Removing Rules from a Security Group

You can remove an inbound or outbound rule from a security group at any time, even the initial rules contained in default or custom security groups. Once the rule is removed, your modifications are automatically applied and the corresponding flows are no longer allowed.

Removing a Rule from a Security Group Using Cockpit

  1. Click Network/Security > Security Groups.

  2. Click the security group you want to remove a rule from.
    The security group is selected.

  3. Click the rule you want to remove.
    The rule is selected.

  4. Click Delete rule .
    A confirmation dialog box appears.

  5. Click Delete to validate.
    The selected rule is deleted.

Removing Rules from a Security Group Using AWS CLI

Removing Inbound Flows Rules from a Security Group

To remove one or more rules for inbound flows, use the revoke-security-group-ingress command following this syntax:

Request sample
$ aws ec2 revoke-security-group-ingress \
    --profile YOUR_PROFILE \
    --group-name my-security-group \
    [--group-id NOT_SPECIFIED] \
    [--protocol NOT_SPECIFIED] \
    [--port NOT_SPECIFIED] \
    [--cidr NOT_SPECIFIED] \
    [--source-group NOT_SPECIFIED] \
    [--group-owner NOT_SPECIFIED] \
    --ip-permissions "[ \
                        { \
                        \"IpProtocol\": \"tcp\", \
                        \"FromPort\": 22, \
                        \"ToPort\": 22, \
                        \"IpRanges\": [ \
                                        { \
                                        \"CidrIp\": \"10.0.0.0/16\" \
                                        } \
                                      ], \
                        \"UserIdGroupPairs\": [ \
                                                { \
                                                \"UserId\": \"123456789000\", \
                                                \"GroupName\": \"dev-sg\", \
                                                \"GroupId\": \"sg-87654321\" \
                                                } \
                                              ] \
                        } \
                      ]" \
    --endpoint https://fcu.eu-west-2.outscale.com

This command contains the following attributes that you need to specify:

  • (optional) profile: The named profile you want to use, created when configuring AWS CLI. For more information, see Installing and Configuring AWS CLI.

  • (optional) group-name: The name of the security group, if you are in the public Cloud.

  • (optional) group-id: The ID of the security group.

    Among the following attributes, you need to specify either:

    • the protocol, port, and cidr attributes

    • the protocol, port, source-group, and group-owner attributes

    • the ip-permissions attribute

  • (optional) protocol: The IP protocol name (tcp, udp, icmp, or -1 for all protocols). By default, -1. In a VPC, this can also be an IP protocol number. For more information, see the IANA.org website.

  • (optional) port: The port as a single integer or range of ports in the min-max format for TCP and UDP protocols, or an ICMP type number and code in the type-code format (-1 to indicate all ICMP types).

  • (optional) cidr: The range of IPs you want to allow, in CIDR notation (/32 prefix for a single IP).

  • (optional) source-group: The name or ID of the source security group from which flows are allowed by the rule you want to remove.

  • (optional) group-owner: The account ID of the owner of the source security group, if it belongs to another account.

  • (optional) ip-permissions: A set of permissions that can be used to remove several rules in the same request. This attribute contains the following elements that you need to specify:

    • (optional) IpProtocol: The IP protocol name (tcp, udp, icmp, or -1 for all protocols). By default, -1. In a VPC, this can also be an IP protocol number. For more information, see the IANA.org website.

    • (optional) FromPort: The beginning of the port range for the TCP and UDP protocols, or an ICMP type number (-1 to indicate all ICMP types).

    • (optional) ToPort: The end of port range for the TCP and UDP protocols, or an ICMP code number (-1 to indicate all ICMP codes).

    • (optional) IpRanges: One or more IP ranges.

      • (optional) CidrIp: The range of IPs.

    • (optional) UserIdGroupPairs: Information about one or more accounts and security groups to remove permissions for flows from security groups of other accounts. This attribute contains the following elements that you need to specify:

      • (optional) UserId: The account ID of the owner of the referenced security group.

      • (optional) GroupName: The name of the referenced security group.

      • (optional) GroupId: The ID of the referenced security group.

