Menu
How can I connect two security groups together using the AWS CDK?
This is an example of allow IPv4 traffic ingress via port 443
ec2SecurityGroup.addIngressRule(Peer.anyIpv4(), Port.tcp(443), 'Test rule', false)
This from the documentation:
public addIngressRule(peer: IPeer, connection: Port, description?: string, remoteRule?: boolean): void
This is the best I could come up with (where 'elbSecurityGroup' is another security group):
const p = Peer.anyIpv4()
p.connections.allowFrom(elbSecurityGroup.connections, Port.tcp(443))
ec2SecurityGroup.addIngressRule(p, Port.tcp(443), 'Test rule', false)
But that doesn't really make any sense. There must be a better way of Initializing the Peer. Typescript says
Constructor of class 'Peer' is protected and only accessible within the class declaration.
If I try:
const p = new Peer()
951
AWS::EC2::SecurityGroup Ingress. Adds an inbound rule to a security group. An inbound rule permits instances to receive traffic from the specified IPv4 or IPv6 CIDR address range, or from the instances associated with the specified security group.
Egress in the world of networking implies traffic that exits an entity or a network boundary, while Ingress is traffic that enters the boundary of a network.
Think of it as applying firewall settings to individual instances (or rather, virtual NICs within an instance). Another thing that you need to know about VPC security groups is that you can apply multiple security groups to a single network adapter.
That system is known as CIDR notation. CIDR IP addresses consist of two groups of numbers, which are also referred to as groups of bits. The most important of these groups is the network address, and it is used to identify a network or a sub-network (subnet). The lesser of the bit groups is the host identifier.
This can be done by accessing the 'connections' on SecurityGroups or other Constructs directly
ec2SecurityGroup.connections.allowFrom(elbSecurityGroup, Port.tcp(443), 'Application Load Balancer')
Or from an EC2 Instance object directly to another EC2 instance:
ec2Instance1.connections.allowFrom(ec2Instance2, Port.tcp(4321), 'Inbound')
ec2Instance2.connections.allowTo(ec2Instance1, Port.tcp(4321), 'Outbound')
This will create/alter a SecurityGroup created by CDK that is attached to the EC2 instance.
96
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With