Class SecurityGroup

Creates an Amazon EC2 security group within a VPC.

Inheritance

System.Object

Resource

SecurityGroup

Implements

ISecurityGroup

IResource

Constructs.IConstruct

Constructs.IDependable

IPeer

IConnectable

Inherited Members

Resource.IsOwnedResource(IConstruct)

Resource.IsResource(IConstruct)

Resource.ApplyRemovalPolicy(RemovalPolicy)

Resource.GeneratePhysicalName()

Resource.GetResourceArnAttribute(String, IArnComponents)

Resource.GetResourceNameAttribute(String)

Resource.Env

Resource.PhysicalName

Resource.Stack

Namespace: Amazon.CDK.AWS.EC2

Assembly: Amazon.CDK.Lib.dll

Syntax (csharp)

public class SecurityGroup : Resource, ISecurityGroup, IResource, IPeer, IConnectable

Syntax (vb)

Public Class SecurityGroup
    Inherits Resource
    Implements ISecurityGroup, IResource, IPeer, IConnectable

Remarks

Security Groups act like a firewall with a set of rules, and are associated with any AWS resource that has or creates Elastic Network Interfaces (ENIs). A typical example of a resource that has a security group is an Instance (or Auto Scaling Group of instances)

If you are defining new infrastructure in CDK, there is a good chance you won't have to interact with this class at all. Like IAM Roles, Security Groups need to exist to control access between AWS resources, but CDK will automatically generate and populate them with least-privilege permissions for you so you can concentrate on your business logic.

All Constructs that require Security Groups will create one for you if you don't specify one at construction. After construction, you can selectively allow connections to and between constructs via--for example-- the instance.connections object. Think of it as "allowing connections to your instance", rather than "adding ingress rules a security group". See the Allowing Connections section in the library documentation for examples.

Direct manipulation of the Security Group through addIngressRule and addEgressRule is possible, but mutation through the .connections object is recommended. If you peer two constructs with security groups this way, appropriate rules will be created in both.

If you have an existing security group you want to use in your CDK application, you would import it like this:

var securityGroup = SecurityGroup.FromSecurityGroupId(this, "SG", "sg-12345", new SecurityGroupImportOptions {
    Mutable = false
});

ExampleMetadata: infused

Examples

Vpc vpc;


var mySecurityGroup = new SecurityGroup(this, "SecurityGroup", new SecurityGroupProps { Vpc = vpc });
new AutoScalingGroup(this, "ASG", new AutoScalingGroupProps {
    Vpc = vpc,
    InstanceType = InstanceType.Of(InstanceClass.BURSTABLE2, InstanceSize.MICRO),
    MachineImage = MachineImage.LatestAmazonLinux2(),
    SecurityGroup = mySecurityGroup
});

Synopsis

Constructors

SecurityGroup(ByRefValue)	Used by jsii to construct an instance of this class from a Javascript-owned object reference
SecurityGroup(DeputyBase.DeputyProps)	Used by jsii to construct an instance of this class from DeputyProps
SecurityGroup(Construct, String, ISecurityGroupProps)

Properties

AllowAllIpv6Outbound	Whether the SecurityGroup has been configured to allow all outbound ipv6 traffic.
AllowAllOutbound	Whether the SecurityGroup has been configured to allow all outbound traffic.
CanInlineRule	Whether the rule can be inlined into a SecurityGroup or not.
Connections	The network connections associated with this resource.
DefaultPort
SecurityGroupId	The ID of the security group.
SecurityGroupVpcId	The VPC ID this security group is part of.
UniqueId	A unique identifier for this connection peer.

Methods

AddEgressRule(IPeer, Port, String, Nullable<Boolean>)	Add an egress rule for the current security group.
AddIngressRule(IPeer, Port, String, Nullable<Boolean>)	Add an ingress rule for the current security group.
DetermineRuleScope(IPeer, Port, String, Nullable<Boolean>)	Determine where to parent a new ingress/egress rule.
FromLookupById(Construct, String, String)	Look up a security group by id.
FromLookupByName(Construct, String, String, IVpc)	Look up a security group by name.
FromSecurityGroupId(Construct, String, String, ISecurityGroupImportOptions)	Import an existing security group into this app.
IsSecurityGroup(Object)	Return whether the indicated object is a security group.
ToEgressRuleConfig()	Produce the egress rule JSON for the given connection.
ToIngressRuleConfig()	Produce the ingress rule JSON for the given connection.

Constructors

SecurityGroup(ByRefValue)

Used by jsii to construct an instance of this class from a Javascript-owned object reference

protected SecurityGroup(ByRefValue reference)

Parameters

reference Amazon.JSII.Runtime.Deputy.ByRefValue: The Javascript-owned object reference

SecurityGroup(DeputyBase.DeputyProps)

Used by jsii to construct an instance of this class from DeputyProps

protected SecurityGroup(DeputyBase.DeputyProps props)

Parameters

props Amazon.JSII.Runtime.Deputy.DeputyBase.DeputyProps: The deputy props

SecurityGroup(Construct, String, ISecurityGroupProps)

public SecurityGroup(Construct scope, string id, ISecurityGroupProps props)

Parameters

scope Constructs.Construct
id System.String
props ISecurityGroupProps

Properties

AllowAllIpv6Outbound

Whether the SecurityGroup has been configured to allow all outbound ipv6 traffic.

public virtual bool AllowAllIpv6Outbound { get; }

Property Value

System.Boolean

AllowAllOutbound

Whether the SecurityGroup has been configured to allow all outbound traffic.

public virtual bool AllowAllOutbound { get; }

Property Value

System.Boolean

CanInlineRule

Whether the rule can be inlined into a SecurityGroup or not.

