Question

是否可以撤销AWS安全组中的所有入口规则？是否可以撤销所有SSH入口规则？我正在尝试使用下面的cli命令，但它不起作用：

aws ec2 revoke-security-group-ingress --group-id GroupID --protocol tcp --port 22

Answer 1

根据@kuboon的建议，这是该脚本的一个更简单，有效的版本，已在zsh中进行了测试。关键区别在于：

通过显式使用--output json选项强制第一个命令返回json（这并不总是默认值）
将结果传递给--ip-permissions的参数revoke-security-group-ingress，而不是--cli-input-json所需要的json中的全格式命令（不是）。

groupId="your group-id"
aws ec2 revoke-security-group-ingress --group-id $groupId \
  --ip-permissions \
  "`aws ec2 describe-security-groups --output json --group-ids $groupId --query "SecurityGroups[0].IpPermissions"`"

Answer 2

看起来您必须单独指定每个源，例如--cidr 0.0.0.0/0或--source-group sg-12345678。

Answer 3

获取规则列表并撤消所有规则。

groupId="your group-id"
json=`aws ec2 describe-security-groups --group-id $groupId --query "SecurityGroups[0].IpPermissions"`
aws ec2 revoke-security-group-ingress --cli-input-json "{\"GroupId\": \"$groupId\", \"IpPermissions\": $json}"

Answer 4

我最终编写了一个使用AWS CLI来执行此操作的Powershell脚本。

该脚本遍历所有区域，查找默认的安全组，并删除其中的所有规则。

这里是：

# get all regions
write-host "Getting all regions.."
$regions = ([string](aws ec2 describe-regions --region eu-west-2) | ConvertFrom-Json).Regions.RegionName
write-host "Got them:"
$regions

write-host "-------------------"
write-host ""

# for all regions
foreach ($region in $regions)
{
    write-host "Getting default security groups for $region.."
    # get all subnets
    $groupIds = ([string](aws ec2 describe-security-groups --filters Name=group-name,Values=default --region $region) | ConvertFrom-Json).SecurityGroups.GroupId

    foreach ($groupId in $groupIds)
    {
        write-host "Got it: $groupId" 
        write-host "Getting all rules.."
        $rules = [string](aws ec2 describe-security-groups --group-id $groupId --query "SecurityGroups[0].IpPermissions" --region $region) | ConvertFrom-Json
        foreach ($rule in $rules)
        {
            $protocol = $rule.IpProtocol
            $cidr = $rule.IpRanges.CidrIp
            $fromPort = $rule.FromPort
            $toPort = $rule.ToPort
            $cidrIpv6 = $rule.Ipv6Ranges.CidrIpv6
            $sourceGroup = $rule.UserIdGroupPairs.GroupId
            $sourceGroupUserId = $rule.UserIdGroupPairs.UserId

            if ($protocol -eq "icmpv6") {
                $protocol = "icmp"
            }

            if (($protocol -eq "tcp") -Or ($protocol -eq "udp") -Or ($protocol -eq "icmp"))
            {                
                if ($cidr){
                    if ($fromPort -eq -1){
                        write-host "Removing rule from security group using this command:"
                        write-host "aws ec2 revoke-security-group-ingress --group-id $groupId --protocol $protocol --port "$fromPort" --cidr $cidr --region $region"
                        aws ec2 revoke-security-group-ingress --group-id $groupId --protocol $protocol --port "$fromPort" --cidr $cidr --region $region
                        write-host "Done!"

                        query
                    }
                    else {
                        write-host "Removing rule from security group using this command:"
                        write-host "aws ec2 revoke-security-group-ingress --group-id $groupId --protocol $protocol --port "$fromPort-$toPort" --cidr $cidr --region $region"
                        aws ec2 revoke-security-group-ingress --group-id $groupId --protocol $protocol --port "$fromPort-$toPort" --cidr $cidr --region $region
                        write-host "Done!"                         
                    }                    
                }
                if ($cidrIpv6){
                    $json = ('{"IpProtocol": "'+$protocol+'", "FromPort": '+$fromPort+', "ToPort": '+$toPort+', "Ipv6Ranges": [{"CidrIpv6": "'+$cidrIpv6+'"}]}') | ConvertTo-Json
                    write-host "Removing Ipv6 version of rule from security group using this command:"
                    write-host "aws ec2 revoke-security-group-ingress --group-id $groupId --ip-permissions $json --region $region"
                    aws ec2 revoke-security-group-ingress --group-id $groupId --ip-permissions $json --region $region
                    write-host "Done!"
                }
                if ($sourceGroup -and $sourceGroupUserId) 
                {
                    write-host "Removing SourceGroup rule from security group using this command:"
                    write-host "aws ec2 revoke-security-group-ingress --group-id $groupId --protocol $protocol --port "$fromPort-$toPort" --cidr $cidr --region $region"
                    aws ec2 revoke-security-group-ingress --group-id $groupId --protocol $protocol --port "$fromPort-$toPort" --source-group $sourceGroup --group-owner $sourceGroupUserId --region $region
                    write-host "Done!"
                }                
            }
            else 
            {
                if ($cidr){
                    write-host "Removing rule from security group using this command:"
                    write-host "aws ec2 revoke-security-group-ingress --group-id $groupId --protocol $protocol --cidr $cidr --region $region"
                    aws ec2 revoke-security-group-ingress --group-id $groupId --protocol $protocol --cidr $cidr --region $region
                    write-host "Done!"
                }
                if ($cidrIpv6){
                    $json = '{"IpProtocol": "-1", "Ipv6Ranges": [{"CidrIpv6": "'+$cidrIpv6+'"}]}' | ConvertTo-Json
                    write-host "Removing Ipv6 version of rule from security group using this command:"
                    write-host "aws ec2 revoke-security-group-ingress --group-id $groupId --ip-permissions $json --region $region"
                    aws ec2 revoke-security-group-ingress --group-id $groupId --ip-permissions $json --region $region
                    write-host "Done!"
                }
                if ($sourceGroup) 
                {
                    $json = '{ "IpProtocol": "-1", "UserIdGroupPairs":[{"GroupId":"'+$sourceGroup+'","UserId":"'+$sourceGroupUserId+'"}] }' | ConvertTo-Json
                    write-host "Removing SourceGroup rule from security group using this command:"
                    write-host "aws ec2 revoke-security-group-ingress --group-id $groupId --ip-permissions $json --region $region"
                    aws ec2 revoke-security-group-ingress --group-id $groupId --ip-permissions $json --region $region
                    write-host "Done!"
                }   
            }
        }        
    }    
    write-host "-------------------"
    write-host ""  
}

该脚本无法删除某些规则（自定义协议，自定义ICMP规则-IPv6），但适用于大多数规则。

我按照以下规则测试了脚本：

这是运行脚本后剩下的内容：

希望这对外面的人有帮助！

Answer 5

只是对demonicdaron脚本的一个小改进，可以将多个cidr返回到同一规则，在这种情况下，您只需在$ cidr上执行foreach（）即可遍历每个人。

但是它就像一个魅力

撤消所有AWS安全组入口规则

5 个答案: