Python 如何在AWS CDK中指定源安全组Id?
嗨,我在AWS CDK上工作。我正在编写安全组模板。我能用云的形式写出来。现在我正在用AWS CDK编写它。我无法得到任何包含源安全组的示例。下面是我之前写的云形成模板Python 如何在AWS CDK中指定源安全组Id?,python,amazon-web-services,amazon-cloudformation,aws-cdk,Python,Amazon Web Services,Amazon Cloudformation,Aws Cdk,嗨,我在AWS CDK上工作。我正在编写安全组模板。我能用云的形式写出来。现在我正在用AWS CDK编写它。我无法得到任何包含源安全组的示例。下面是我之前写的云形成模板 Resources: MerchWebServicesSecurityGroup: Type: "AWS::EC2::SecurityGroup" Properties: Tags: - Key: "Name" Value: !Ref "AWS::StackNa
Resources:
MerchWebServicesSecurityGroup:
Type: "AWS::EC2::SecurityGroup"
Properties:
Tags:
- Key: "Name"
Value: !Ref "AWS::StackName"
GroupDescription: "EC2 Services Security Group"
VpcId:
Fn::ImportValue: "infra-vpc-base::VpcId"
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: "80"
ToPort: "80"
SourceSecurityGroupId: !Ref MerchWebServicesLoadBalancerSecurityGroup
- IpProtocol: tcp
FromPort: "443"
ToPort: "443"
SourceSecurityGroupId: !Ref MerchWebServicesLoadBalancerSecurityGroup
- IpProtocol: tcp
FromPort: 31000
ToPort: 65535
SourceSecurityGroupId: !Ref MerchWebServicesLoadBalancerSecurityGroup
MerchWebServicesLoadBalancerSecurityGroup:
Type: "AWS::EC2::SecurityGroup"
Properties:
Tags:
-
Key: "Name"
Value: !Ref "AWS::StackName"
GroupDescription: "MerchWebServices ALB Group"
VpcId:
Fn::ImportValue: "infra-vpc-base::VpcId"
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 80
ToPort: 80
CidrIp: '172.30.1.0/15'
在上面的模板中,我创建了SG MerchWebServicesSecurityGroup,并将SourceSecurityGroupId指定为另一个SG MerchWebServicesLoadBalancerSecurityGroup
#create SG MerchWebServicesLoadBalancerSecurityGroup
mws_vpc_sg_alb = ec2.SecurityGroup(self,"MerchWebServicesLoadBalancerSecurityGroup",
description = "MerchWebServices ALB Group",
security_group_name = "MerchWebServicesLoadBalancerSecurityGroup",
vpc= vpc);
mws_vpc_sg_alb.add_ingress_rule(peer = ec2.Peer.ipv4('172.30.0.0/15'), connection = ec2.Port.tcp(80));
#create SG MerchWebServicesSecurityGroup
mws_vpc_sg = ec2.SecurityGroup(self,"MerchWebServicesSecurityGroup",
description="EC2 Services Security Group",
security_group_name="MerchWebServicesSecurityGroup",
vpc = vpc);
mws_vpc_sg.add_ingress_rule(peer = ec2.Peer.ipv4(mws_vpc_sg_alb), connection = ec2.Port.tcp(80));
在上面的代码中,我试图创建SG MerchWebServicesSecurity组,下面我添加了入口规则
mws_vpc_sg.add_ingress_rule(peer = ec2.Peer.ipv4(mws_vpc_sg_alb), connection = ec2.Port.tcp(80));
这里不是指定Cidr块,而是指定SourceSecurityGroupId。在AWS CDK中,我不确定如何使用Ref并包括SourceSecurityGroupId。有人能帮我完成这个吗?任何帮助都将不胜感激。谢谢ec2.SecurityGroup实现了IPER接口,因此安全组本身可以用作对等方
mws_vpc_sg_alb.add_ingress_rule(
peer=mws_vpc_sg_alb,
connection=ec2.Port.tcp(80),
description='ALB access'
)