  • endpoint: The endpoint corresponding to the Region you want to send the request to.

The specified rules are removed from the security group.

(VPC only) Removing Outbound Flows Rules from a Security Group

To remove one or more rules for outbound flows, use the revoke-security-group-egress command following this syntax:

Request sample
$ aws ec2 revoke-security-group-egress \
    --profile YOUR_PROFILE \
    --group-id my-security-group \
    [--protocol NOT_SPECIFIED] \
    [--port NOT_SPECIFIED] \
    [--cidr NOT_SPECIFIED] \
    [--source-group NOT_SPECIFIED] \
    [--group-owner NOT_SPECIFIED] \
    --ip-permissions "[ \
                        { \
                        \"IpProtocol\": \"tcp\", \
                        \"FromPort\": 22, \
                        \"ToPort\": 22, \
                        \"IpRanges\": [ \
                                        { \
                                        \"CidrIp\": \"10.0.0.0/16\" \
                                        } \
                                      ], \
                        \"UserIdGroupPairs\": [ \
                                                { \
                                                \"UserId\": \"123456789000\", \
                                                \"GroupName\": \"dev-sg\", \
                                                \"GroupId\": \"sg-87654321\" \
                                                } \
                                              ], \
                        \"PrefixListIds\": [ \
                                             { \
                                             \"PrefixListId\": \"pl-12345678\" \
                                             } \
                                           ] \
                        } \
                      ]" \
    --endpoint https://fcu.eu-west-2.outscale.com

This command contains the following attributes that you need to specify:

  • (optional) profile: The named profile you want to use, created when configuring AWS CLI. For more information, see Installing and Configuring AWS CLI.

  • group-id: The ID of the security group.

    Among the following attributes, you need to specify either:

    • the protocol, port, and cidr attributes

    • the protocol, port, source-group, and group-owner attributes

    • the ip-permissions attribute

  • (optional) protocol: The IP protocol name (tcp, udp, icmp, or -1 for all protocols). By default, -1. In a VPC, this can also be an IP protocol number. For more information, see the IANA.org website.

  • (optional) port: The port as a single integer or range of ports in the min-max format for TCP and UDP protocols, or an ICMP type number and code in the type-code format (-1 to indicate all ICMP types).

  • (optional) cidr: The range of IPs you want to allow, in CIDR notation (/32 prefix for a single IP).

  • (optional) source-group: The name or ID of the source security group from which flows are allowed by the rule you want to remove.

  • (optional) group-owner: The account ID of the owner of the source security group, if it belongs to another account.

  • (optional) ip-permissions: A set of permissions that can be used to remove several rules in the same request. This attribute contains the following elements that you need to specify:

    • (optional) IpProtocol: The IP protocol name (tcp, udp, icmp, or -1 for all protocols). By default, -1. In a VPC, this can also be an IP protocol number. For more information, see the IANA.org website.

    • (optional) FromPort: The beginning of the port range for the TCP and UDP protocols, or an ICMP type number (-1 to indicate all ICMP types).

    • (optional) ToPort: The end of port range for the TCP and UDP protocols, or an ICMP code number (-1 to indicate all ICMP types).

    • (optional) IpRanges: One or more IP ranges.

      • (optional) CidrIp: The range of IPs.

    • (optional) UserIdGroupPairs: Information about one or more accounts and security groups to remove permissions for flows from security groups of other accounts. This attribute contains the following elements that you need to specify:

      • (optional) UserId: The account ID of the owner of the referenced security group.

      • (optional) GroupName: The name of the referenced security group.

      • (optional) GroupId: The ID of the referenced security group.

    • (optional) PrefixListIds: One or more prefix list IDs. For more information, see Getting Information About Prefix Lists.

      • (optional) PrefixListId: The ID of a prefix list.

  • endpoint: The endpoint corresponding to the Region you want to send the request to.

The specified rules are removed from the security group.

Related Pages

Corresponding API Methods

AWS™ and Amazon Web Services™ are trademarks of Amazon Technologies, Inc or its affiliates in the United States and/or other countries.