ALIYUN::ECS::SecurityGroupEgress-Resource Orchestration Service(ROS)-阿里云帮助中心

Syntax

{
  "Type": "ALIYUN::ECS::SecurityGroupEgress",
  "Properties": {
    "SecurityGroupId": String,
    "IpProtocol": String,
    "PortRange": String,
    "DestGroupId": String,
    "DestCidrIp": String,
    "Policy": String,
    "Priority": String,
    "NicType": String,
    "DestPrefixListId": String,
    "Description": String,    
    "DestGroupOwnerId": String,
    "Ipv6DestCidrIp": String
  }
}

Properties

Property Name	Type	Required	Update allowed	Description	Constraints
IpProtocol	String	Yes	No	The transport-layer protocol.	Valid values: tcp udp icmp gre all: all four protocols are supported.
PortRange	String	Yes	No	The range of destination ports that are open for the transport-layer protocol.	Valid values: For TCP/UDP: 1 to 65535. Use a forward slash (/) to separate the start port and the end port. For example: 1/200. An incorrect example is 200/1. For ICMP: -1/-1. For GRE: -1/-1. For all: -1/-1. For more information about common port scenarios, see Commonly used ports.
SecurityGroupId	String	No	No	The ID of the source security group.	None
DestPrefixListId	String	No	No	The ID of the destination prefix list for which you want to set outbound access permissions.	You can call DescribePrefixLists to query the IDs of available prefix lists. You cannot set a prefix list for a security group in the classic network. For more information, see Limits on security groups. This parameter is ignored if you specify DestCidrIp, Ipv6DestCidrIp, or DestGroupId.
NicType	String	No	No	The network interface controller (NIC) type.	Valid values: internet (default): a public NIC. intranet: a private NIC. If you set mutual access between security groups by specifying DestGroupId but not DestCidrIp, this parameter is set to intranet.
Priority	Integer	No	No	The priority of the security group rule.	Valid values: 1 to 100. Default value: 1.
DestGroupId	String	No	No	The ID of the destination security group for which you want to set access permissions.	Specify either DestGroupId or DestCidrIp. If you specify DestGroupId but not DestCidrIp, NicType is set to intranet. If you specify both DestGroupId and DestCidrIp, the value of DestCidrIp takes precedence.
DestCidrIp	String	No	No	The destination IP address range.	Supports IPv4 address ranges.
Policy	String	No	No	You can set access permissions.	Valid values: accept (default): grants access. drop: denies access.
Description	String	No	Yes	The description of the security group rule.	The description must be 1 to 512 characters long.
DestGroupOwnerId	String	No	No	When you set a security group rule across accounts, this is the Alibaba Cloud account ID of the destination security group.	If you do not set DestGroupOwnerId, the rule is considered a rule for another security group within your account. If you have already set DestCidrIp, the DestGroupOwnerId setting is invalid.
Ipv6DestCidrIp	String	No	No	The destination IPv6 CIDR block.	Supports CIDR blocks and IPv6 address ranges. Only IP addresses in VPCs are supported.

Return value

Fn::GetAtt

None.

Examples

YAML format

ROSTemplateFormatVersion: '2015-09-01'
Description: Test ECS SecurityGroupEgress
Parameters:
  SecurityGroupId:
    Type: String
    AssociationProperty: ALIYUN::ECS::SecurityGroup::SecurityGroupId
    Label:
      zh-cn: Security Group ID
      en: Security Group ID
Resources:
  SgEgress:
    Type: ALIYUN::ECS::SecurityGroupEgress
    Properties:
      IpProtocol: all
      PortRange: '-1/-1'
      NicType: intranet
      SecurityGroupId:
        Ref: SecurityGroupId

JSON format

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Description": "Test ECS SecurityGroupEgress",
  "Parameters": {
    "SecurityGroupId": {
      "Type": "String",
      "AssociationProperty": "ALIYUN::ECS::SecurityGroup::SecurityGroupId",
      "Label": {
        "zh-cn": "Security Group ID",
        "en": "Security Group ID"
      }
    }
  },
  "Resources": {
    "SgEgress": {
      "Type": "ALIYUN::ECS::SecurityGroupEgress",
      "Properties": {
        "IpProtocol": "all",
        "PortRange": "-1/-1",
        "NicType": "intranet",
        "SecurityGroupId": {
          "Ref": "SecurityGroupId"
        }
      }
    }
  }
}