Cria uma regra de entrada para um grupo de segurança.
Sintaxe
{
"Type": "ALIYUN::ECS::SecurityGroupIngress",
"Properties": {
"SourceGroupOwnerId": String,
"Description": String,
"PortRange": String,
"SecurityGroupId": String,
"NicType": String,
"Ipv6SourceCidrIp": String,
"Priority": Integer,
"SourceGroupId": String,
"Policy": String,
"IpProtocol": String,
"SourcePortRange": String,
"SourceCidrIp": String,
"SourcePrefixListId": String
}
}Propriedades
|
Nome da propriedade |
Tipo |
Obrigatório |
Atualizável |
Descrição |
Restrições |
|
IpProtocol |
String |
Sim |
Não |
Protocolo IP. |
Valores válidos:
|
|
PortRange |
String |
Sim |
Não |
Intervalo de portas da camada de transporte abertas no grupo de segurança de destino. |
Valores válidos:
|
|
SourcePrefixListId |
String |
Não |
Não |
ID da lista de prefixos de destino usada para controle de acesso de entrada. |
Chame a operação DescribePrefixLists do ECS para consultar os IDs das listas de prefixos disponíveis. Sem suporte para grupos de segurança de rede clássica. Se você especificar SourceCidrIp, Ipv6SourceCidrIp ou SourceGroupId, o sistema ignora este parâmetro. |
|
SourceGroupId |
String |
Não |
Não |
ID do grupo de segurança de origem. |
Especifique SourceGroupId ou SourceCidrIp. Se você especificar SourceGroupId sem definir SourceCidrIp, NicType assume o valor intranet. Ao especificar SourceGroupId e SourceCidrIp simultaneamente, a configuração de SourceCidrIp tem precedência. |
|
SecurityGroupId |
String |
Não |
Não |
ID do grupo de segurança onde criar a regra de entrada. |
Nenhuma |
|
NicType |
String |
Não |
Não |
Tipo de rede. |
Valores válidos:
Na configuração de acesso mútuo entre grupos de segurança — por exemplo, ao especificar DestGroupId sem definir DestCidrIp — este parâmetro assume o valor intranet. |
|
Priority |
Integer |
Não |
Não |
Prioridade da regra do grupo de segurança. |
Valores válidos: 1 a 100. Valor padrão: 1. |
|
SourceCidrIp |
String |
Não |
Não |
Bloco CIDR IPv4 de origem. |
Compatível apenas com blocos CIDR IPv4. |
|
Policy |
String |
Não |
Não |
Política de controle de acesso. |
Valores válidos:
|
|
SourceGroupOwnerId |
String |
Não |
Não |
ID da conta Alibaba Cloud do proprietário do grupo de segurança de origem. Usado para regras entre contas. |
Sem a definição de SourceGroupOwnerId, o sistema configura as permissões de acesso para seus outros grupos de segurança por padrão. Se você especificar SourceCidrIp, o sistema ignora este parâmetro. |
|
Description |
String |
Não |
Sim |
Descrição da regra do grupo de segurança. |
Comprimento: 1 a 512 caracteres. |
|
SourcePortRange |
String |
Não |
Não |
Intervalo de portas da camada de transporte abertas no grupo de segurança de origem. |
Valores válidos:
|
|
Ipv6SourceCidrIp |
String |
Não |
Não |
Bloco CIDR IPv6 de origem. |
Compatível com blocos e endereços CIDR IPv6. Apenas VPC. |
Valores de retorno
Fn::GetAtt
Nenhum.
Exemplos
Cenário 1: Selecione um grupo de segurança existente e abrir a porta de entrada 3306.
ROSTemplateFormatVersion: '2015-09-01'
Description: Choose an existing security group and open inbound port 3306.
Parameters:
SecurityGroupId:
Type: String
Label: Business Security Group ID
AssociationProperty: ALIYUN::ECS::SecurityGroup::SecurityGroupId
Resources:
SecurityGroupIngress_3306:
Type: ALIYUN::ECS::SecurityGroupIngress
Properties:
SecurityGroupId:
Ref: SecurityGroupId
SourceCidrIp: 0.0.0.0/0
IpProtocol: tcp
NicType: intranet
PortRange: 3306/3306
Outputs: {}
Metadata: {}
{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": "Choose an existing security group and open inbound port 3306.",
"Parameters": {
"SecurityGroupId": {
"Type": "String",
"Label": "Business Security Group ID",
"AssociationProperty": "ALIYUN::ECS::SecurityGroup::SecurityGroupId"
}
},
"Resources": {
"SecurityGroupIngress_3306": {
"Type": "ALIYUN::ECS::SecurityGroupIngress",
"Properties": {
"SecurityGroupId": {
"Ref": "SecurityGroupId"
},
"SourceCidrIp": "0.0.0.0/0",
"IpProtocol": "tcp",
"NicType": "intranet",
"PortRange": "3306/3306"
}
}
},
"Outputs": {
},
"Metadata": {
}
}Cenário 2: Crie um grupo de segurança e abrir a porta de entrada 80.
