Obtenir des informations sur vos security groups

Vous pouvez obtenir des informations à propos d’un ou plusieurs security groups et les règles qu’ils contiennent.

Des informations sur vos security groups sont également disponibles depuis les machines virtuelles (VM) elles-mêmes. Pour en savoir plus, voir Accéder aux metadata et user data d’une VM.

Obtenir des informations sur vos security groups avec Cockpit v2

Voir le dashboard Security Groups.

Obtenir des informations sur vos security groups avec OSC CLI

À ce jour, cette section est disponible en anglais uniquement.

The ReadSecurityGroups command lists one or more security groups.
You can specify either the name of the security groups or their IDs.

Request sample

$ osc-cli api ReadSecurityGroups --profile "default" \
    --Filters '{
        "SecurityGroupIds": ["sg-12345678"]
      }'

Request sample

$ osc-cli api ReadSecurityGroups --profile "default" \
    --Filters '{
        "InboundRuleIpRanges": ["192.0.2.0"]
      }'

This command contains the following attributes that you need to specify:

DryRun: (optional) If true, checks whether you have the required permissions to perform the action.
Filters: (optional) One or more filters.
- Descriptions: (optional) The descriptions of the security groups.
- InboundRuleAccountIds: (optional) The account IDs that have been granted permissions.
- InboundRuleFromPortRanges: (optional) The beginnings of the port ranges for the TCP and UDP protocols, or the ICMP type numbers.
- InboundRuleIpRanges: (optional) The IP ranges that have been granted permissions, in CIDR notation (for example, 10.0.0.0/24).
- InboundRuleProtocols: (optional) The IP protocols for the permissions (tcp | udp | icmp, or a protocol number, or -1 for all protocols).
- InboundRuleSecurityGroupIds: (optional) The IDs of the security groups that have been granted permissions.
- InboundRuleSecurityGroupNames: (optional) The names of the security groups that have been granted permissions.
- InboundRuleToPortRanges: (optional) The ends of the port ranges for the TCP and UDP protocols, or the ICMP code numbers.
- NetIds: (optional) The IDs of the Nets specified when the security groups were created.
- OutboundRuleAccountIds: (optional) The account IDs that have been granted permissions.
- OutboundRuleFromPortRanges: (optional) The beginnings of the port ranges for the TCP and UDP protocols, or the ICMP type numbers.
- OutboundRuleIpRanges: (optional) The IP ranges that have been granted permissions, in CIDR notation (for example, 10.0.0.0/24).
- OutboundRuleProtocols: (optional) The IP protocols for the permissions (tcp | udp | icmp, or a protocol number, or -1 for all protocols).
- OutboundRuleSecurityGroupIds: (optional) The IDs of the security groups that have been granted permissions.
- OutboundRuleSecurityGroupNames: (optional) The names of the security groups that have been granted permissions.
- OutboundRuleToPortRanges: (optional) The ends of the port ranges for the TCP and UDP protocols, or the ICMP code numbers.
- SecurityGroupIds: (optional) The IDs of the security groups.
- SecurityGroupNames: (optional) The names of the security groups.
- TagKeys: (optional) The keys of the tags associated with the security groups.
- TagValues: (optional) The values of the tags associated with the security groups.
- Tags: (optional) The key/value combination of the tags associated with the security groups, in the following format: "Filters":{"Tags":["TAGKEY=TAGVALUE"]}.
NextPageToken: (optional) The token to request the next page of results. Each token refers to a specific page.
ResultsPerPage: (optional) The maximum number of logs returned in a single response (between 1 and 1000, both included). By default, 100.

The ReadSecurityGroups command returns the following elements:

NextPageToken: The token to request the next page of results. Each token refers to a specific page.
ResponseContext: Information about the context of the response.
- RequestId: The ID of the request.
SecurityGroups: Information about one or more security groups.
- AccountId: The account ID that has been granted permission.
- Description: The description of the security group.
- InboundRules: The inbound rules associated with the security group.
  - FromPortRange: The beginning of the port range for the TCP and UDP protocols, or an ICMP type number.
  - IpProtocol: The IP protocol name (tcp, udp, icmp, or -1 for all protocols). By default, -1. In a Net, this can also be an IP protocol number. For more information, see the IANA.org website.
  - IpRanges: One or more IP ranges for the security group rules, in CIDR notation (for example, 10.0.0.0/16).
  - SecurityGroupsMembers: Information about one or more source or destination security groups.
    
    AccountId: The account ID that owns the source or destination security group.
    
    SecurityGroupId: The ID of a source or destination security group that you want to link to the security group of the rule.
    
