Crée une règle entrante pour un groupe de sécurité.
Syntaxe
{
"Type": "ALIYUN::ECS::SecurityGroupIngress",
"Properties": {
"SourceGroupOwnerId": String,
"Description": String,
"PortRange": String,
"SecurityGroupId": String,
"NicType": String,
"Ipv6SourceCidrIp": String,
"Priority": Integer,
"SourceGroupId": String,
"Policy": String,
"IpProtocol": String,
"SourcePortRange": String,
"SourceCidrIp": String,
"SourcePrefixListId": String
}
}Propriétés
|
Nom de la propriété |
Type |
Obligatoire |
Modifiable |
Description |
Contraintes |
|
IpProtocol |
String |
Oui |
Non |
Protocole IP. |
Valeurs valides :
|
|
PortRange |
String |
Oui |
Non |
Plage des ports de la couche transport ouverts dans le groupe de sécurité de destination. |
Valeurs valides :
|
|
SourcePrefixListId |
String |
Non |
Non |
ID de la liste de préfixes de destination à utiliser pour le contrôle d'accès entrant. |
Appelez l'opération ECS DescribePrefixLists pour interroger les ID de listes de préfixes disponibles. Non pris en charge pour les groupes de sécurité du réseau classique. Si vous spécifiez SourceCidrIp, Ipv6SourceCidrIp ou SourceGroupId, ce paramètre est ignoré. |
|
SourceGroupId |
String |
Non |
Non |
ID du groupe de sécurité source. |
Vous devez spécifier soit SourceGroupId, soit SourceCidrIp. Si vous spécifiez SourceGroupId sans spécifier SourceCidrIp, NicType est défini sur intranet. Si vous spécifiez à la fois SourceGroupId et SourceCidrIp, le paramètre SourceCidrIp est prioritaire. |
|
SecurityGroupId |
String |
Non |
Non |
ID du groupe de sécurité pour lequel vous souhaitez créer une règle entrante. |
Aucune |
|
NicType |
String |
Non |
Non |
Type de réseau. |
Valeurs valides :
Lorsque vous configurez un accès mutuel entre des groupes de sécurité, par exemple en spécifiant DestGroupId sans spécifier DestCidrIp, la valeur de ce paramètre est intranet. |
|
Priority |
Integer |
Non |
Non |
Priorité de la règle de groupe de sécurité. |
Valeurs valides : de 1 à 100. Valeur par défaut : 1. |
|
SourceCidrIp |
String |
Non |
Non |
Bloc CIDR IPv4 source. |
Seuls les blocs CIDR IPv4 sont pris en charge. |
|
Policy |
String |
Non |
Non |
Politique de contrôle d'accès. |
Valeurs valides :
|
|
SourceGroupOwnerId |
String |
Non |
Non |
ID du compte Alibaba Cloud du propriétaire du groupe de sécurité source. Utilisé pour les règles intercomptes. |
Si SourceGroupOwnerId n'est pas défini, les autorisations d'accès sont configurées par défaut pour vos autres groupes de sécurité. Si vous spécifiez SourceCidrIp, ce paramètre est ignoré. |
|
Description |
String |
Non |
Oui |
Description de la règle de groupe de sécurité. |
Longueur : de 1 à 512 caractères. |
|
SourcePortRange |
String |
Non |
Non |
Plage des ports de la couche transport ouverts dans le groupe de sécurité source. |
Valeurs valides :
|
|
Ipv6SourceCidrIp |
String |
Non |
Non |
Bloc CIDR IPv6 source. |
Prend en charge les blocs CIDR et les adresses IPv6. Réservé au VPC uniquement. |
Valeurs de retour
Fn::GetAtt
Aucune.
Exemples
Scénario 1 : sélectionnez un groupe de sécurité existant et ouvrez le port entrant 3306.
ROSTemplateFormatVersion: '2015-09-01'
Description: Choose an existing security group and open inbound port 3306.