public virtual bool CanInlineRule { get; }

Property Value

System.Boolean

Connections

The network connections associated with this resource.

public virtual Connections_ Connections { get; }

Property Value

Connections_

DefaultPort

public virtual Port DefaultPort { get; }

Property Value

Port

SecurityGroupId

The ID of the security group.

public virtual string SecurityGroupId { get; }

Property Value

System.String

Remarks

Attribute: true

SecurityGroupVpcId

The VPC ID this security group is part of.

public virtual string SecurityGroupVpcId { get; }

Property Value

System.String

Remarks

Attribute: true

UniqueId

A unique identifier for this connection peer.

public virtual string UniqueId { get; }

Property Value

System.String

Methods

AddEgressRule(IPeer, Port, String, Nullable<Boolean>)

Add an egress rule for the current security group.

public virtual void AddEgressRule(IPeer peer, Port connection, string description = null, Nullable<bool> remoteRule = null)

Parameters

peer IPeer
connection Port
description System.String
remoteRule System.Nullable<System.Boolean>

Remarks

remoteRule controls where the Rule object is created if the peer is also a securityGroup and they are in different stack. If false (default) the rule object is created under the current SecurityGroup object. If true and the peer is also a SecurityGroup, the rule object is created under the remote SecurityGroup object.

AddIngressRule(IPeer, Port, String, Nullable<Boolean>)

Add an ingress rule for the current security group.

public virtual void AddIngressRule(IPeer peer, Port connection, string description = null, Nullable<bool> remoteRule = null)

Parameters

peer IPeer
connection Port
description System.String
remoteRule System.Nullable<System.Boolean>

Remarks

DetermineRuleScope(IPeer, Port, String, Nullable<Boolean>)

Determine where to parent a new ingress/egress rule.

protected virtual IRuleScope DetermineRuleScope(IPeer peer, Port connection, string fromTo, Nullable<bool> remoteRule = null)

Parameters

peer IPeer
connection Port
fromTo System.String
remoteRule System.Nullable<System.Boolean>

Returns

IRuleScope

Remarks

A SecurityGroup rule is parented under the group it's related to, UNLESS we're in a cross-stack scenario with another Security Group. In that case, we respect the 'remoteRule' flag and will parent under the other security group.

This is necessary to avoid cyclic dependencies between stacks, since both ingress and egress rules will reference both security groups, and a naive parenting will lead to the following situation:

╔════════════════════╗ ╔════════════════════╗ ║ ┌───────────┐ ║ ║ ┌───────────┐ ║ ║ │ GroupA │◀────╬─┐ ┌───╬───▶│ GroupB │ ║ ║ └───────────┘ ║ │ │ ║ └───────────┘ ║ ║ ▲ ║ │ │ ║ ▲ ║ ║ │ ║ │ │ ║ │ ║ ║ │ ║ │ │ ║ │ ║ ║ ┌───────────┐ ║ └───┼───╬────┌───────────┐ ║ ║ │ EgressA │─────╬─────┘ ║ │ IngressB │ ║ ║ └───────────┘ ║ ║ └───────────┘ ║ ║ ║ ║ ║ ╚════════════════════╝ ╚════════════════════╝

By having the ability to switch the parent, we avoid the cyclic reference by keeping all rules in a single stack.

If this happens, we also have to change the construct ID, because otherwise we might have two objects with the same ID if we have multiple reversed security group relationships.

╔═══════════════════════════════════╗ ║┌───────────┐ ║ ║│ GroupB │ ║ ║└───────────┘ ║ ║ ▲ ║ ║ │ ┌───────────┐ ║ ║ ├────"from A"──│ IngressB │ ║ ║ │ └───────────┘ ║ ║ │ ┌───────────┐ ║ ║ ├─────"to B"───│ EgressA │ ║ ║ │ └───────────┘ ║ ║ │ ┌───────────┐ ║ ║ └─────"to B"───│ EgressC │ ║ <-- oops ║ └───────────┘ ║ ╚═══════════════════════════════════╝

FromLookupById(Construct, String, String)

Look up a security group by id.

public static ISecurityGroup FromLookupById(Construct scope, string id, string securityGroupId)

Parameters

scope Constructs.Construct
id System.String
securityGroupId System.String

Returns

ISecurityGroup

FromLookupByName(Construct, String, String, IVpc)

Look up a security group by name.

public static ISecurityGroup FromLookupByName(Construct scope, string id, string securityGroupName, IVpc vpc)

Parameters

scope Constructs.Construct
id System.String
securityGroupName System.String
vpc IVpc

Returns

ISecurityGroup

FromSecurityGroupId(Construct, String, String, ISecurityGroupImportOptions)

Import an existing security group into this app.

public static ISecurityGroup FromSecurityGroupId(Construct scope, string id, string securityGroupId, ISecurityGroupImportOptions options = null)

Parameters

scope Constructs.Construct
id System.String
securityGroupId System.String
options ISecurityGroupImportOptions

Returns

ISecurityGroup

Remarks

This method will assume that the Security Group has a rule in it which allows all outbound traffic, and so will not add egress rules to the imported Security Group (only ingress rules).

If your existing Security Group needs to have egress rules added, pass the allowAllOutbound: false option on import.

IsSecurityGroup(Object)

Return whether the indicated object is a security group.

public static bool IsSecurityGroup(object x)

Parameters

x System.Object

Returns

System.Boolean

ToEgressRuleConfig()

Produce the egress rule JSON for the given connection.

public virtual object ToEgressRuleConfig()

Returns

System.Object

ToIngressRuleConfig()

Produce the ingress rule JSON for the given connection.

public virtual object ToIngressRuleConfig()

Returns

System.Object

Implements

ISecurityGroup

IResource

Constructs.IConstruct

Constructs.IDependable

IPeer

IConnectable