ALIYUN::VPC::TrafficMirrorFilter-Resource Orchestration Service(ROS)-阿里云帮助中心

Syntax

{
  "Type": "ALIYUN::VPC::TrafficMirrorFilter",
  "Properties": {
    "TrafficMirrorFilterDescription": String,
    "EgressRules": List,
    "TrafficMirrorFilterName": String,
    "IngressRules": List
  }
}

Properties

Property Name	Type	Required	Update Allowed	Description	Constraints
TrafficMirrorFilterDescription	String	No	Yes	The description of the traffic mirror filter.	The description must be 1 to 256 characters in length. It cannot start with `http://` or `https://`.
EgressRules	List	No	No	The details of the outbound rules.	For more information, see EgressRules properties.
TrafficMirrorFilterName	String	No	Yes	The name of the traffic mirror filter.	The name must be 1 to 128 characters in length. It cannot start with `http://` or `https://`.
IngressRules	List	No	No	The details of the inbound rules.	For more information, see IngressRules properties.

EgressRules syntax

"EgressRules": [
  {
    "DestinationPortRange": String,
    "Action": String,
    "SourcePortRange": String,
    "Priority": Integer,
    "SourceCidrBlock": String,
    "DestinationCidrBlock": String,
    "Protocol": String
  }
]

EgressRules properties

Property Name	Type	Required	Update Allowed	Description	Constraints
DestinationPortRange	String	No	No	The destination port range for the outbound rule.	The port range is 1 to 65535. Use a forward slash (/) to separate the start port and the end port. For example: 1/200 or 80/80. The value -1/-1 represents all ports and cannot be set manually. Note If you set Protocol to ALL or ICMP, you do not need to configure this parameter. This indicates that all ports are allowed.
Action	String	Yes	No	The collection policy for the outbound rule.	Valid values: accept: collects network traffic. drop: does not collect network traffic.
SourcePortRange	String	No	No	The source port range for the outbound rule.	The port range is 1 to 65535. Use a forward slash (/) to separate the start port and the end port. For example: 1/200 or 80/80. The value -1/-1 indicates that there are no port restrictions and cannot be set independently. Note If you set Protocol to ALL or ICMP, you do not need to configure this parameter. This indicates that all ports are allowed.
Priority	Integer	No	No	The priority of the outbound rule.	The smaller the value, the higher the priority. A filter supports a maximum of 10 outbound rules.
SourceCidrBlock	String	No	No	The source CIDR block for the outbound rule.	None
DestinationCidrBlock	String	No	No	The destination CIDR block for the outbound rule.	None
Protocol	String	Yes	No	The protocol of outbound network traffic to mirror.	Valid values: ALL: all protocols. ICMP: Internet Control Message Protocol. TCP: Transmission Control Protocol. UDP: User Datagram Protocol.

IngressRules syntax

"IngressRules": [
  {
    "DestinationPortRange": String,
    "Action": String,
    "SourcePortRange": String,
    "Priority": Integer,
    "SourceCidrBlock": String,
    "DestinationCidrBlock": String,
    "Protocol": String
  }
]

IngressRules properties

Property name	Type	Required	Update Allowed	Description	Constraints
DestinationPortRange	String	No	No	The destination port range for the inbound rule.	The port range is 1 to 65535. Use a forward slash (/) to separate the start port and the end port. For example: 1/200 or 80/80. Note If you set Protocol to ALL or ICMP, you do not need to set this parameter. This indicates that all ports are allowed.
Action	String	Yes	No	The collection policy for the inbound rule.	Valid values: accept: collects network traffic. drop: does not collect network traffic.
SourcePortRange	String	No	No	The source port range for the inbound rule.	The port range is 1 to 65535. Use a forward slash (/) to separate the start port and the end port. For example: 1/200 or 80/80. Note If you set Protocol to ALL or ICMP, you do not need to configure this parameter. This indicates that all ports are allowed.
Priority	Integer	No	No	The priority of the inbound rule.	The smaller the value, the higher the priority. A filter supports a maximum of 10 inbound rules.
SourceCidrBlock	String	No	No	The source CIDR block for the inbound rule.	None
DestinationCidrBlock	String	No	No	The destination CIDR block for the inbound rule.	None
Protocol	String	Yes	No	The protocol of inbound network traffic to mirror.	Valid values: ALL: all protocols. ICMP: Internet Control Message Protocol. TCP: Transmission Control Protocol. UDP: User Datagram Protocol.

