json - 具有 50 个 CIDR IP 的安全组的 Cloudformation 模板(JSON)(入口)

Question

我正在为安全组创建云形成模板，其入口规则超过 50 个 CIDR IP。在参数中，我对多个 CIDR IP 使用 Commadelimited 列表。是否可以在单个代码中包含多个 CidrIps，而不是在 SecurityGroupIngress 中为每个 CIDR IP 创建单独的值。

                    {
                        "IpProtocol" : "tcp",
                        "CidrIp" : "54.183.255.128/26",
                        "FromPort" : "443",
                        "ToPort" : "443"
                    },
                    {
                        "IpProtocol" : "tcp",
                        "CidrIp" : "54.228.16.0/26", 
                        "FromPort" : "443",
                        "ToPort" : "443"
                    },
                    {
                        "IpProtocol" : "tcp",
                        "CidrIp" :  "54.232.40.64/26", 
                        "FromPort" : "443",
                        "ToPort" : "443"
                    },
                    {
                        "IpProtocol" : "tcp",
                        "CidrIp" : "54.241.32.64/26", 
                        "FromPort" : "443",
                        "ToPort" : "443"
                    },

我想使用如下所示的模板。但在这里我只能获得 1 位 CIDR IP。

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "HTTPS - Security Group",
    "Parameters": {
        "VPC": {
            "Type": "AWS::EC2::VPC::Id",
            "Description": "VPC where the Security Group will belong"
        },
        "Name": {
            "Type": "String",
            "Description": "Name Tag of the Security Group"
        },
        "DbSubnetIpBlocks": {
            "Description": "Comma-delimited list of CIDR blocks",
            "Type": "CommaDelimitedList"
        }
    },
    "Resources": {
        "MySG": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupDescription": {
                    "Ref": "Description"
                },
                "VpcId": {
                    "Ref": "VPC"
                },
                "SecurityGroupIngress": [
                    {
                        "IpProtocol": "tcp",
                        "CidrIp": {
                            "Fn::Select": [
                                "1",
                                {
                                    "Ref": "DbSubnetIpBlocks"
                                }
                            ]
                        },
                        "FromPort": "443",
                        "ToPort": "443"
                    }
                ]
            }
        }
    },
    "Outputs": {
        "SecurityGroupID": {
            "Description": "Security Group ID",
            "Value": {
                "Ref": "MySG"
            }
        }

Answer 1

遗憾的是这是不可能的。一条安全组 (SG) 规则仅适用于一个 CIDR 范围。

限制为60 SG 中的规则，您可以请求增加这些规则。

尽管单个 SG 规则可以引用单个 CIDR，但您可以创建 CloudFormation macro或custom resource自动为您创建所有这些规则。