SecurityGroup

ec2.services.k8s.aws/v1alpha1

Type	Link
GoDoc	ec2-controller/apis/v1alpha1#SecurityGroup

Metadata

Property	Value
Scope	Namespaced
Kind	`SecurityGroup`
ListKind	`SecurityGroupList`
Plural	`securitygroups`
Singular	`securitygroup`

Describes a security group.

Spec

description: string
egressRules:
- fromPort: integer
  ipProtocol: string
  ipRanges:
  - cidrIP: string
    description: string
  ipv6Ranges:
  - cidrIPv6: string
    description: string
  prefixListIDs:
  - description: string
    prefixListID: string
  toPort: integer
  userIDGroupPairs:
  - description: string
    groupID: string
    groupName: string
    groupRef: 
      from: 
        name: string
        namespace: string
    peeringStatus: string
    userID: string
    vpcID: string
    vpcPeeringConnectionID: string
    vpcRef: 
      from: 
        name: string
        namespace: string
ingressRules:
- fromPort: integer
  ipProtocol: string
  ipRanges:
  - cidrIP: string
    description: string
  ipv6Ranges:
  - cidrIPv6: string
    description: string
  prefixListIDs:
  - description: string
    prefixListID: string
  toPort: integer
  userIDGroupPairs:
  - description: string
    groupID: string
    groupName: string
    groupRef: 
      from: 
        name: string
        namespace: string
    peeringStatus: string
    userID: string
    vpcID: string
    vpcPeeringConnectionID: string
    vpcRef: 
      from: 
        name: string
        namespace: string
name: string
tags:
- key: string
  value: string
vpcID: string
vpcRef: 
  from: 
    name: string
    namespace: string

Field	Description
description Required	string A description for the security group. This is informational only. Constraints: Up to 255 characters in length Constraints for EC2-Classic: ASCII characters Constraints for EC2-VPC: a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=&;{}!$*
egressRules Optional	array
egressRules.[] Required	object Describes a set of permissions for a security group rule.
egressRules.[].ipProtocol Optional	string
egressRules.[].ipRanges Optional	array
egressRules.[].ipRanges.[] Required	object Describes an IPv4 range.
egressRules.[].ipRanges.[].description Optional	string
egressRules.[].ipv6Ranges Optional	array
egressRules.[].ipv6Ranges.[] Required	object [EC2-VPC only] Describes an IPv6 range.
egressRules.[].ipv6Ranges.[].description Optional	string
egressRules.[].prefixListIDs Optional	array
egressRules.[].prefixListIDs.[] Required	object Describes a prefix list ID.
egressRules.[].prefixListIDs.[].prefixListID Optional	string
egressRules.[].toPort Optional	integer
egressRules.[].userIDGroupPairs Optional	array
egressRules.[].userIDGroupPairs.[] Required	object Describes a security group and Amazon Web Services account ID pair.

