O recurso ALIYUN::ECS::SecurityGroupEgresses associa várias regras de saída a um grupo de segurança simultaneamente.
Sintaxe
{
"Type": "ALIYUN::ECS::SecurityGroupEgresses",
"Properties": {
"SecurityGroupId": String,
"Permissions": List
}
}Propriedades
|
Propriedade |
Tipo |
Obrigatória |
Editável |
Descrição |
Restrição |
|
Permissions |
List |
Sim |
Sim |
Configurações de regras de saída para associar ao grupo de segurança. |
É possível associar até 100 regras de saída. Para mais informações, consulte Propriedades de Permissions. |
|
SecurityGroupId |
String |
Sim |
Não |
ID do grupo de segurança de source. |
Nenhuma. |
Sintaxe de Permissions
"Permissions": [
{
"Policy": String,
"Description": String,
"SourcePortRange": String,
"Priority": Integer,
"Ipv6SourceCidrIp": String,
"NicType": String,
"DestGroupId": String,
"PortRange": String,
"DestGroupOwnerAccount": String,
"DestPrefixListId": String,
"SourceCidrIp": String,
"DestGroupOwnerId": String,
"IpProtocol": String,
"DestCidrIp": String,
"Ipv6DestCidrIp": String
}
]Propriedades de Permissions
|
Propriedade |
Tipo |
Obrigatória |
Editável |
Descrição |
Restrição |
|
IpProtocol |
String |
Sim |
Não |
Protocolo da camada de transporte. |
Valores válidos:
|
|
PortRange |
String |
Sim |
Não |
Intervalo de portas de destino do protocolo da camada de transporte. |
|
|
Description |
String |
Não |
Não |
Descrição da regra. |
De 1 a 512 caracteres. |
|
DestCidrIp |
String |
Não |
Não |
Bloco CIDR IPv4 de destino. |
Somente IPv4. |
|
DestGroupId |
String |
Não |
Não |
ID do grupo de segurança de destino referenciado na regra. |
Especifique pelo menos um entre DestGroupId e DestCidrIp. Se especificar DestGroupId sem DestCidrIp, defina NicType como intranet. Se ambos forem especificados, DestCidrIp terá precedência. |
|
DestGroupOwnerAccount |
String |
Não |
Não |
E-mail da conta Alibaba Cloud proprietária do grupo de segurança de destino. |
Exemplo: T***@example.com. |
|
DestGroupOwnerId |
String |
Não |
Não |
ID da conta Alibaba Cloud proprietária do grupo de segurança de destino para regras entre contas. |
Se estiver vazio, a regra controlará o acesso a um grupo de segurança na sua conta. Se DestCidrIp for especificado, DestGroupOwnerId será ignorado. |
|
DestPrefixListId |
String |
Não |
Não |
ID da lista de prefixos de destino referenciada na regra. |
Chame a API DescribePrefixLists para consultar os IDs das listas de prefixos disponíveis. Se o grupo de segurança estiver na rede clássica, não será possível referenciar listas de prefixos na regra. Para mais informações, consulte Limites. Se DestCidrIp, Ipv6DestCidrIp ou DestGroupId for especificado, DestPrefixListId será ignorado. |
|
Ipv6DestCidrIp |
String |
Não |
Não |
Bloco CIDR IPv6 de destino. |
Somente endereços IPv6 do tipo VPC. |
|
Ipv6SourceCidrIp |
String |
Não |
Não |
Bloco CIDR IPv6 de source. |
Somente endereços IPv6 do tipo VPC. |
|
NicType |
String |
Não |
Não |
Tipo de NIC. |
Valores válidos:
Se especificar DestGroupId sem DestCidrIp, defina NicType como intranet. |
|
Policy |
String |
Não |
Não |
Ação de controle de acesso. |
Valores válidos:
|
|
Priority |
Integer |
Não |
Não |
Prioridade da regra. |
Valores válidos: 1 a 100. Valor padrão: 1. |
|
SourceCidrIp |
String |
Não |
Não |
Intervalo de endereços IPv4 de source. |
Somente IPv4. |
|
SourcePortRange |
String |
Não |
Não |
Intervalo de portas de source do protocolo da camada de transporte. |
|
Valores de retorno
Fn::GetAtt
Nenhum.
Exemplos
Formato YAML
ROSTemplateFormatVersion: '2015-09-01'
Parameters:
SecurityGroupId:
AssociationPropertyMetadata:
VpcId: ${VpcId}
AssociationProperty: ALIYUN::ECS::SecurityGroup::SecurityGroupId
Type: String
Description:
en: Id of the security group.
