Skip to content

Resource: awsVpcSecurityGroupIngressRule

Manages an inbound (ingress) rule for a security group.

When specifying an inbound rule for your security group in a VPC, the configuration must include a source for the traffic.

\~> NOTE on Security Groups and Security Group Rules: Terraform currently provides a Security Group resource with ingress and egress rules defined in-line and a Security Group Rule resource which manages one or more ingress or egress rules. Both of these resource were added before AWS assigned a security group rule unique ID, and they do not work well in all scenarios using thedescription and tags attributes, which rely on the unique ID. The awsVpcSecurityGroupIngressRule resource has been added to address these limitations and should be used for all new security group rules. You should not use the awsVpcSecurityGroupIngressRule resource in conjunction with an awsSecurityGroup resource with in-line rules or with awsSecurityGroupRule resources defined for the same Security Group, as rule conflicts may occur and rules will be overwritten.

Example Usage

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as aws from "./.gen/providers/aws";
new aws.vpcSecurityGroupIngressRule.VpcSecurityGroupIngressRule(
  this,
  "example",
  {
    cidrIpv4: "10.0.0.0/8",
    fromPort: 80,
    ipProtocol: "tcp",
    securityGroupId: "${aws_security_group.example.id}",
    toPort: 8080,
  }
);

Argument Reference

The following arguments are supported:

  • cidrIpv4 - (Optional) The source IPv4 CIDR range.
  • cidrIpv6 - (Optional) The source IPv6 CIDR range.
  • description - (Optional) The security group rule description.
  • fromPort - (Optional) The start of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type.
  • ipProtocol - (Optional) The IP protocol name or number. Use 1 to specify all protocols.
  • prefixListId - (Optional) The ID of the source prefix list.
  • referencedSecurityGroupId - (Optional) The source security group that is referenced in the rule.
  • securityGroupId - (Required) The ID of the security group.
  • tags - (Optional) A map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
  • toPort - (Optional) The end of port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.

Attributes Reference

In addition to all arguments above, the following attributes are exported:

  • arn - The Amazon Resource Name (ARN) of the security group rule.
  • securityGroupRuleId - The ID of the security group rule.
  • tagsAll - A map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.

Import

Security group ingress rules can be imported using the securityGroupRuleId, e.g.,

$ terraform import aws_vpc_security_group_ingress_rule.example sgr-02108b27edd666983