ROSTemplateFormatVersion: '2015-09-01'
Description: Create an ECS security group to open inbound port 80.
Parameters:
ZoneId:
Type: String
Label: Availability Zone
AssociationProperty: ALIYUN::ECS::Instance:ZoneId
Resources:
Vpc:
Type: ALIYUN::ECS::VPC
Properties:
CidrBlock: 192.168.0.0/16
VSwitch:
Type: ALIYUN::ECS::VSwitch
Properties:
ZoneId:
Ref: ZoneId
VpcId:
Ref: Vpc
CidrBlock: 192.168.0.0/24
SecurityGroup:
Type: ALIYUN::ECS::SecurityGroup
Properties:
VpcId:
Ref: Vpc
SecurityGroupIngress_80:
Type: ALIYUN::ECS::SecurityGroupIngress
Properties:
SecurityGroupId:
Ref: SecurityGroup
SourceCidrIp: 0.0.0.0/0
IpProtocol: tcp
NicType: intranet
PortRange: 80/80
Outputs: {}
Metadata: {}
{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": "Create an ECS security group to open inbound port 80.",
"Parameters": {
"ZoneId": {
"Type": "String",
"Label": "Availability Zone",
"AssociationProperty": "ALIYUN::ECS::Instance:ZoneId"
}
},
"Resources": {
"Vpc": {
"Type": "ALIYUN::ECS::VPC",
"Properties": {
"CidrBlock": "192.168.0.0/16"
}
},
"VSwitch": {
"Type": "ALIYUN::ECS::VSwitch",
"Properties": {
"ZoneId": {
"Ref": "ZoneId"
},
"VpcId": {
"Ref": "Vpc"
},
"CidrBlock": "192.168.0.0/24"
}
},
"SecurityGroup": {
"Type": "ALIYUN::ECS::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "Vpc"
}
}
},
"SecurityGroupIngress_80": {
"Type": "ALIYUN::ECS::SecurityGroupIngress",
"Properties": {
"SecurityGroupId": {
"Ref": "SecurityGroup"
},
"SourceCidrIp": "0.0.0.0/0",
"IpProtocol": "tcp",
"NicType": "intranet",
"PortRange": "80/80"
}
}
},
"Outputs": {
},
"Metadata": {
}
}Cenário 3: Crie uma instância ECS e abrir a porta de entrada 3000 como porta de serviço para uma aplicação Flowise.
ROSTemplateFormatVersion: '2015-09-01'
Description: Create an Ubuntu 22.04 ECS instance, configure security groups and networking, automate the installation of Node.js alongside the Flowise AI agent service, and provision an external access URL.
Parameters:
SystemDiskCategory:
Default: cloud_essd
AssociationProperty: ALIYUN::ECS::Disk::SystemDiskCategory
AssociationPropertyMetadata:
LocaleKey: DiskCategory
AutoChangeType: false
InstanceType: ${InstanceType}
AutoSelectFirst: true
ZoneId: ${ZoneId}
Type: String
Label: System Disk Type
InstanceType:
AssociationProperty: ALIYUN::ECS::Instance::InstanceType
AssociationPropertyMetadata:
DefaultValueStrategy: recent
ZoneId: ${ZoneId}
Type: String
Label: Instance Type
InstancePassword:
AssociationPropertyMetadata:
Visible:
Condition:
Fn::Equals:
- ${SelectInstance}
- false
Description: The logon password for the server. The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters: ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
Default: Null
Type: String
Label: Instance Password
NoEcho: true
AssociationProperty: ALIYUN::ECS::Instance::Password
ConstraintDescription: The logon password for the server. The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters: ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/
ZoneId:
AssociationProperty: ALIYUN::ECS::Instance:ZoneId
Type: String
Description: <font color='blue'>This template uses Git to clone the FlowiseAI/Flowise repository from GitHub. You may encounter network issues when you use this template in a region within China. You can switch to a region outside China.</font>
Label: Availability Zone
Outputs:
FlowiseUrl:
Description: The default address for Flowise.