Parameters:
SecurityGroupId:
Type: String
Label: Business Security Group ID
AssociationProperty: ALIYUN::ECS::SecurityGroup::SecurityGroupId
Resources:
SecurityGroupIngress_3306:
Type: ALIYUN::ECS::SecurityGroupIngress
Properties:
SecurityGroupId:
Ref: SecurityGroupId
SourceCidrIp: 0.0.0.0/0
IpProtocol: tcp
NicType: intranet
PortRange: 3306/3306
Outputs: {}
Metadata: {}
{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": "Choose an existing security group and open inbound port 3306.",
"Parameters": {
"SecurityGroupId": {
"Type": "String",
"Label": "Business Security Group ID",
"AssociationProperty": "ALIYUN::ECS::SecurityGroup::SecurityGroupId"
}
},
"Resources": {
"SecurityGroupIngress_3306": {
"Type": "ALIYUN::ECS::SecurityGroupIngress",
"Properties": {
"SecurityGroupId": {
"Ref": "SecurityGroupId"
},
"SourceCidrIp": "0.0.0.0/0",
"IpProtocol": "tcp",
"NicType": "intranet",
"PortRange": "3306/3306"
}
}
},
"Outputs": {
},
"Metadata": {
}
}Scénario 2 : créez un groupe de sécurité et ouvrez le port entrant 80.
ROSTemplateFormatVersion: '2015-09-01'
Description: Create an ECS security group to open inbound port 80.
Parameters:
ZoneId:
Type: String
Label: Availability Zone
AssociationProperty: ALIYUN::ECS::Instance:ZoneId
Resources:
Vpc:
Type: ALIYUN::ECS::VPC
Properties:
CidrBlock: 192.168.0.0/16
VSwitch:
Type: ALIYUN::ECS::VSwitch
Properties:
ZoneId:
Ref: ZoneId
VpcId:
Ref: Vpc
CidrBlock: 192.168.0.0/24
SecurityGroup:
Type: ALIYUN::ECS::SecurityGroup
Properties:
VpcId:
Ref: Vpc
SecurityGroupIngress_80:
Type: ALIYUN::ECS::SecurityGroupIngress
Properties:
SecurityGroupId:
Ref: SecurityGroup
SourceCidrIp: 0.0.0.0/0
IpProtocol: tcp
NicType: intranet
PortRange: 80/80
Outputs: {}
Metadata: {}
{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": "Create an ECS security group to open inbound port 80.",
"Parameters": {
"ZoneId": {
"Type": "String",
"Label": "Availability Zone",
"AssociationProperty": "ALIYUN::ECS::Instance:ZoneId"
}
},
"Resources": {
"Vpc": {
"Type": "ALIYUN::ECS::VPC",
"Properties": {
"CidrBlock": "192.168.0.0/16"
}
},
"VSwitch": {
"Type": "ALIYUN::ECS::VSwitch",
"Properties": {
"ZoneId": {
"Ref": "ZoneId"
},
"VpcId": {
"Ref": "Vpc"
},
"CidrBlock": "192.168.0.0/24"
}
},
"SecurityGroup": {
"Type": "ALIYUN::ECS::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "Vpc"
}
}
},
"SecurityGroupIngress_80": {
"Type": "ALIYUN::ECS::SecurityGroupIngress",
"Properties": {
"SecurityGroupId": {
"Ref": "SecurityGroup"
},
"SourceCidrIp": "0.0.0.0/0",
"IpProtocol": "tcp",
"NicType": "intranet",
"PortRange": "80/80"
}
}
},
"Outputs": {
},
"Metadata": {
}
}Scénario 3 : créez une instance ECS et ouvrez le port entrant 3000 en tant que port de service pour une application Flowise.
ROSTemplateFormatVersion: '2015-09-01'
Description: Create an Ubuntu 22.04 ECS instance, configure security groups and networking, automate the installation of Node.js alongside the Flowise AI agent service, and provision an external access URL.
Parameters:
SystemDiskCategory:
Default: cloud_essd
AssociationProperty: ALIYUN::ECS::Disk::SystemDiskCategory
AssociationPropertyMetadata:
LocaleKey: DiskCategory
AutoChangeType: false
InstanceType: ${InstanceType}
AutoSelectFirst: true
ZoneId: ${ZoneId}
Type: String
Label: System Disk Type
InstanceType:
AssociationProperty: ALIYUN::ECS::Instance::InstanceType
AssociationPropertyMetadata:
DefaultValueStrategy: recent
ZoneId: ${ZoneId}
Type: String
Label: Instance Type
InstancePassword:
AssociationPropertyMetadata:
Visible:
Condition:
Fn::Equals:
- ${SelectInstance}
- false
Description: The logon password for the server. The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters: ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
Default: Null
Type: String
Label: Instance Password
NoEcho: true
AssociationProperty: ALIYUN::ECS::Instance::Password
ConstraintDescription: The logon password for the server. The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters: ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
ZoneId:
AssociationProperty: ALIYUN::ECS::Instance:ZoneId
Type: String
Description: <font color='blue'>This template uses Git to clone the FlowiseAI/Flowise repository from GitHub. You may encounter network issues when you use this template in a region within China. You can switch to a region outside China.</font>
Label: Availability Zone
Outputs:
FlowiseUrl:
Description: The default address for Flowise.