Return values

Fn::GetAtt

TrafficMirrorFilterDescription: The description of the traffic mirror filter.
EgressRules: The details of the outbound rules.
TrafficMirrorFilterId: The instance ID of the traffic mirror filter.
TrafficMirrorFilterName: The instance name of the traffic mirror filter.
IngressRules: The details of the inbound rules.

Examples

YAML format

ROSTemplateFormatVersion: '2015-09-01'
Parameters: {}
Resources:
  ExtensionResource:
    Type: ALIYUN::VPC::TrafficMirrorFilter
    Properties:
      EgressRules:
        - DestinationPortRange: 22/40
          Action: accept
          SourcePortRange: 22/40
          Priority: 1
          SourceCidrBlock: 10.0.0.0/24
          DestinationCidrBlock: 10.0.0.0/24
          Protocol: TCP
      TrafficMirrorFilterName: TestTrafficMirrorFilterName
      IngressRules:
        - Action: accept
          SourceCidrBlock: 10.0.0.0/24
          Protocol: TCP
          DestinationPortRange: 80/120
          Priority: 1
          DestinationCidrBlock: 10.0.0.0/24
          SourcePortRange: 80/120
Outputs:
  TrafficMirrorFilterDescription:
    Description: The description of the filter.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - TrafficMirrorFilterDescription
  EgressRules:
    Description: Egress rules.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - EgressRules
  TrafficMirrorFilterId:
    Description: The ID of the filter.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - TrafficMirrorFilterId
  TrafficMirrorFilterName:
    Description: The name of the filter.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - TrafficMirrorFilterName
  IngressRules:
    Description: Ingress rules.
    Value:
      Fn::GetAtt:
        - ExtensionResource
        - IngressRules

JSON format

{
  "ROSTemplateFormatVersion": "2015-09-01",
  "Parameters": {
  },
  "Resources": {
    "ExtensionResource": {
      "Type": "ALIYUN::VPC::TrafficMirrorFilter",
      "Properties": {
        "EgressRules": [
          {
            "DestinationPortRange": "22/40",
            "Action": "accept",
            "SourcePortRange": "22/40",
            "Priority": 1,
            "SourceCidrBlock": "10.0.0.0/24",
            "DestinationCidrBlock": "10.0.0.0/24",
            "Protocol": "TCP"
          }
        ],
        "TrafficMirrorFilterName": "TestTrafficMirrorFilterName",
        "IngressRules": [
          {
            "Action": "accept",
            "SourceCidrBlock": "10.0.0.0/24",
            "Protocol": "TCP",
            "DestinationPortRange": "80/120",
            "Priority": 1,
            "DestinationCidrBlock": "10.0.0.0/24",
            "SourcePortRange": "80/120"
          }
        ]
      }
    }
  },
  "Outputs": {
    "TrafficMirrorFilterDescription": {
      "Description": "The description of the filter.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "TrafficMirrorFilterDescription"
        ]
      }
    },
    "EgressRules": {
      "Description": "Egress rules.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "EgressRules"
        ]
      }
    },
    "TrafficMirrorFilterId": {
      "Description": "The ID of the filter.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "TrafficMirrorFilterId"
        ]
      }
    },
    "TrafficMirrorFilterName": {
      "Description": "The name of the filter.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "TrafficMirrorFilterName"
        ]
      }
    },
    "IngressRules": {
      "Description": "Ingress rules.",
      "Value": {
        "Fn::GetAtt": [
          "ExtensionResource",
          "IngressRules"
        ]
      }
    }
  }
}