We are retiring EC2-Classic on August 15, 2022. We recommend that you migrate from EC2-Classic to a VPC. For more information, see Migrate from EC2-Classic to a VPC (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-migrate.html) in the Amazon Elastic Compute Cloud User Guide. || egressRules.[].userIDGroupPairs.[].description
Optional | string
| | egressRules.[].userIDGroupPairs.[].groupID
Optional | string
| | egressRules.[].userIDGroupPairs.[].groupName
Optional | string
| | egressRules.[].userIDGroupPairs.[].groupRef
Optional | object
Reference field for GroupID | | egressRules.[].userIDGroupPairs.[].groupRef.from
Optional | object
AWSResourceReference provides all the values necessary to reference another
k8s resource for finding the identifier(Id/ARN/Name) | | egressRules.[].userIDGroupPairs.[].groupRef.from.name
Optional | string
| | egressRules.[].userIDGroupPairs.[].groupRef.from.namespace
Optional | string
| | egressRules.[].userIDGroupPairs.[].peeringStatus
Optional | string
| | egressRules.[].userIDGroupPairs.[].userID
Optional | string
| | egressRules.[].userIDGroupPairs.[].vpcID
Optional | string
| | egressRules.[].userIDGroupPairs.[].vpcPeeringConnectionID
Optional | string
| | egressRules.[].userIDGroupPairs.[].vpcRef
Optional | object
Reference field for VPCID | | egressRules.[].userIDGroupPairs.[].vpcRef.from
Optional | object
AWSResourceReference provides all the values necessary to reference another
k8s resource for finding the identifier(Id/ARN/Name) | | egressRules.[].userIDGroupPairs.[].vpcRef.from.name
Optional | string
| | egressRules.[].userIDGroupPairs.[].vpcRef.from.namespace
Optional | string
| | ingressRules
Optional | array
| | ingressRules.[]
Required | object
Describes a set of permissions for a security group rule. || ingressRules.[].fromPort
Optional | integer
| | ingressRules.[].ipProtocol
Optional | string
| | ingressRules.[].ipRanges
Optional | array
| | ingressRules.[].ipRanges.[]
Required | object
Describes an IPv4 range. || ingressRules.[].ipRanges.[].cidrIP
Optional | string
| | ingressRules.[].ipRanges.[].description
Optional | string
| | ingressRules.[].ipv6Ranges
Optional | array
| | ingressRules.[].ipv6Ranges.[]
Required | object
[EC2-VPC only] Describes an IPv6 range. || ingressRules.[].ipv6Ranges.[].cidrIPv6
Optional | string
| | ingressRules.[].ipv6Ranges.[].description
Optional | string
| | ingressRules.[].prefixListIDs
Optional | array
| | ingressRules.[].prefixListIDs.[]
Required | object
Describes a prefix list ID. || ingressRules.[].prefixListIDs.[].description
Optional | string
| | ingressRules.[].prefixListIDs.[].prefixListID
Optional | string
| | ingressRules.[].toPort
Optional | integer
| | ingressRules.[].userIDGroupPairs
Optional | array
| | ingressRules.[].userIDGroupPairs.[]
Required | object
Describes a security group and Amazon Web Services account ID pair.

We are retiring EC2-Classic on August 15, 2022. We recommend that you migrate from EC2-Classic to a VPC. For more information, see Migrate from EC2-Classic to a VPC (https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/vpc-migrate.html) in the Amazon Elastic Compute Cloud User Guide. || ingressRules.[].userIDGroupPairs.[].description
Optional | string
| | ingressRules.[].userIDGroupPairs.[].groupID
Optional | string
| | ingressRules.[].userIDGroupPairs.[].groupName
Optional | string
| | ingressRules.[].userIDGroupPairs.[].groupRef
Optional | object
Reference field for GroupID | | ingressRules.[].userIDGroupPairs.[].groupRef.from
Optional | object
AWSResourceReference provides all the values necessary to reference another
k8s resource for finding the identifier(Id/ARN/Name) | | ingressRules.[].userIDGroupPairs.[].groupRef.from.name
Optional | string
| | ingressRules.[].userIDGroupPairs.[].groupRef.from.namespace
Optional | string
| | ingressRules.[].userIDGroupPairs.[].peeringStatus
Optional | string
| | ingressRules.[].userIDGroupPairs.[].userID
Optional | string
| | ingressRules.[].userIDGroupPairs.[].vpcID
Optional | string
| | ingressRules.[].userIDGroupPairs.[].vpcPeeringConnectionID
Optional | string
| | ingressRules.[].userIDGroupPairs.[].vpcRef
Optional | object
Reference field for VPCID | | ingressRules.[].userIDGroupPairs.[].vpcRef.from
Optional | object
AWSResourceReference provides all the values necessary to reference another
k8s resource for finding the identifier(Id/ARN/Name) | | ingressRules.[].userIDGroupPairs.[].vpcRef.from.name
Optional | string
| | ingressRules.[].userIDGroupPairs.[].vpcRef.from.namespace
Optional | string
| | name
Required | string
The name of the security group.