    SecurityGroupName: (Public Cloud only) The name of a source or destination security group that you want to link to the security group of the rule.
  - ServiceIds: One or more service IDs to allow traffic from a Net to access the corresponding OUTSCALE services. For more information, see ReadNetAccessPointServices.
  - ToPortRange: The end of the port range for the TCP and UDP protocols, or an ICMP code number.
- NetId: The ID of the Net for the security group.
- OutboundRules: The outbound rules associated with the security group.
  - FromPortRange: The beginning of the port range for the TCP and UDP protocols, or an ICMP type number.
  - IpProtocol: The IP protocol name (tcp, udp, icmp, or -1 for all protocols). By default, -1. In a Net, this can also be an IP protocol number. For more information, see the IANA.org website.
  - IpRanges: One or more IP ranges for the security group rules, in CIDR notation (for example, 10.0.0.0/16).
  - SecurityGroupsMembers: Information about one or more source or destination security groups.
    
    AccountId: The account ID that owns the source or destination security group.
    
    SecurityGroupId: The ID of a source or destination security group that you want to link to the security group of the rule.
    
    SecurityGroupName: (Public Cloud only) The name of a source or destination security group that you want to link to the security group of the rule.
  - ServiceIds: One or more service IDs to allow traffic from a Net to access the corresponding OUTSCALE services. For more information, see ReadNetAccessPointServices.
  - ToPortRange: The end of the port range for the TCP and UDP protocols, or an ICMP code number.
- SecurityGroupId: The ID of the security group.
- SecurityGroupName: The name of the security group.
- Tags: One or more tags associated with the security group.
  - Key: The key of the tag, with a minimum of 1 character.
  - Value: The value of the tag, between 0 and 255 characters.

Result sample

{
  "SecurityGroups": [
    {
      "Tags": [],
      "SecurityGroupName": "security-group-example",
      "OutboundRules": [
        {
          "FromPortRange": -1,
          "IpProtocol": "-1",
          "ToPortRange": -1,
          "IpRanges": [
            "0.0.0.0/0"
          ]
        }
      ],
      "SecurityGroupId": "sg-12345678",
      "AccountId": "123456789012",
      "Description": "Example of security group",
      "InboundRules": [
        {
          "FromPortRange": 22,
          "IpProtocol": "tcp",
          "ToPortRange": 22,
          "IpRanges": [
            "192.0.2.0",
            "198.51.100.0"
          ]
        }
      ],
      "NetId": "vpc-12345678"
    }
  ],
  "ResponseContext": {
    "RequestId": "0475ca1e-d0c5-441d-712a-da55a4175157"
  }
}

Obtenir des informations sur vos security groups avec oapi-cli

À ce jour, cette section est disponible en anglais uniquement.

The ReadSecurityGroups command lists one or more security groups.
You can specify either the name of the security groups or their IDs.

Request sample

$ oapi-cli --profile "default" ReadSecurityGroups \
    --Filters '{
        "SecurityGroupIds": ["sg-12345678"]
      }'

Request sample

$ oapi-cli --profile "default" ReadSecurityGroups \
    --Filters '{
        "InboundRuleIpRanges": ["192.0.2.0"]
      }'

This command contains the following attributes that you need to specify:

DryRun: (optional) If true, checks whether you have the required permissions to perform the action.
Filters: (optional) One or more filters.
- Descriptions: (optional) The descriptions of the security groups.
- InboundRuleAccountIds: (optional) The account IDs that have been granted permissions.
- InboundRuleFromPortRanges: (optional) The beginnings of the port ranges for the TCP and UDP protocols, or the ICMP type numbers.
- InboundRuleIpRanges: (optional) The IP ranges that have been granted permissions, in CIDR notation (for example, 10.0.0.0/24).
- InboundRuleProtocols: (optional) The IP protocols for the permissions (tcp | udp | icmp, or a protocol number, or -1 for all protocols).
- InboundRuleSecurityGroupIds: (optional) The IDs of the security groups that have been granted permissions.
- InboundRuleSecurityGroupNames: (optional) The names of the security groups that have been granted permissions.
- InboundRuleToPortRanges: (optional) The ends of the port ranges for the TCP and UDP protocols, or the ICMP code numbers.
- NetIds: (optional) The IDs of the Nets specified when the security groups were created.
- OutboundRuleAccountIds: (optional) The account IDs that have been granted permissions.
- OutboundRuleFromPortRanges: (optional) The beginnings of the port ranges for the TCP and UDP protocols, or the ICMP type numbers.
- OutboundRuleIpRanges: (optional) The IP ranges that have been granted permissions, in CIDR notation (for example, 10.0.0.0/24).
- OutboundRuleProtocols: (optional) The IP protocols for the permissions (tcp | udp | icmp, or a protocol number, or -1 for all protocols).
- OutboundRuleSecurityGroupIds: (optional) The IDs of the security groups that have been granted permissions.
- OutboundRuleSecurityGroupNames: (optional) The names of the security groups that have been granted permissions.
- OutboundRuleToPortRanges: (optional) The ends of the port ranges for the TCP and UDP protocols, or the ICMP code numbers.
- SecurityGroupIds: (optional) The IDs of the security groups.
- SecurityGroupNames: (optional) The names of the security groups.
- TagKeys: (optional) The keys of the tags associated with the security groups.
- TagValues: (optional) The values of the tags associated with the security groups.
- Tags: (optional) The key/value combination of the tags associated with the security groups, in the following format: "Filters":{"Tags":["TAGKEY=TAGVALUE"]}.
NextPageToken: (optional) The token to request the next page of results. Each token refers to a specific page.
ResultsPerPage: (optional) The maximum number of logs returned in a single response (between 1 and 1000, both included). By default, 100.