Required: true
Permissions:
AssociationPropertyMetadata:
Parameters:
Policy:
Type: String
Description:
en: 'Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept.'
AllowedValues:
- accept
- drop
Required: false
Description:
AssociationProperty: TextArea
Type: String
Description:
en: Description of the security group rule, [1, 512] characters. The default is empty.
Required: false
MinLength: 1
MaxLength: 512
SourcePortRange:
Type: String
Description:
en: 'The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1.'
Required: false
Priority:
Type: Number
Description:
en: Authorization policies priority range[1, 100]
Required: false
MinValue: 1
MaxValue: 100
Default: 1
Ipv6SourceCidrIp:
Type: String
Description:
en: |-
Source IPv6 CIDR address segment. Supports IP address ranges in CIDR format and IPv6 format.
Note Only VPC type IP addresses are supported.
Required: false
NicType:
Type: String
Description:
en: Network type, could be 'internet' or 'intranet'. Default value is internet.
AllowedValues:
- internet
- intranet
Required: false
DestGroupId:
Type: String
Description:
en: |-
The destination security group ID to which access permissions need to be set.
Set at least one of the DestGroupId, DestCidrIp, Ipv6DestCidrIp, or DestPrefixListId parameters.
- If DestGroupId is specified without the DestCidrIp parameter, the NicType parameter can only take the value intranet.
- If both DestGroupId and DestCidrIp are specified, DestCidrIp is assumed to prevail.
You should pay attention to:
- Enterprise Security groups do not support authorized security group access.
- The maximum number of authorized security groups supported by ordinary security groups is 20.
Required: false
PortRange:
Type: String
Description:
en: Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'
Required: true
DestGroupOwnerAccount:
Type: String
Description:
en: |-
When setting security group rules across accounts, the Ali cloud account to which the destination security group belongs.
- If neither DestGroupOwnerAccount nor DestGroupOwnerId is set, it is considered to set access permissions for your other security group.
- If the parameter DestCidrIp has been set, the parameter DestGroupOwnerAccount is invalid.
Required: false
DestPrefixListId:
Type: String
Description:
en: |-
The ID of the destination prefix list to which you want to control access. You can call the DescribePrefixLists operation to query the IDs of available prefix lists. Take note of the following items:
If a security group is in the classic network, you cannot configure prefix lists in the security group rules. For information about the limits on security groups and prefix lists, see the "Security group limits" in Limits.
If you specify DestCidrIp, Ipv6DestCidrIp, or DestGroupId, DestPrefixListId is ignored.
Required: false
SourceCidrIp:
Type: String
Description:
en: The source IPv4 CIDR block to which you want to control access. CIDR blocks and IPv4 addresses are supported.
Required: false
DestGroupOwnerId:
Type: String
Description:
en: |-
When setting security group rules across accounts, the Ali Cloud account ID of the destination security group.
- If neither DestGroupOwnerId nor DestGroupOwnerAccount is set, it is considered to set the access rights of your other security group.
- If you have set the parameter DestCidrIp, the parameter DestGroupOwnerId is invalid.
Required: false
IpProtocol:
Type: String
Description:
en: Ip protocol for in rule.
AllowedValues:
- tcp
- udp
- icmp
- gre
- all
- icmpv6
Required: true
DestCidrIp:
Type: String
Description:
en: The destination IPv4 CIDR block to which you want to control access. CIDR blocks and IPv4 addresses are supported.
Required: false
Ipv6DestCidrIp:
Type: String
Description:
en: Destination IPv6 CIDR address block for which access rights need to be set. CIDR format and IPv6 format IP address range are supported.
Required: false
AssociationProperty: List[Parameters]
Type: Json
Description:
en: A list of security group rules. A hundred at most.
Required: true
MaxLength: 100
Resources:
SecurityGroupEgresses:
Type: ALIYUN::ECS::SecurityGroupEgresses
Properties:
SecurityGroupId:
Ref: SecurityGroupId
Permissions:
Ref: Permissions
Formato JSON
{
"ROSTemplateFormatVersion": "2015-09-01",
"Parameters": {
"SecurityGroupId": {
"AssociationPropertyMetadata": {
"VpcId": "${VpcId}"
},
"AssociationProperty": "ALIYUN::ECS::SecurityGroup::SecurityGroupId",
"Type": "String",
"Description": {
"en": "Id of the security group."
},
"Required": true
},
"Permissions": {
"AssociationPropertyMetadata": {
"Parameters": {
"Policy": {
"Type": "String",
"Description": {
"en": "Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept."