Constraints: Up to 255 characters in length. Cannot start with sg-.

Constraints for EC2-Classic: ASCII characters

Constraints for EC2-VPC: a-z, A-Z, 0-9, spaces, and ._-:/()#,@[]+=&;{}!$* | | **tags**
Optional | **array**
The tags. The value parameter is required, but if you don’t want the tag
to have a value, specify the parameter with no value, and we set the value
to an empty string. | | **tags.[]**
Required | **object**
Describes a tag. || **tags.[].key**
Optional | **string**
| | **tags.[].value**
Optional | **string**
| | **vpcID**
Optional | **string**
[EC2-VPC] The ID of the VPC. Required for EC2-VPC. | | **vpcRef**
Optional | **object**
AWSResourceReferenceWrapper provides a wrapper around *AWSResourceReference
type to provide more user friendly syntax for references using ‘from’ field
Ex:
APIIDRef:

from:
name: my-api | | **vpcRef.from**
Optional | **object**
AWSResourceReference provides all the values necessary to reference another
k8s resource for finding the identifier(Id/ARN/Name) | | **vpcRef.from.name**
Optional | **string**
| | **vpcRef.from.namespace**
Optional | **string**
|

Status

ackResourceMetadata: 
  arn: string
  ownerAccountID: string
  region: string
conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
id: string
rules:
- cidrIPv4: string
  cidrIPv6: string
  description: string
  fromPort: integer
  ipProtocol: string
  isEgress: boolean
  prefixListID: string
  securityGroupRuleID: string
  tags:
  - key: string
    value: string
  toPort: integer

Field	Description
ackResourceMetadata Optional	object All CRs managed by ACK have a common `Status.ACKResourceMetadata` member that is used to contain resource sync state, account ownership, constructed ARN for the resource
ackResourceMetadata.arn Optional	string ARN is the Amazon Resource Name for the resource. This is a globally-unique identifier and is set only by the ACK service controller once the controller has orchestrated the creation of the resource OR when it has verified that an “adopted” resource (a resource where the ARN annotation was set by the Kubernetes user on the CR) exists and matches the supplied CR’s Spec field values. https://github.com/aws/aws-controllers-k8s/issues/270
ackResourceMetadata.ownerAccountID Required	string OwnerAccountID is the AWS Account ID of the account that owns the backend AWS service API resource.
ackResourceMetadata.region Required	string Region is the AWS region in which the resource exists or will exist.
conditions Optional	array All CRS managed by ACK have a common `Status.Conditions` member that contains a collection of `ackv1alpha1.Condition` objects that describe the various terminal states of the CR and its backend AWS service API resource
conditions.[] Required	object Condition is the common struct used by all CRDs managed by ACK service
controllers to indicate terminal states of the CR and its backend AWS
service API resource
conditions.[].message Optional	string A human readable message indicating details about the transition.
conditions.[].reason Optional	string The reason for the condition’s last transition.
conditions.[].status Optional	string Status of the condition, one of True, False, Unknown.
conditions.[].type Optional	string Type is the type of the Condition
id Optional	string The ID of the security group.
rules Optional	array Information about security group rules.
rules.[] Required	object Describes a security group rule.
rules.[].cidrIPv6 Optional	string
rules.[].description Optional	string
rules.[].fromPort Optional	integer
rules.[].ipProtocol Optional	string
rules.[].isEgress Optional	boolean
rules.[].prefixListID Optional	string
rules.[].securityGroupRuleID Optional	string
rules.[].tags Optional	array
rules.[].tags.[] Required	object Describes a tag.
rules.[].tags.[].value Optional	string
rules.[].toPort Optional	integer

SecurityGroup

Metadata#

Spec#

Status#

Metadata

Spec

Status