The ReadSecurityGroups command returns the following elements:

NextPageToken: The token to request the next page of results. Each token refers to a specific page.
ResponseContext: Information about the context of the response.
- RequestId: The ID of the request.
SecurityGroups: Information about one or more security groups.
- AccountId: The account ID that has been granted permission.
- Description: The description of the security group.
- InboundRules: The inbound rules associated with the security group.
  - FromPortRange: The beginning of the port range for the TCP and UDP protocols, or an ICMP type number.
  - IpProtocol: The IP protocol name (tcp, udp, icmp, or -1 for all protocols). By default, -1. In a Net, this can also be an IP protocol number. For more information, see the IANA.org website.
  - IpRanges: One or more IP ranges for the security group rules, in CIDR notation (for example, 10.0.0.0/16).
  - SecurityGroupsMembers: Information about one or more source or destination security groups.
    
    AccountId: The account ID that owns the source or destination security group.
    
    SecurityGroupId: The ID of a source or destination security group that you want to link to the security group of the rule.
    
    SecurityGroupName: (Public Cloud only) The name of a source or destination security group that you want to link to the security group of the rule.
  - ServiceIds: One or more service IDs to allow traffic from a Net to access the corresponding OUTSCALE services. For more information, see ReadNetAccessPointServices.
  - ToPortRange: The end of the port range for the TCP and UDP protocols, or an ICMP code number.
- NetId: The ID of the Net for the security group.
- OutboundRules: The outbound rules associated with the security group.
  - FromPortRange: The beginning of the port range for the TCP and UDP protocols, or an ICMP type number.
  - IpProtocol: The IP protocol name (tcp, udp, icmp, or -1 for all protocols). By default, -1. In a Net, this can also be an IP protocol number. For more information, see the IANA.org website.
  - IpRanges: One or more IP ranges for the security group rules, in CIDR notation (for example, 10.0.0.0/16).
  - SecurityGroupsMembers: Information about one or more source or destination security groups.
    
    AccountId: The account ID that owns the source or destination security group.
    
    SecurityGroupId: The ID of a source or destination security group that you want to link to the security group of the rule.
    
    SecurityGroupName: (Public Cloud only) The name of a source or destination security group that you want to link to the security group of the rule.
  - ServiceIds: One or more service IDs to allow traffic from a Net to access the corresponding OUTSCALE services. For more information, see ReadNetAccessPointServices.
  - ToPortRange: The end of the port range for the TCP and UDP protocols, or an ICMP code number.
- SecurityGroupId: The ID of the security group.
- SecurityGroupName: The name of the security group.
- Tags: One or more tags associated with the security group.
  - Key: The key of the tag, with a minimum of 1 character.
  - Value: The value of the tag, between 0 and 255 characters.

Result sample

{
  "SecurityGroups": [
    {
      "Tags": [],
      "SecurityGroupName": "security-group-example",
      "OutboundRules": [
        {
          "FromPortRange": -1,
          "IpProtocol": "-1",
          "ToPortRange": -1,
          "IpRanges": [
            "0.0.0.0/0"
          ]
        }
      ],
      "SecurityGroupId": "sg-12345678",
      "AccountId": "123456789012",
      "Description": "Example of security group",
      "InboundRules": [
        {
          "FromPortRange": 22,
          "IpProtocol": "tcp",
          "ToPortRange": 22,
          "IpRanges": [
            "192.0.2.0",
            "198.51.100.0"
          ]
        }
      ],
      "NetId": "vpc-12345678"
    }
  ],
  "ResponseContext": {
    "RequestId": "0475ca1e-d0c5-441d-712a-da55a4175157"
  }
}

Obtenir des informations sur vos security groups avec AWS CLI

Avant de commencer : Installez et configurez AWS CLI. Pour en savoir plus, voir Installer et configurer AWS CLI.

