如何添加引用另一个安全组的cloudformation安全组入口规则? [英] How do I add a cloudformation security group ingress rule that refers to another security group?

问题描述

我在yaml模板中具有以下安全组.我想让"SecurityGroupApplication"安全组允许来自"SecurityGroupBastion"的传入连接.但是，aws客户端的validate-template函数会告诉我无用的信息，例如不受支持的结构".好的，但是结构有什么问题吗?想法?

I have the following security group in a yaml template. I'd like to have the "SecurityGroupApplication" security group allow incoming connections from the "SecurityGroupBastion". However, the validate-template function of the aws client is telling me unhelpful information like "unsupported structure". Ok, but what is wrong with the structure? Ideas?

Resources:
  SecurityGroupBastion:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Bastion security group
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
      VpcId: !Ref vpcId
  SecurityGroupApplication:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Application security group
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref SecurityGroupBastion
          IpProtocol: tcp

推荐答案

您的模板非常适合我，但我必须为App安全组指定端口:

Your template works perfectly find for me, except that I had to specify the ports for the App security Group:

Resources:
  SecurityGroupBastion:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Bastion security group
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
      VpcId: vpc-abcd1234
  SecurityGroupApplication:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Application security group
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref SecurityGroupBastion
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22

这篇关于如何添加引用另一个安全组的cloudformation安全组入口规则?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！