ALIYUN::ENS::SecurityGroup - Create ENS security group - Resource Orchestration Service

Sözdizimi

{
  "Type": "ALIYUN::ENS::SecurityGroup",
  "Properties": {
    "Description": String,
    "SecurityGroupName": String,
    "Permissions": List
  }
}

Özellikler

Özellik	Tür	Gerekli	Düzenlenebilir	Açıklama	Kısıtlama
Description	String	No	Yes	Güvenlik grubu açıklaması.	2–256 karakter. Bir harfle başlamalıdır. `http://` veya `https://` ile başlayamaz.
Permissions	List	No	No	Güvenlik grubu kuralları.	Permissions özelliklerinde tanımlanır.
SecurityGroupName	String	No	Yes	Güvenlik grubu adı.	2–128 karakter. Bir harfle başlamalıdır. `http://` veya `https://` ile başlayamaz. Harfler, rakamlar, iki nokta üst üste (:), alt çizgi (_) ve tire (-) içerebilir. Varsayılan olarak boştur.

İzin sözdizimi

"Permissions": [
  {
    "Direction": String,
    "Description": String,
    "Policy": String,
    "IpProtocol": String,
    "Priority": Integer,
    "SourcePortRange": String,
    "SourceCidrIp": String,
    "PortRange": String,
    "DestCidrIp": String
  }
]

İzin özellikleri

Özellik	Tür	Gerekli	Düzenlenebilir	Açıklama	Kısıtlama
Direction	String	Yes	No	Kural yönü.	None.
Description	String	No	No	Kural açıklaması.	None.
Policy	String	Yes	No	Yetkilendirme ilkesi.	None.
IpProtocol	String	Yes	No	IP protokolü.	None.
Priority	Integer	Yes	No	Kural önceliği.	None.
SourcePortRange	String	No	No	Kaynak bağlantı noktası aralığı.	None.
SourceCidrIp	String	No	No	Kaynak CIDR bloğu.	Gelen erişim kontrolü.
PortRange	String	Yes	No	Hedef bağlantı noktası aralığı.	None.
DestCidrIp	String	No	No	Hedef CIDR bloğu.	Giden erişim kontrolü.

Dönüş değerleri

Fn::GetAtt

SecurityGroupId: Güvenlik grubunun kimliği.

Örnekler

YAML

ROSTemplateFormatVersion: '2015-09-01'
Parameters:
  SecurityGroupName:
    Type: String
    Description:
      en: The name of the security group. The name must be 2 to 128 characters in length. The name must start with a letter and cannot start with http:// or https://. It can contain letters, digits, colons (:), underscores (_), and hyphens (-). By default, this parameter is empty.
    Required: false
  SecurityGroupIngress:
    AssociationPropertyMetadata:
      Parameters:
        Policy:
          Type: String
          Description:
            en: 'Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept.'
          AllowedValues:
            - accept
            - drop
          Required: false
        PortRange:
          Type: String
          Description:
            en: Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'
          Required: true
        SourcePortRange:
          Type: String
          Description:
            en: 'The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1.'
          Required: false
        Priority:
          Type: Number
          Description:
            en: Authorization policies priority range[1, 100]
          Required: false
          MinValue: 1
          MaxValue: 100
          Default: 1
        SourceCidrIp:
          Type: String
          Description:
            en: Source CIDR Ip Address range.
          Required: false
        IpProtocol:
          Type: String
          Description:
            en: Ip protocol for in rule.
          AllowedValues:
            - tcp
            - udp
            - icmp
            - gre
            - all
          Required: true
    AssociationProperty: List[Parameters]
    Type: Json
    Description:
      en: Ingress rules for the security group.
    Required: false
  SecurityGroupEgress:
    AssociationPropertyMetadata:
      Parameters:
        Policy:
          Type: String
          Description:
            en: 'Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept.'
          AllowedValues:
            - accept
            - drop
          Required: false
        PortRange:
          Type: String
          Description:
            en: Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'
          Required: true
        SourcePortRange:
          Type: String
          Description:
            en: 'The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1.'
          Required: false
        Priority:
          Type: Number
          Description:
            en: Authorization policies priority range[1, 100]
          Required: false
          MinValue: 1
          MaxValue: 100
          Default: 1
        IpProtocol:
          Type: String
          Description:
            en: Ip protocol for in rule.
          AllowedValues:
            - tcp
            - udp
            - icmp
            - gre
            - all
          Required: true
        DestCidrIp:
          Type: String
          Description:
            en: Dest CIDR Ip Address range.
          Required: false
    AssociationProperty: List[Parameters]
    Type: Json
    Description:
      en: egress rules for the security group.
    Required: false
Resources:
  SecurityGroup:
    Type: ALIYUN::ENS::SecurityGroup
    Properties:
      SecurityGroupName:
        Ref: SecurityGroupName
      SecurityGroupIngress:
        Ref: SecurityGroupIngress
      SecurityGroupEgress:
        Ref: SecurityGroupEgress
Outputs:
  SecurityGroupId:
    Description: The ID of the security group.
    Value:
      Fn::GetAtt:
        - SecurityGroup
        - SecurityGroupId

