Package: sgtools
ConceptsSecurity Groups rules in AWS have four basic components. In Situ and this
documentation, we refer to them as follows:Adirection, “in” (ingress) or “out” (egress)Anowner, the group to whom the rule belongsAnother, the subject of the rule, which may be a security group or CIDRAportspec, consisting of an IP protocol, low port, and high portIncluded ToolsSitu includes two tools for managing security group rules:sgtablesandsgmanager.sgmanageris a higher-level tool used for managing more human-friendly rule
representations.sgmanagerdepends onsgtablesto make changes in AWS.stgablesis a low-level (raw) rule processor. It consumes and generates
basic rule definitions, and is capable of modifying rulesets in AWS.These tools only manage security grouprules. They do not create or remove
the groups themselves.UsingsgmanagerHintYou can typesgmanager--helpfor detailed help about thesgmanagerCLI.There are currently threesgmanagersubcommands:groupdefs, a tool for extracting group definitions in thesgmanagerformatrender, which accepts one or more configuration files and renders
them to raw rules suitable for consumption bysgtablesreverse, which can help you convertsgtablesoutput to a set of rulesWhen usingsgmanager,vars_filesare files in thesgmanagerconfiguration format as outlined below.input_filesrefer to files containing
raw rules as output bysgtables.Hintsgmanagerconfigurations can be broken into several files for
flexibility. Consider storing accounts, CIDRs, and portspecs separately
from group definitions and rules.sgmanagerConfigurationThere are four entity types that can be defined in an sgmanager configuration:Rule - represents a single IpPermission on a SecurityGroupSecurityGroup - represents a single AWS SecurityGroupCidr - An IPv4 CIDR address/maskAccount - an AWS accountThe syntax of an sgmanager configuration is:<rule>          ::= "rule " <Direction> " " <SecurityGroup:NAME> " " ( <SecurityGroup:NAME> | <Cidr:NAME> ) " " <PortSpec:NAME>

<SecurityGroup> ::= "sg " NAME " " SG_ID

<Cidr>          ::= "cidr " NAME " " IPADDR "/" INT_MASK

<Account>       ::= "acct " NAME " " ACCOUNT_ID

<PortSpec>      ::= "proto " NAME " " <Protocol> " " <Lport> " " <Hport>
<Protocol>      ::= ( "icmp" | "tcp" | "udp" | -1 | 0 | POSITIVE_INTEGER )
<Lport>         ::= -1 | 0 | POSITIVE_INTEGER
<Hport>         ::= -1 | 0 | POSITIVE_INTEGERWhere:SG_IDis an AWS security group idIPADDRis an IPv4 addressINT_MASKis an integer between 0 and 32 (inclusive)ACCOUNT_IDis an AWS numeric account IDFor port numbers,POSITIVE_INTEGERcan be between 1 and 65535, and -1 meansall.ExampleSuppose you have a sgmanager configuration file named “myrules” containing the following:acct prd 11223344556677

cidr prd-w1 10.208.0.0/16

sg prd-w1-eop sg-12345678
sg prd-w1-app sg-abcdef12

proto ssh tcp 22 22

rule in prd-w1-eop prd-w1-app ssh
rule in prd-w1-eop prd-w1 sshRunningsgmanager prd myruleswould produce the following output:in sg-12345678 sg-abcdef12 tcp 22 22
in sg-12345678 10.208.0.0/16 tcp 22 22UsingsgtablesHintSee the output ofsgtables--helpfor complete, current information
about available options.sgtableshas four functions:list,add,remove, andupdatesgtablesalways requires an AWS profile (from ~/.aws/config), a region, and
a specific VPC to operate against (or the special name ‘classic’ for EC2
Classic).sgtablesonly operates on one network at a time. EC2 classic is
handled as its own network/VPC.All data-modification commands (everything exceptlist) accept a--noopargument (for no-op) that prevents any real changes from taking place. You can
use the--verboseflag to see more detail about the operations performed by
the command.--debugwill also include low-level details.Theaddcommand will try to add all rules passed to it (so long as the group
exists in the VPC). Similarly,removewill try to remove all rules passed to
it. You will be warned if the given rule already exists (foradd) or if it is
not found (forremove), but this will not causesgtablesto fail.updatebehaves somewhat differently than the other two. Before making changes,updateinspects the current ruleset and compares it to the input given. For
any security groupmentioned as an owner in the rules list, rules are added
if needed, then rules are removed. To put it another way,updateexpects that
the rules passed to it are theonlyrules that should be in those groups.Mentioned, in this context, means that any rule not listed as an owner in the
ruleset will not be updated.sgtablescan update all rules in all security
groups in a VPC if passed the ominuously-named--obliterateflag toupdate. When--obliterateis specified,sgtablesassumes that the
rules given to it are theonlyrules that should exist in the VPC. If a
group exists but no rules are defined for it, that group will have all of its
rules removed.