我有大量的IP（＆GT; 100）清单，需要在EC2实例上进行入站和出站通信。有没有办法集体白名单？ （IPS也不属于范围，并且是不连续的）。我们使用安全组用于白名单IP的安全组很弯腰，但是我找不到一种简单的方法来将大量的IPS集成。
PS-我尝试在AWS WAF中探索IP集，但是它需要设置应用程序负载均衡器，此外，由于我们已经在使用安全组，因此在应用程序层（通过WAF）阻止IPS（通过WAF）也将阻止已经在该ips上列入白色的IP EC2级别。
提前致谢！
I have a large list of IPs (>100) that need to be whitelisted for both inbound and outbound communication on EC2 instances. Is there a way to whitelist them collectively? (The IPs also don't belong to a range and are discontinuous). We are currenlty using security groups for whitelisting IPs, but I couldn't find an easy way to whitelist a large collection of IPs.
PS- I tried exploring IP sets in AWS WAF, but it requires setting up an application load balancer, additionally since we are already using security groups, blocking IPs at the application layer (via WAF) will also block IPs that are already whitelisted at the EC2 level.
Thanks in Advance!
发布评论
评论（6）
您可以使用托管前缀列表您使配置和维护安全组更容易。
请记住，前缀列表中的每个条目通常在您的SG中计数，因此您可能需要要求增加默认配额（每个安全组60个入站和60个出站规则）。
You can use managed prefix lists which allows you to make it easier to configure and maintain your security groups.
Keep in mind that every entry in the prefix list count as a rule in your SG, so probably you will need to request an increase of the default quota (60 inbound and 60 outbound rules per security group).
对于EC2端口，您获得的最佳选择是安全组。但是，您最好使用IAC来管理诸如Terraform或CloudFormation之类的它 - 它将帮助您更好地管理IP列表并将它们全部保存在一个文件中。
这是Terraform的参考：
For an EC2 port access the best option you got is security groups. But you better use IaC to manage this such as Terraform or CloudFormation - it will help you to better manage the IP list and save them all in one file.
Here is a reference for Terraform: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group
另一个简单的选择是，您维护CSV文件以存储IP地址并使用Python脚本来更新您的安全组。由于使用Excel/CSV文件更受欢迎，因此您可以轻松地找到python脚本来读取CSV文件和使用Boto3来更新您的安全组。
Another easy option is you maintain a csv file to store IP addresses and use a python script to update your security group. Since working with Excel/csv files are more popular you can easily find python scripts to read csv files and the use boto3 to update your security group.
在安全组中维持白名单的IP，这是我相信的最佳选择，您不需要入站和出站。
由于安全组是有状态的，因此您需要仅在入站规则中提及白名单的IP。
（您可能有不同的出站用例，我不确定）
但是，我认为通过自动化处理它的最佳方法。您可以创建一个具有不同规则条目的DynamoDB表，启用DynamoDB流，任何更改都会触发一个lambda，该lambda会创建/修改与EC2关联的安全组。
Maintaining the whitelisted IPs in a Security group, which is the best option I believe, you don't need for both inbound and outbound.
Since Security group is stateful, you need to mention whitelisted IPs in inbound rule only.
(You may have different use case for outbound, which I am not sure)
However, I think the best way to handle it via an automation. You can create a Dynamodb table with different rule entries, enable dynamodb stream, any change triggers a Lambda which inturn creates/amends security group associated with the EC2.
您可以使用IP前缀列表来简化设计并在需要时使用它。
您可以使用以下链接以获取更多信息。
https://aws.amazon.com/about-aws/whats/whats-new/2020/06/amazon-azon-virtual-private-private-cloud-cloud-customers-use-use-prefix-lists -implify-configuration-security-groups-route-tables/
https://aws.amazon.com/blogs/networking-and-content-delivery/simplify-network-routing-and-security- with-vpc-prefix-lists/
You can use IP prefix list to simplify your design and use it where required.
You can use below link for more info.
https://aws.amazon.com/about-aws/whats-new/2020/06/amazon-virtual-private-cloud-customers-use-prefix-lists-simplify-configuration-security-groups-route-tables/
https://aws.amazon.com/blogs/networking-and-content-delivery/simplify-network-routing-and-security-administration-with-vpc-prefix-lists/
我知道这很晚，但是如果基于Linux的Linux，则可以允许所有IPS上的所有IPS，然后设置Iptables以明确允许这些IP地址并阻止其他任何内容。
I know it's pretty late but you can allow all IPs on your security group and inside your ec2 machine if it's Linux based then set iptables to explicitly allow those ip addresses and block anything else.