }}'
        Priority: '{{ priority }}'
        SourceCidrIp: '{{ sourceCidrIp }}'
        SecurityGroupId: '{{ ACS::TaskLoopItem }}'
    Loop:
      RateControl: '{{ rateControl }}'
      Items: '{{ securityGroupIds }}'
Metadata:
  ALIYUN::OOS::Interface:
    ParameterGroups:
      - Parameters:
          - regionId
          - securityGroupIds
          - ipProtocol
          - portRange
          - nicType
          - policy
          - priority
          - sourceCidrIp
        Label:
          default:
            en: Configure Parameters
      - Parameters:
          - rateControl
          - OOSAssumeRole
        Label:
          default:
            en: Control Options