},
"AllowedValues": [
"accept",
"drop"
],
"Required": false
},
"Description": {
"AssociationProperty": "TextArea",
"Type": "String",
"Description": {
"en": "Description of the security group rule, [1, 512] characters. The default is empty."
},
"Required": false,
"MinLength": 1,
"MaxLength": 512
},
"SourcePortRange": {
"Type": "String",
"Description": {
"en": "The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1."
},
"Required": false
},
"Priority": {
"Type": "Number",
"Description": {
"en": "Authorization policies priority range[1, 100]"
},
"Required": false,
"MinValue": 1,
"MaxValue": 100,
"Default": 1
},
"Ipv6SourceCidrIp": {
"Type": "String",
"Description": {
"en": "Source IPv6 CIDR address segment. Supports IP address ranges in CIDR format and IPv6 format.\nNote Only VPC type IP addresses are supported."
},
"Required": false
},
"NicType": {
"Type": "String",
"Description": {
"en": "Network type, could be 'internet' or 'intranet'. Default value is internet."
},
"AllowedValues": [
"internet",
"intranet"
],
"Required": false
},
"DestGroupId": {
"Type": "String",
"Description": {
"en": "The destination security group ID to which access permissions need to be set.\nSet at least one of the DestGroupId, DestCidrIp, Ipv6DestCidrIp, or DestPrefixListId parameters.\n- If DestGroupId is specified without the DestCidrIp parameter, the NicType parameter can only take the value intranet.\n- If both DestGroupId and DestCidrIp are specified, DestCidrIp is assumed to prevail.\nYou should pay attention to:\n- Enterprise Security groups do not support authorized security group access.\n- The maximum number of authorized security groups supported by ordinary security groups is 20."
},
"Required": false
},
"PortRange": {
"Type": "String",
"Description": {
"en": "Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'"
},
"Required": true
},
"DestGroupOwnerAccount": {
"Type": "String",
"Description": {
"en": "When setting security group rules across accounts, the Ali cloud account to which the destination security group belongs.\n- If neither DestGroupOwnerAccount nor DestGroupOwnerId is set, it is considered to set access permissions for your other security group.\n- If the parameter DestCidrIp has been set, the parameter DestGroupOwnerAccount is invalid."
},
"Required": false
},
"DestPrefixListId": {
"Type": "String",
"Description": {
"en": "The ID of the destination prefix list to which you want to control access. You can call the DescribePrefixLists operation to query the IDs of available prefix lists. Take note of the following items:\nIf a security group is in the classic network, you cannot configure prefix lists in the security group rules. For information about the limits on security groups and prefix lists, see the \"Security group limits\" in Limits.\nIf you specify DestCidrIp, Ipv6DestCidrIp, or DestGroupId, DestPrefixListId is ignored."
},
"Required": false
},
"SourceCidrIp": {
"Type": "String",
"Description": {
"en": "The source IPv4 CIDR block to which you want to control access. CIDR blocks and IPv4 addresses are supported."
},
"Required": false
},
"DestGroupOwnerId": {
"Type": "String",
"Description": {
"en": "When setting security group rules across accounts, the Ali Cloud account ID of the destination security group.\n- If neither DestGroupOwnerId nor DestGroupOwnerAccount is set, it is considered to set the access rights of your other security group.\n- If you have set the parameter DestCidrIp, the parameter DestGroupOwnerId is invalid."
},
"Required": false
},
"IpProtocol": {
"Type": "String",
"Description": {
"en": "Ip protocol for in rule."
},
"AllowedValues": [
"tcp",
"udp",
"icmp",
"gre",
"all",
"icmpv6"
],
"Required": true
},
"DestCidrIp": {
"Type": "String",
"Description": {
"en": "The destination IPv4 CIDR block to which you want to control access. CIDR blocks and IPv4 addresses are supported."
},
"Required": false
},
"Ipv6DestCidrIp": {
"Type": "String",
"Description": {
"en": "Destination IPv6 CIDR address block for which access rights need to be set. CIDR format and IPv6 format IP address range are supported."
},
"Required": false
}
}
},
"AssociationProperty": "List[Parameters]",
"Type": "Json",
"Description": {
"en": "A list of security group rules. A hundred at most."
},
"Required": true,
"MaxLength": 100
}
},
"Resources": {
"SecurityGroupEgresses": {
"Type": "ALIYUN::ECS::SecurityGroupEgresses",
"Properties": {
"SecurityGroupId": {
"Ref": "SecurityGroupId"
},
"Permissions": {
"Ref": "Permissions"
}
}
}
}
}