ALIYUN::ENS::SecurityGroup - Criar grupo de segurança do ENS - Resource Orchestration Service: Central de Documentação do Alibaba Cloud

Sintaxe

{
  "Type": "ALIYUN::ENS::SecurityGroup",
  "Properties": {
    "Description": String,
    "SecurityGroupName": String,
    "Permissions": List
  }
}

Propriedades

Propriedade	Tipo	Obrigatória	Editável	Descrição	Restrição
Description	String	Não	Sim	Descrição do grupo de segurança.	De 2 a 256 caracteres. Deve começar com uma letra. Não pode iniciar com `http://` ou `https://`.
Permissions	List	Não	Não	Regras do grupo de segurança.	Definido nas propriedades de Permissions.
SecurityGroupName	String	Não	Sim	Nome do grupo de segurança.	De 2 a 128 caracteres. Deve começar com uma letra. Não pode iniciar com `http://` ou `https://`. Pode conter letras, dígitos, dois-pontos (:), sublinhados (_) e hifens (-). Vazio por padrão.

Sintaxe de Permissions

"Permissions": [
  {
    "Direction": String,
    "Description": String,
    "Policy": String,
    "IpProtocol": String,
    "Priority": Integer,
    "SourcePortRange": String,
    "SourceCidrIp": String,
    "PortRange": String,
    "DestCidrIp": String
  }
]

Propriedades de Permissions

Propriedade	Tipo	Obrigatória	Editável	Descrição	Restrição
Direction	String	Sim	Não	Direção da regra.	Nenhuma.
Description	String	Não	Não	Descrição da regra.	Nenhuma.
Policy	String	Sim	Não	Política de autorização.	Nenhuma.
IpProtocol	String	Sim	Não	Protocolo IP.	Nenhuma.
Priority	Integer	Sim	Não	Prioridade da regra.	Nenhuma.
SourcePortRange	String	Não	Não	Intervalo de portas de origem.	Nenhuma.
SourceCidrIp	String	Não	Não	Bloco CIDR de origem.	Controle de acesso de entrada.
PortRange	String	Sim	Não	Intervalo de portas de destino.	Nenhuma.
DestCidrIp	String	Não	Não	Bloco CIDR de destino.	Controle de acesso de saída.

Valores de retorno

Fn::GetAtt

SecurityGroupId: ID do grupo de segurança.

Exemplos

ROSTemplateFormatVersion: '2015-09-01'
Parameters:
  SecurityGroupName:
    Type: String
    Description:
      en: The name of the security group. The name must be 2 to 128 characters in length. The name must start with a letter and cannot start with http:// or https://. It can contain letters, digits, colons (:), underscores (_), and hyphens (-). By default, this parameter is empty.
    Required: false
  SecurityGroupIngress:
    AssociationPropertyMetadata:
      Parameters:
        Policy:
          Type: String
          Description:
            en: 'Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept.'
          AllowedValues:
            - accept
            - drop
          Required: false
        PortRange:
          Type: String
          Description:
            en: Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'
          Required: true
        SourcePortRange:
          Type: String
          Description:
            en: 'The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1.'
          Required: false
        Priority:
          Type: Number
          Description:
            en: Authorization policies priority range[1, 100]
          Required: false
          MinValue: 1
          MaxValue: 100
          Default: 1
        SourceCidrIp:
          Type: String
          Description:
            en: Source CIDR Ip Address range.
          Required: false
        IpProtocol:
          Type: String
          Description:
            en: Ip protocol for in rule.
          AllowedValues:
            - tcp
            - udp
            - icmp
            - gre
            - all
          Required: true
    AssociationProperty: List[Parameters]
    Type: Json
    Description:
      en: Ingress rules for the security group.
    Required: false
  SecurityGroupEgress:
    AssociationPropertyMetadata:
      Parameters:
        Policy:
          Type: String
          Description:
            en: 'Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept.'
          AllowedValues:
            - accept
            - drop
          Required: false
        PortRange:
          Type: String
          Description:
            en: Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'
          Required: true
        SourcePortRange:
          Type: String
          Description:
            en: 'The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1.'
          Required: false
        Priority:
          Type: Number
          Description:
            en: Authorization policies priority range[1, 100]
          Required: false
          MinValue: 1
          MaxValue: 100
          Default: 1
        IpProtocol:
          Type: String
          Description:
            en: Ip protocol for in rule.
          AllowedValues:
            - tcp
            - udp
            - icmp
            - gre
            - all
          Required: true
        DestCidrIp:
          Type: String
          Description:
            en: Dest CIDR Ip Address range.
          Required: false
    AssociationProperty: List[Parameters]
    Type: Json
    Description:
      en: egress rules for the security group.
    Required: false
Resources:
  SecurityGroup:
    Type: ALIYUN::ENS::SecurityGroup
    Properties:
      SecurityGroupName:
        Ref: SecurityGroupName
      SecurityGroupIngress:
        Ref: SecurityGroupIngress
      SecurityGroupEgress:
        Ref: SecurityGroupEgress
Outputs:
  SecurityGroupId:
    Description: The ID of the security group.
    Value:
      Fn::GetAtt:
        - SecurityGroup
        - SecurityGroupId