Value:
Fn::Sub:
- http://${IP}:3000
- IP:
Fn::Jq:
- First
- if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else .[0].EipAddress.IpAddress end
- Fn::GetAtt:
- DS_Instances
- Instances
Resources:
SecurityGroupIngress_3000:
Type: ALIYUN::ECS::SecurityGroupIngress
Properties:
IpProtocol: tcp
SecurityGroupId:
Ref: SecurityGroup
NicType: intranet
SourceCidrIp: 0.0.0.0/0
PortRange: 3000/3000
InstanceGroup:
Type: ALIYUN::ECS::InstanceGroup
Properties:
SystemDiskCategory:
Ref: SystemDiskCategory
VpcId:
Ref: Vpc
SecurityGroupId:
Ref: SecurityGroup
ImageId: ubuntu_22_04
IoOptimized: optimized
VSwitchId:
Ref: VSwitch
Password:
Ref: InstancePassword
InstanceName: Flowise
InstanceType:
Ref: InstanceType
MaxAmount: 1
SecurityGroup:
Type: ALIYUN::ECS::SecurityGroup
Properties:
VpcId:
Ref: Vpc
DS_Instances:
Type: DATASOURCE::ECS::Instances
Properties:
InstanceIds:
Fn::GetAtt:
- InstanceGroup
- InstanceIds
Vpc:
Type: ALIYUN::ECS::VPC
Properties:
CidrBlock: 192.168.0.0/16
InstallFlowise:
Type: ALIYUN::ECS::RunCommand
Properties:
CommandContent: |
#!/bin/bash
echo "#########################"
echo "# Install NodeJS"
echo "#########################"
git clone https://github.com/nvm-sh/nvm.git /opt/nvm && cd /opt/nvm
ret_code=$?
if [ $ret_code -ne 0 ]; then
echo "Git clone https://github.com/nvm-sh/nvm.git failed. Exiting."
exit $ret_code
fi
./install.sh
export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
nvm install 22
npm config set registry https://registry.npmmirror.com
npm i -g pnpm
echo "#########################"
echo "# Install Flowise"
echo "#########################"
git clone --depth 1 https://github.com/FlowiseAI/Flowise.git /opt/Flowise && cd /opt/Flowise
ret_code=$?
if [ $ret_code -ne 0 ]; then
echo "Git clone https://github.com/FlowiseAI/Flowise.git failed. Exiting."
exit $ret_code
fi
pnpm install
pnpm build
nohup pnpm start > flowise.log 2>&1 &
Type: RunShellScript
Sync: true
InstanceIds:
Fn::GetAtt:
- InstanceGroup
- InstanceIds
Timeout: 1800
VSwitch:
Type: ALIYUN::ECS::VSwitch
Properties:
VpcId:
Ref: Vpc
CidrBlock: 192.168.0.0/24
ZoneId:
Ref: ZoneId
Metadata: {}
{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": "Create an Ubuntu 22.04 ECS instance, configure security groups and networking, automate the installation of Node.js alongside the Flowise AI agent service, and provision an external access URL.",
"Parameters": {
"SystemDiskCategory": {
"Default": "cloud_essd",
"AssociationProperty": "ALIYUN::ECS::Disk::SystemDiskCategory",
"AssociationPropertyMetadata": {
"LocaleKey": "DiskCategory",
"AutoChangeType": false,
"InstanceType": "${InstanceType}",
"AutoSelectFirst": true,
"ZoneId": "${ZoneId}"
},
"Type": "String",
"Label": "System Disk Type"
},
"InstanceType": {
"AssociationProperty": "ALIYUN::ECS::Instance::InstanceType",
"AssociationPropertyMetadata": {
"DefaultValueStrategy": "recent",
"ZoneId": "${ZoneId}"
},
"Type": "String",
"Label": "Instance Type"
},
"InstancePassword": {
"AssociationPropertyMetadata": {
"Visible": {
"Condition": {
"Fn::Equals": [
"${SelectInstance}",
false
]
}
}
},
"Description": "The logon password for the server. The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters: ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/",
"Default": null,
"Type": "String",
"Label": "Instance Password",
"NoEcho": true,
