如何添加引用另一个安全组的规则？

Question

我在yaml模板中有以下安全组。我希望"SecurityGroupApplication“安全组允许来自"SecurityGroupBastion”的传入连接。然而，aws客户端的验证-模板函数告诉我像“不支持的结构”这样的无用信息。好的，但是这个结构有什么问题？想法？

Resources:
  SecurityGroupBastion:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Bastion security group
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
      VpcId: !Ref vpcId
  SecurityGroupApplication:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Application security group
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref SecurityGroupBastion
          IpProtocol: tcp

Answer 1

您的模板非常适合我，只是我必须为指定端口：

Resources:
  SecurityGroupBastion:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Bastion security group
      SecurityGroupIngress:
        - CidrIp: 0.0.0.0/0
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
      VpcId: vpc-abcd1234
  SecurityGroupApplication:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Application security group
      SecurityGroupIngress:
        - SourceSecurityGroupId: !Ref SecurityGroupBastion
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22

Answer 2

如果您希望SecurityGroupApplication是一个安全组，那么您应该使用Type: AWS::EC2::SecurityGroup而不是Type: AWS::EC2::SecurityGroupIngress。这可能是您所看到的“不支持的结构”错误的原因。

Answer 3

如果有人陷入了这个老问题，现在有一种方法可以在cloudformation中引用跨帐户SG，所以如果您想添加指向另一个AWS帐户的SG入口规则，只需添加键SourceSecurityGroupOwnerId和account ID即可。

即

AWSTemplateFormatVersion: 2010-09-09
Resources:
  TargetSG:
    Type: 'AWS::EC2::SecurityGroup'
    Properties:
      VpcId: vpc-1a2b3c4d
      GroupDescription: Security group allowing ingress for security scanners
  InboundRule:
    Type: 'AWS::EC2::SecurityGroupIngress'
    Properties:
      GroupId: !GetAtt TargetSG.GroupId
      IpProtocol: tcp
      FromPort: 80
      ToPort: 80
      SourceSecurityGroupId: sg-12345678 # SG in the other AWS account
      SourceSecurityGroupOwnerId: '123456789012' # Account ID