Value:
Fn::Sub:
- http://${IP}:3000
- IP:
Fn::Jq:
- First
- if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else .[0].EipAddress.IpAddress end
- Fn::GetAtt:
- DS_Instances
- Instances
Resources:
SecurityGroupIngress_3000:
Type: ALIYUN::ECS::SecurityGroupIngress
Properties:
IpProtocol: tcp
SecurityGroupId:
Ref: SecurityGroup
NicType: intranet
SourceCidrIp: 0.0.0.0/0
PortRange: 3000/3000
InstanceGroup:
Type: ALIYUN::ECS::InstanceGroup
Properties:
SystemDiskCategory:
Ref: SystemDiskCategory
VpcId:
Ref: Vpc
SecurityGroupId:
Ref: SecurityGroup
ImageId: ubuntu_22_04
IoOptimized: optimized
VSwitchId:
Ref: VSwitch
Password:
Ref: InstancePassword
InstanceName: Flowise
InstanceType:
Ref: InstanceType
MaxAmount: 1
SecurityGroup:
Type: ALIYUN::ECS::SecurityGroup
Properties:
VpcId:
Ref: Vpc
DS_Instances:
Type: DATASOURCE::ECS::Instances
Properties:
InstanceIds:
Fn::GetAtt:
- InstanceGroup
- InstanceIds
Vpc:
Type: ALIYUN::ECS::VPC
Properties:
CidrBlock: 192.168.0.0/16
InstallFlowise:
Type: ALIYUN::ECS::RunCommand
Properties:
CommandContent: |
#!/bin/bash
echo "#########################"
echo "# Install NodeJS"
echo "#########################"
git clone https://github.com/nvm-sh/nvm.git /opt/nvm && cd /opt/nvm
ret_code=$?
if [ $ret_code -ne 0 ]; then
echo "Git clone https://github.com/nvm-sh/nvm.git failed. Exiting."
exit $ret_code
fi
./install.sh
export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
nvm install 22
npm config set registry https://registry.npmmirror.com
npm i -g pnpm
echo "#########################"
echo "# Install Flowise"
echo "#########################"
git clone --depth 1 https://github.com/FlowiseAI/Flowise.git /opt/Flowise && cd /opt/Flowise
ret_code=$?
if [ $ret_code -ne 0 ]; then
echo "Git clone https://github.com/FlowiseAI/Flowise.git failed. Exiting."
exit $ret_code
fi
pnpm install
pnpm build
nohup pnpm start > flowise.log 2>&1 &
Type: RunShellScript
Sync: true
InstanceIds:
Fn::GetAtt:
- InstanceGroup
- InstanceIds
Timeout: 1800
VSwitch:
Type: ALIYUN::ECS::VSwitch
Properties:
VpcId:
Ref: Vpc
CidrBlock: 192.168.0.0/24
ZoneId:
Ref: ZoneId
Metadata: {}
{
"ROSTemplateFormatVersion": "2015-09-01",
"Description": "Create an Ubuntu 22.04 ECS instance, configure security groups and networking, automate the installation of Node.js alongside the Flowise AI agent service, and provision an external access URL.",
"Parameters": {
"SystemDiskCategory": {
"Default": "cloud_essd",
"AssociationProperty": "ALIYUN::ECS::Disk::SystemDiskCategory",
"AssociationPropertyMetadata": {
"LocaleKey": "DiskCategory",
"AutoChangeType": false,
"InstanceType": "${InstanceType}",
"AutoSelectFirst": true,
"ZoneId": "${ZoneId}"
},
"Type": "String",
"Label": "System Disk Type"
},
"InstanceType": {
"AssociationProperty": "ALIYUN::ECS::Instance::InstanceType",
"AssociationPropertyMetadata": {
"DefaultValueStrategy": "recent",
"ZoneId": "${ZoneId}"
},
"Type": "String",
"Label": "Instance Type"
},
"InstancePassword": {
"AssociationPropertyMetadata": {
"Visible": {
"Condition": {
"Fn::Equals": [
"${SelectInstance}",
false
]
}
}
},
"Description": "The logon password for the server. The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters: ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/",
"Default": null,
"Type": "String",
"Label": "Instance Password",
"NoEcho": true,
"AssociationProperty": "ALIYUN::ECS::Instance::Password",