"AssociationProperty": "ALIYUN::ECS::Instance::Password",
"ConstraintDescription": "The logon password for the server. The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters: ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/"
},
"ZoneId": {
"AssociationProperty": "ALIYUN::ECS::Instance:ZoneId",
"Type": "String",
"Description": "<font color='blue'>This template uses Git to clone the FlowiseAI/Flowise repository from GitHub. You may encounter network issues when you use this template in a region within China. You can switch to a region outside China.</font>",
"Label": "Availability Zone"
}
},
"Outputs": {
"FlowiseUrl": {
"Description": "The default address for Flowise.",
"Value": {
"Fn::Sub": [
"http://${IP}:3000",
{
"IP": {
"Fn::Jq": [
"First",
"if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else .[0].EipAddress.IpAddress end",
{
"Fn::GetAtt": [
"DS_Instances",
"Instances"
]
}
]
}
}
]
}
}
},
"Resources": {
"SecurityGroupIngress_3000": {
"Type": "ALIYUN::ECS::SecurityGroupIngress",
"Properties": {
"IpProtocol": "tcp",
"SecurityGroupId": {
"Ref": "SecurityGroup"
},
"NicType": "intranet",
"SourceCidrIp": "0.0.0.0/0",
"PortRange": "3000/3000"
}
},
"InstanceGroup": {
"Type": "ALIYUN::ECS::InstanceGroup",
"Properties": {
"SystemDiskCategory": {
"Ref": "SystemDiskCategory"
},
"VpcId": {
"Ref": "Vpc"
},
"SecurityGroupId": {
"Ref": "SecurityGroup"
},
"ImageId": "ubuntu_22_04",
"IoOptimized": "optimized",
"VSwitchId": {
"Ref": "VSwitch"
},
"Password": {
"Ref": "InstancePassword"
},
"InstanceName": "Flowise",
"InstanceType": {
"Ref": "InstanceType"
},
"MaxAmount": 1
}
},
"SecurityGroup": {
"Type": "ALIYUN::ECS::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "Vpc"
}
}
},
"DS_Instances": {
"Type": "DATASOURCE::ECS::Instances",
"Properties": {
"InstanceIds": {
"Fn::GetAtt": [
"InstanceGroup",
"InstanceIds"
]
}
}
},
"Vpc": {
"Type": "ALIYUN::ECS::VPC",
"Properties": {
"CidrBlock": "192.168.0.0/16"
}
},
"InstallFlowise": {
"Type": "ALIYUN::ECS::RunCommand",
"Properties": {
"CommandContent": "#!/bin/bash\necho \"#########################\"\necho \"# Install NodeJS\"\necho \"#########################\"\ngit clone https://github.com/nvm-sh/nvm.git /opt/nvm && cd /opt/nvm\nret_code=$?\nif [ $ret_code -ne 0 ]; then\n echo \"Git clone https://github.com/nvm-sh/nvm.git failed. Exiting.\"\n exit $ret_code\nfi\n./install.sh\nexport NVM_DIR=\"$HOME/.nvm\"\n[ -s \"$NVM_DIR/nvm.sh\" ] && \\. \"$NVM_DIR/nvm.sh\"\n[ -s \"$NVM_DIR/bash_completion\" ] && \\. \"$NVM_DIR/bash_completion\"\nnvm install 22\nnpm config set registry https://registry.npmmirror.com\nnpm i -g pnpm\n\necho \"#########################\"\necho \"# Install Flowise\"\necho \"#########################\"\ngit clone --depth 1 https://github.com/FlowiseAI/Flowise.git /opt/Flowise && cd /opt/Flowise\nret_code=$?\nif [ $ret_code -ne 0 ]; then\n echo \"Git clone https://github.com/FlowiseAI/Flowise.git failed. Exiting.\"\n exit $ret_code\nfi\npnpm install\npnpm build\nnohup pnpm start > flowise.log 2>&1 &\n",
"Type": "RunShellScript",
"Sync": true,
"InstanceIds": {
"Fn::GetAtt": [
"InstanceGroup",
"InstanceIds"
]
},
"Timeout": 1800
}
},
"VSwitch": {
"Type": "ALIYUN::ECS::VSwitch",
"Properties": {
"VpcId": {
"Ref": "Vpc"
},
"CidrBlock": "192.168.0.0/24",
"ZoneId": {
"Ref": "ZoneId"
}
}
}
},
"Metadata": {
}
}