JSON

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
    "SecurityGroupName": {
      "Type": "String",
      "Description": {
        "en": "The name of the security group. The name must be 2 to 128 characters in length. The name must start with a letter and cannot start with http:// or https://. It can contain letters, digits, colons (:), underscores (_), and hyphens (-). By default, this parameter is empty."
      },
      "Required": false
    },
    "SecurityGroupIngress": {
      "AssociationPropertyMetadata": {
        "Parameters": {
          "Policy": {
            "Type": "String",
            "Description": {
              "en": "Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept."
            },
            "AllowedValues": [
              "accept",
              "drop"
            ],
            "Required": false
          },
          "PortRange": {
            "Type": "String",
            "Description": {
              "en": "Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'"
            },
            "Required": true
          },
          "SourcePortRange": {
            "Type": "String",
            "Description": {
              "en": "The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1."
            },
            "Required": false
          },
          "Priority": {
            "Type": "Number",
            "Description": {
              "en": "Authorization policies priority range[1, 100]"
            },
            "Required": false,
            "MinValue": 1,
            "MaxValue": 100,
            "Default": 1
          },
          "SourceCidrIp": {
            "Type": "String",
            "Description": {
              "en": "Source CIDR Ip Address range."
            },
            "Required": false
          },
          "IpProtocol": {
            "Type": "String",
            "Description": {
              "en": "Ip protocol for in rule."
            },
            "AllowedValues": [
              "tcp",
              "udp",
              "icmp",
              "gre",
              "all"
            ],
            "Required": true
          }
        }
      },
      "AssociationProperty": "List[Parameters]",
      "Type": "Json",
      "Description": {
        "en": "Ingress rules for the security group."
      },
      "Required": false
    },
    "SecurityGroupEgress": {
      "AssociationPropertyMetadata": {
        "Parameters": {
          "Policy": {
            "Type": "String",
            "Description": {
              "en": "Authorization policies, parameter values can be: accept (accepted access), drop (denied access). Default value is accept."
            },
            "AllowedValues": [
              "accept",
              "drop"
            ],
            "Required": false
          },
          "PortRange": {
            "Type": "String",
            "Description": {
              "en": "Ip protocol relative port range. For tcp and udp, the port rang is [1,65535], using format '1/200'For icmp|gre|all protocel, the port range should be '-1/-1'"
            },
            "Required": true
          },
          "SourcePortRange": {
            "Type": "String",
            "Description": {
              "en": "The range of the ports enabled by the source security group for the transport layer protocol. Valid values: TCP/UDP: Value range: 1 to 65535. The start port and the end port are separated by a slash (/). Correct example: 1/200. Incorrect example: 200/1.ICMP: -1/-1.GRE: -1/-1.ALL: -1/-1."
            },
            "Required": false
          },
          "Priority": {
            "Type": "Number",
            "Description": {
              "en": "Authorization policies priority range[1, 100]"
            },
            "Required": false,
            "MinValue": 1,
            "MaxValue": 100,
            "Default": 1
          },
          "IpProtocol": {
            "Type": "String",
            "Description": {
              "en": "Ip protocol for in rule."
            },
            "AllowedValues": [
              "tcp",
              "udp",
              "icmp",
              "gre",
              "all"
            ],
            "Required": true
          },
          "DestCidrIp": {
            "Type": "String",
            "Description": {
              "en": "Dest CIDR Ip Address range."
            },
            "Required": false
          }
        }
      },
      "AssociationProperty": "List[Parameters]",
      "Type": "Json",
      "Description": {
        "en": "egress rules for the security group."
      },
      "Required": false
    }
  },
  "Resources": {
    "SecurityGroup": {
      "Type": "ALIYUN::ENS::SecurityGroup",
      "Properties": {
        "SecurityGroupName": {
          "Ref": "SecurityGroupName"
        },
        "SecurityGroupIngress": {
          "Ref": "SecurityGroupIngress"
        },
        "SecurityGroupEgress": {
          "Ref": "SecurityGroupEgress"
        }
      }
    }
  },
  "Outputs": {
    "SecurityGroupId": {
      "Description": "The ID of the security group.",
      "Value": {
        "Fn::GetAtt": [
          "SecurityGroup",
          "SecurityGroupId"
        ]
      }
    }
  }
}