AWS CloudFormation-将条件添加到安全组出口规则

发布于 2025-01-22 07:45:47 字数 840 浏览 5 评论 0原文

如何在安全组资源中的SecurityGroupingress规则中添加条件？因此，例如，如果环境参数设置为“ prod”，它将同时打开端口80和443，但是如果将其设置为“测试”，它将仅打开端口80。

示例模板：

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  EnvType:
    Description: Environment type.
    Default: test
    Type: String
    AllowedValues:
      - prod
      - test
    ConstraintDescription: must specify prod or test.
Conditions:
  CreateProdResources: !Equals 
    - Ref: EnvType
    - prod
Resources:
  WebSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Web server
      GroupName: web
      VpcId: vpc-abc01234
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

原文

How can I add a condition to an SecurityGroupIngress rule in a Security group resource? So for example if environment parameter is set to "prod" it will open both port 80 and 443 but if its set to "test" it will only open port 80.

Example template:

AWSTemplateFormatVersion: 2010-09-09
Parameters:
  EnvType:
    Description: Environment type.
    Default: test
    Type: String
    AllowedValues:
      - prod
      - test
    ConstraintDescription: must specify prod or test.
Conditions:
  CreateProdResources: !Equals 
    - Ref: EnvType
    - prod
Resources:
  WebSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Web server
      GroupName: web
      VpcId: vpc-abc01234
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

长发绾君心 2025-01-29 07:45:47

您已经定义了此条件，现在您可以使用内在的 novalue pseudo参数：

  WebSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Web server
      GroupName: web
      VpcId: vpc-abc01234
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - !If
          - CreateProdResources
          - IpProtocol: tcp
            FromPort: 443
            ToPort: 443
            CidrIp: 0.0.0.0/0
          - !Ref AWS::NoValue

You have already defined the condition that is required for this, now you can make use of the intrinsic If function and the NoValue pseudo parameter:

  WebSecurityGroup:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      GroupDescription: Web server
      GroupName: web
      VpcId: vpc-abc01234
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
        - !If
          - CreateProdResources
          - IpProtocol: tcp
            FromPort: 443
            ToPort: 443
            CidrIp: 0.0.0.0/0
          - !Ref AWS::NoValue

回复收藏 0 原文

~没有更多了~