"ConstraintDescription": "The logon password for the server. The password must be 8 to 30 characters long and contain at least three of the following character types: uppercase letters, lowercase letters, digits, and special characters: ()`~!@#$%^&*_-+=|{}[]:;'<>,.?/"
},
"ZoneId": {
"AssociationProperty": "ALIYUN::ECS::Instance:ZoneId",
"Type": "String",
"Description": "<font color='blue'>This template uses Git to clone the FlowiseAI/Flowise repository from GitHub. You may encounter network issues when you use this template in a region within China. You can switch to a region outside China.</font>",
"Label": "Availability Zone"
}
},
"Outputs": {
"FlowiseUrl": {
"Description": "The default address for Flowise.",
"Value": {
"Fn::Sub": [
"http://${IP}:3000",
{
"IP": {
"Fn::Jq": [
"First",
"if .[0].PublicIpAddress != [] then .[0].PublicIpAddress[0] else .[0].EipAddress.IpAddress end",
{
"Fn::GetAtt": [
"DS_Instances",
"Instances"
]
}
]
}
}
]
}
}
},
"Resources": {
"SecurityGroupIngress_3000": {
"Type": "ALIYUN::ECS::SecurityGroupIngress",
"Properties": {
"IpProtocol": "tcp",
"SecurityGroupId": {
"Ref": "SecurityGroup"
},
"NicType": "intranet",
"SourceCidrIp": "0.0.0.0/0",
"PortRange": "3000/3000"
}
},
"InstanceGroup": {
"Type": "ALIYUN::ECS::InstanceGroup",
"Properties": {
"SystemDiskCategory": {
"Ref": "SystemDiskCategory"
},
"VpcId": {
"Ref": "Vpc"
},
"SecurityGroupId": {
"Ref": "SecurityGroup"
},
"ImageId": "ubuntu_22_04",
"IoOptimized": "optimized",
"VSwitchId": {
"Ref": "VSwitch"
},
"Password": {
"Ref": "InstancePassword"
},
"InstanceName": "Flowise",
"InstanceType": {
"Ref": "InstanceType"
},
"MaxAmount": 1
}
},
"SecurityGroup": {
"Type": "ALIYUN::ECS::SecurityGroup",
"Properties": {
"VpcId": {
"Ref": "Vpc"
}
}
},
"DS_Instances": {
"Type": "DATASOURCE::ECS::Instances",
"Properties": {
"InstanceIds": {
"Fn::GetAtt": [
"InstanceGroup",
"InstanceIds"
]
}
}
},
"Vpc": {
"Type": "ALIYUN::ECS::VPC",
"Properties": {
"CidrBlock": "192.168.0.0/16"
}
},
"InstallFlowise": {
"Type": "ALIYUN::ECS::RunCommand",
"Properties": {
"CommandContent": "#!/bin/bash\necho \"#########################\"\necho \"# Install NodeJS\"\necho \"#########################\"\ngit clone https://github.com/nvm-sh/nvm.git /opt/nvm && cd /opt/nvm\nret_code=$?\nif [ $ret_code -ne 0 ]; then\n echo \"Git clone https://github.com/nvm-sh/nvm.git failed. Exiting.\"\n exit $ret_code\nfi\n./install.sh\nexport NVM_DIR=\"$HOME/.nvm\"\n[ -s \"$NVM_DIR/nvm.sh\" ] && \\. \"$NVM_DIR/nvm.sh\"\n[ -s \"$NVM_DIR/bash_completion\" ] && \\. \"$NVM_DIR/bash_completion\"\nnvm install 22\nnpm config set registry https://registry.npmmirror.com\nnpm i -g pnpm\n\necho \"#########################\"\necho \"# Install Flowise\"\necho \"#########################\"\ngit clone --depth 1 https://github.com/FlowiseAI/Flowise.git /opt/Flowise && cd /opt/Flowise\nret_code=$?\nif [ $ret_code -ne 0 ]; then\n echo \"Git clone https://github.com/FlowiseAI/Flowise.git failed. Exiting.\"\n exit $ret_code\nfi\npnpm install\npnpm build\nnohup pnpm start > flowise.log 2>&1 &\n",
"Type": "RunShellScript",
"Sync": true,
"InstanceIds": {
"Fn::GetAtt": [
"InstanceGroup",
"InstanceIds"
]
},
"Timeout": 1800
}
},
"VSwitch": {
"Type": "ALIYUN::ECS::VSwitch",
"Properties": {
"VpcId": {
"Ref": "Vpc"
},
"CidrBlock": "192.168.0.0/24",
"ZoneId": {
"Ref": "ZoneId"
}
}
}
},
"Metadata": {
}
}