ACS-ECS-RevokeSecurityGroupRules - CloudOps Orchestration Service: Central de Documentação do Alibaba Cloud

Nome do modelo

ACS-ECS-RevokeSecurityGroupRules

Executar agora

Descrição do modelo

Exclui uma regra de grupo de segurança.

Tipo de modelo

Automatizado

Proprietário

Alibaba Cloud

Parâmetros de entrada

Parâmetro	Descrição	Tipo	Obrigatório	Valor padrão	Limite
securityGroupId	ID do grupo de segurança.	String	Sim
direction	Direção da regra do grupo de segurança.	String	Sim
policy	Política de controle de acesso da regra do grupo de segurança.	String	Sim
portRange	Intervalo de portas.	String	Sim
sourceCidrIp	Bloco CIDR IPv4 de origem.	String	Sim
regionId	ID da região.	String	Não	{{ ACS::RegionId }}
OOSAssumeRole	Função RAM assumida pelo OOS para executar o modelo.	String	Não	""

Parâmetros de saída

Nenhum

Política de permissões necessária para executar o modelo

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "ecs:DescribeSecurityGroupAttribute",
                "ecs:RevokeSecurityGroup"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Referências

Para mais informações, consulte ACS-ECS-RevokeSecurityGroupRules.yml no GitHub.

Conteúdo do modelo

FormatVersion: OOS-2019-06-01
Description:
  en: Del the security gorup rule
  zh-cn: the description in Chinese
  name-en: ACS-ECS-RevokeSecurityGroupRules
  name-zh-cn: the description in Chinese
  categories:
    - instance_manage
    - computenest
Parameters:
  regionId:
    Label:
      en: RegionId
      zh-cn: the description in Chinese
    Type: String
    AssociationProperty: RegionId
    Default: '{{ ACS::RegionId }}'
  securityGroupId:
    Label:
      en: SecurityGroupId
      zh-cn: the description in Chinese
    Type: String
    AssociationProperty: ALIYUN::ECS::SecurityGroup::SecurityGroupId
    AssociationPropertyMetadata:
      regionId: regionId
  direction:
    Label:
      en: Direction
      zh-cn: the description in Chinese
    Description:
      en: <ul class="ul">
        <li class="li" >egress: security group outbound direction</li>
        <li class="li" >ingress: security group incoming direction</li>
        <li class="li">all: direction-insensitive</li></ul>
      zh-cn: <ul class="ul">
        <li class="li" >The description in Chinese</li>
        <li class="li" >The description in Chinese</li>
        <li class="li">The description in Chinese</li></ul>
    Type: String
    AllowedValues:
      - egress
      - ingress
      - all
  policy:
    Label:
      en: Policy
      zh-cn: the description in Chinese
    Description:
      en: <ul class="ul">
        <li class="li">Accept: Accept access</li>
        <li class="li">Arop: Access denied</li>
        </ul>
      zh-cn: <ul class="ul">
        <li class="li">The description in Chinese</li>
        <li class="li">The description in Chinese</li>
        </ul>
    Type: String
    AllowedValues:
      - Accept
      - Drop
  portRange:
    Label:
      en: PortRange
      zh-cn: the description in Chinese
    Description:
      en: 'Use a slash (/) to separate the start and end ports. Example: 1/200, -1/-1, 22/22'
      zh-cn: the description in Chinese Example: 1/200, -1/-1, 22/22
    Type: String
  sourceCidrIp:
    Label:
      en: SourceCidrIp
      zh-cn: the description in Chinese
    Description:
      en: 'Examples: 10.0.0.0/8 and 10.0.0.0/0'
      zh-cn: the description in Chinese
    Type: String
  OOSAssumeRole:
    Label:
      en: OOSAssumeRole
      zh-cn: the description in Chinese
    Type: String
    Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
- Name: describeSecurityGroupRules
  Action: ACS::ExecuteAPI
  Description:
    en: Get security group rules
    zh-cn: the description in Chinese
  Properties:
    Service: ECS
    API: DescribeSecurityGroupAttribute
    Parameters:
      RegionId: '{{ regionId }}'
      SecurityGroupId: '{{ securityGroupId }}'
      Direction: '{{ direction }}'
  Outputs:
    rules:
      Type: Json
      ValueSelector: .Permissions.Permission | map( select(.Policy == "{{ policy }}") ) | map( select(.PortRange == "{{ portRange }}") ) |  map( select(.SourceCidrIp == "{{ sourceCidrIp }}") )
- Name: delSecurityGroupRule
  Action: ACS::ExecuteAPI
  Description:
    en: Delete security group rule
    zh-cn: the description in Chinese
  Properties:
    Service: ECS
    API: RevokeSecurityGroup
    Parameters:
      SecurityGroupId: '{{ securityGroupId }}'
      RegionId: '{{ regionId }}'
      Policy:
        Fn::Select:
          - Policy
          - '{{ ACS::TaskLoopItem }}'
      PortRange:
        Fn::Select:
          - PortRange
          - '{{ ACS::TaskLoopItem }}'
      SourceCidrIp:
        Fn::Select:
          - SourceCidrIp
          - '{{ ACS::TaskLoopItem }}'
      IpProtocol:
        Fn::Select:
          - IpProtocol
          - '{{ ACS::TaskLoopItem }}'
  Loop:
    Items: '{{ describeSecurityGroupRules.rules }}'
    RateControl:
      MaxErrors: 0
      Mode: Concurrency
      Concurrency: 1
Metadata:
  ALIYUN::OOS::Interface:
    ParameterGroups:
      - Parameters:
          - direction
          - policy
          - portRange
          - sourceCidrIp
        Label:
          default:
            zh-cn: the description in Chinese
            en: Configure Parameters
      - Parameters:
          - regionId
          - securityGroupId
        Label:
          default:
            zh-cn: the description in Chinese
            en: Select Security Group
      - Parameters:
          - OOSAssumeRole
        Label:
          default:
            zh-cn: the description in Chinese
            en: Control Options