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
    "SecurityGroupName": {
      "Type": "String",
      "Description": {
        "en": "The name of the security group. The name must be 2 to 128 characters in length. The name must start with a letter and cannot start with http:// or https://. It can contain letters, digits, colons (:), underscores (_), and hyphens (-). By default, this parameter is empty."
      },
      "Required": false
    },
    "SecurityGroupIngress": {
      "AssociationPropertyMetadata": {
        "Parameters": {
          "Policy": {
            "Type": "String",
            "Description": {
              "en": "Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept."
            },
            "AllowedValues": [
              "accept",
              "drop"
            ],
            "Required": false
          },
          "PortRange": {
            "Type": "String",
            "Description": {
              "en": "Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'"
            },
            "Required": true
          },
          "SourcePortRange": {
            "Type": "String",
            "Description": {
              "en": "The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1."
            },
            "Required": false
          },
          "Priority": {
            "Type": "Number",
            "Description": {
              "en": "Authorization policies priority range[1, 100]"
            },
            "Required": false,
            "MinValue": 1,
            "MaxValue": 100,
            "Default": 1
          },
          "SourceCidrIp": {
            "Type": "String",
            "Description": {
              "en": "Source CIDR Ip Address range."
            },
            "Required": false
          },
          "IpProtocol": {
            "Type": "String",
            "Description": {
              "en": "Ip protocol for in rule."
            },
            "AllowedValues": [
              "tcp",
              "udp",
              "icmp",
              "gre",
              "all"
            ],
            "Required": true
          }
        }
      },
      "AssociationProperty": "List[Parameters]",
      "Type": "Json",
      "Description": {
        "en": "Ingress rules for the security group."
      },
      "Required": false
    },
    "SecurityGroupEgress": {
      "AssociationPropertyMetadata": {
        "Parameters": {
          "Policy": {
            "Type": "String",
            "Description": {
              "en": "Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept."
            },
            "AllowedValues": [
              "accept",
              "drop"
            ],
            "Required": false
          },
          "PortRange": {
            "Type": "String",
            "Description": {
              "en": "Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'"
            },
            "Required": true
          },
          "SourcePortRange": {
            "Type": "String",
            "Description": {
              "en": "The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1."
            },
            "Required": false
          },
          "Priority": {
            "Type": "Number",
            "Description": {
              "en": "Authorization policies priority range[1, 100]"
            },
            "Required": false,
            "MinValue": 1,
            "MaxValue": 100,
            "Default": 1
          },
          "IpProtocol": {
            "Type": "String",
            "Description": {
              "en": "Ip protocol for in rule."
            },
            "AllowedValues": [
              "tcp",
              "udp",
              "icmp",
              "gre",
              "all"
            ],
            "Required": true
          },
          "DestCidrIp": {
            "Type": "String",
            "Description": {
              "en": "Dest CIDR Ip Address range."
            },
            "Required": false
          }
        }
      },
      "AssociationProperty": "List[Parameters]",
      "Type": "Json",
      "Description": {
        "en": "egress rules for the security group."
      },
      "Required": false
    }
  },
  "Resources": {
    "SecurityGroup": {
      "Type": "ALIYUN::ENS::SecurityGroup",
      "Properties": {
        "SecurityGroupName": {
          "Ref": "SecurityGroupName"
        },
        "SecurityGroupIngress": {
          "Ref": "SecurityGroupIngress"
        },
        "SecurityGroupEgress": {
          "Ref": "SecurityGroupEgress"
        }
      }
    }
  },
  "Outputs": {
    "SecurityGroupId": {
      "Description": "The ID of the security group.",
      "Value": {
        "Fn::GetAtt": [
          "SecurityGroup",
          "SecurityGroupId"
        ]
      }
    }
  }
}