ali_security_group - Manage Alibaba Cloud Security Group and its rules.¶

New in version 2.8.

Synopsis
- Requirements
Parameters
Notes
Examples
Return Values
Status
- Author

Synopsis ¶

Create and Delete Security Group, Modify its description and add/remove rules.

Requirements ¶

The below requirements are needed on the host that executes this module.

footmark >= 1.7.0
python >= 2.6

Parameters ¶

Parameter	Choices/Defaults	Comments
alicloud_access_key		Aliyun Cloud access key. If not set then the value of environment variable `ALICLOUD_ACCESS_KEY`, `ALICLOUD_ACCESS_KEY_ID` will be used instead. aliases: access_key_id, access_key
alicloud_region		The Aliyun Cloud region to use. If not specified then the value of environment variable `ALICLOUD_REGION`, `ALICLOUD_REGION_ID` will be used instead. aliases: region, region_id
alicloud_secret_key		Aliyun Cloud secret key. If not set then the value of environment variable `ALICLOUD_SECRET_KEY`, `ALICLOUD_SECRET_ACCESS_KEY` will be used instead. aliases: secret_access_key, secret_key
alicloud_security_token		The Aliyun Cloud security token. If not specified then the value of environment variable `ALICLOUD_SECURITY_TOKEN` will be used instead. aliases: security_token
description		Description of the security group, which is a string of 2 to 256 characters. It cannot begin with http:// or https://.
group_id		(Deprecated) Security group ID. aliases: id
multi_ok bool	Choices: no ← yes	By default the module will not create another Security Group if there is another Security Group with the same name or vpc_id. Specify this as true if you want duplicate Security Groups created. There will be conflict when multi_ok=True and recent=True.
name required		Name of the security group, which is a string of 2 to 128 Chinese or English characters. It must begin with an uppercase/lowercase letter or a Chinese character and can contain numerals, "_", "." or "-". It cannot begin with http:// or https://. This is used in combination with `vpc_id` to determine if a Securty Group already exists. aliases: group_name
purge_rules bool	Choices: no yes ←	Purge existing rules on security group that are not found in rules
purge_rules_egress bool	Choices: no yes ←	Purge existing rules_egress on security group that are not found in rules_egress
recent bool	Choices: no ← yes	By default the module will not choose the recent one if there is another Security Group with the same name or vpc_id. Specify this as true if you want to target the recent Security Group. There will be conflict when multi_ok=True and recent=True.
rules		List of hash/dictionaries firewall inbound rules to enforce in this group (see example). If none are supplied, no inbound rules will be enabled. Each rule has several keys and refer to https://www.alibabacloud.com/help/doc-detail/25554.htm. Each key should be format as under_score. At present, the valid keys including "ip_protocol", "port_range", "source_port_range", "nic_type", "policy", "dest_cidr_ip", "source_cidr_ip", "source_group_id", "source_group_owner_account", "source_group_owner_id", "priority" and "description".
rules_egress		List of hash/dictionaries firewall outbound rules to enforce in this group (see example). If none are supplied, no outbound rules will be enabled. Each rule has several keys and refer to https://www.alibabacloud.com/help/doc-detail/25560.htm. Each key should be format as under_score. At present, the valid keys including "ip_protocol", "port_range", "source_port_range", "nic_type", "policy", "dest_cidr_ip", "source_cidr_ip", "dest_group_id", "dest_group_owner_account", "dest_group_owner_id", "priority" and "description".
state	Choices: present ← absent	Create, delete a security group
tags		A hash/dictionaries of security group tags. `{"key":"value"}` aliases: group_tags
vpc_id		ID of the VPC to create the group in. This is used in conjunction with the `name` to ensure idempotence.

Notes ¶

Note

If parameters are not set within the module, the following environment variables can be used in decreasing order of precedence ALICLOUD_ACCESS_KEY or ALICLOUD_ACCESS_KEY_ID, ALICLOUD_SECRET_KEY or ALICLOUD_SECRET_ACCESS_KEY, ALICLOUD_REGION or ALICLOUD_REGION_ID, ALICLOUD_SECURITY_TOKEN
ALICLOUD_REGION or ALICLOUD_REGION_ID can be typically be used to specify the ALICLOUD region, when required, but this can also be configured in the footmark config file

Examples ¶

# Note: These examples do not set authentication details, see the Alibaba Cloud Guide for details.
- name: create a new security group
  ali_security_group:
    name: 'AliyunSG'
    vpc_id: 'vpc-123csecd'

- name: authorize security group
  ali_security_group:
    name: 'AliyunSG'
    vpc_id: 'vpc-123csecd'
    rules:
      - ip_protocol: tcp
        port_range: 1/122
        source_cidr_ip: '10.159.6.18/12'
    rules_egress:
      - ip_protocol: icmp
        port_range: -1/-1
        source_cidr_ip: 10.0.0.0/10
        dest_group_id: 'sg-ce33rdsfe'
        priority: 1

- name: delete security grp
  ali_security_group:
    name: 'AliyunSG'
    vpc_id: 'vpc-123csecd'
    state: absent

Return Values ¶

Common return values are documented here, the following are the fields unique to this module:

Key		Returned	Description
group complex		always	Dictionary of security group values
	description string	always	The Security Group description. Sample: my ansible group
	tags dict	always	Tags associated with the security group
	permissions_egress list	always	Outbound rules associated with the security group. Sample: [{'nic_type': 'intranet', 'direction': 'egress', 'dest_cidr_ip': '192.168.0.54/32', 'description': 'NOne', 'create_time': '2018-06-28T08:45:59Z', 'source_cidr_ip': 'None', 'ip_protocol': 'TCP', 'source_group_owner_account': 'None', 'dest_group_owner_account': 'None', 'dest_group_name': 'None', 'priority': 1, 'port_range': '80/80', 'source_group_id': 'None', 'policy': 'Accept', 'source_group_name': 'None', 'dest_group_id': 'None'}]
	group_name string	always	Security group name Sample: my-ansible-group
	inner_access_policy bool	always	Whether can access each other in one security group. Sample: True
	vpc_id string	always	ID of VPC to which the security group belongs Sample: vpc-abcd1234
	group_id string	always	Security group id Sample: sg-abcd1234
	id string	always	Alias of "group_id". Sample: sg-abcd1234
	permissions list	always	Inbound rules associated with the security group. Sample: [{'nic_type': 'intranet', 'direction': 'ingress', 'dest_cidr_ip': 'None', 'description': 'None', 'create_time': '2018-06-28T08:45:58Z', 'source_cidr_ip': '0.0.0.0/0', 'ip_protocol': 'TCP', 'source_group_owner_account': 'None', 'dest_group_owner_account': 'None', 'dest_group_name': 'None', 'priority': 1, 'port_range': '22/22', 'source_group_id': 'None', 'policy': 'Accept', 'source_group_name': 'None', 'dest_group_id': 'None'}]

Status ¶

This module is flagged as preview which means that it is not guaranteed to have a backwards compatible interface.

Author ¶

He Guimin (@xiaozhu36)

Hint

If you notice any issues in this documentation you can edit this document to improve it.