Pour obtenir des informations sur un ou plusieurs security groups, utilisez la commande describe-security-groups en suivant cette syntaxe :

Exemple de requête

$ aws ec2 describe-security-groups \
    --profile YOUR_PROFILE \
    --group-names my-security-groups \
    --group-ids sg-12345678 \
    --filters Name=X,Values=Y \
    --endpoint https://fcu.eu-west-2.outscale.com

Cette commande contient les options suivantes que vous devez spécifier :

(optionnel) profile : Le profil nommé que vous voulez utiliser, créé pendant la configuration d’AWS CLI. Pour en savoir plus, voir Installer et configurer AWS CLI.
(optionnel) group-names : Un ou plusieurs noms de security groups, si vous êtes dans le Cloud public. Dans un VPC, utilisez le filtre group-name.
(optionnel) group-ids : Un ou plusieurs ID de security groups, que vous devez spécifier si vous êtes dans un VPC. Si l’ID est invalide ou inexistant, renvoie une erreur.

(optionnel) filters : Un ou plusieurs filtres, au format "Name=X,Values=Y".

Vous pouvez spécifier plusieurs valeurs pour un même filtre en utilisant le format "Name=X,Values=Y, Z".

Les filtres suivants sont disponibles :

description : La description du security group.
group-id : L’ID du security group.
group-name : Le nom du security group.
ip-permission.cidr : Une IP ou plage d’IP pour lesquelles vous avez autorisé l’accès, en notation CIDR.
ip-permission.from-port : Le début de la plage de ports pour les protocoles TCP ou UDP, ou le numéro d’un type de message ICMP (-1 pour indiquer tous les types de message ICMP).
ip-permission.group-id : L’ID d’un security group pour lequel vous avez autorisé l’accès.
ip-permission.group-name : Le nom d’un security group pour lequel vous avez autorisé l’accès.
ip-permission.protocol : Le protocole IP autorisé (tcp | udp | icmp), ou -1 pour tous les protocoles.
ip-permission.to-port : La fin de la plage de ports pour les protocoles TCP et UDP, ou un code ICMP.
ip-permission.user-id : L’ID du compte que vous avez autorisé.
owner-id : L’ID de compte du propriétaire du security group.

tag-key : La clé d’un tag associé à la ressource.
tag-value : La valeur d’un tag associé à la ressource.

tag:XXXX : La valeur d’un tag associé à la ressource, où XXXX est la clé du tag.

Pour filtrer un tag dont la clé est XXXX et la valeur est YYYY, vous pouvez donc utiliser un des deux formats suivants :

--filters Name=tag-key,Values=XXXX Name=tag-value,Values=YYYY
--filters Name=tag:XXXX,Values=YYYY

vpc-id : L’ID du VPC spécifié lors de la création du security group.

endpoint : Le endpoint correspondant à la Région à laquelle vous voulez envoyer la requête. Pour en savoir plus, voir Installer et configurer AWS CLI.

La commande describe-security-groups renvoie les éléments suivants :

SecurityGroups : Informations à propos d’un ou plusieurs security groups. Cet élément contient les informations suivantes :
- (uniquement pour les VPC) IpPermissionsEgress : Informations à propos d’une ou plusieurs règles pour les flux sortants contenues dans le security group. Cet élément contient les mêmes informations que l’élément IpPermissions.
- Description : La description du security group.
- Tags : Un ou plusieurs tags associés au security group. Cet élément contient les informations suivantes :
  - Value : La valeur du tag.
  - Key : La clé du tag.
- Ip-permissions : Un ensemble de permissions. Cet élément contient les informations suivantes :
  - IpProtocol : Le protocole que vous souhaitez utiliser (tcp | udp | icmp), ou -1 pour tous les protocoles.
  - FromPort : Le début de la plage de ports pour les protocoles TCP ou UDP, ou le numéro d’un type de message ICMP (-1 pour indiquer tous les types de message ICMP).
  - ToPort : La fin de la plage de ports pour les protocoles TCP et UDP, ou le numéro d’un code ICMP (-1 pour indiquer tous les codes ICMP).
  - UserIdGroupPairs : Informations à propos d’un ou plusieurs comptes et security groups référencés dans les règles. Cet élément contient les informations suivantes :
    
    UserId : L’ID de compte du propriétaire du security group référencé.
    
    GroupName : Le nom du security group référencé.
    
    GroupId : L’ID du security group référencé.
- GroupName : Le nom du security group.
- (uniquement pour les VPC) VpcId : L’ID du VPC pour lequel le security group est alloué.
- OwnerId : L’ID de compte du propriétaire du security group.
- GroupId : L’ID du security group.

Exemple de résultat

 {
    "SecurityGroups": [
        {
            "IpPermissionsEgress": [],
            "Description": "my_security_group",
            "Tags": [
                {
                    "Value": "SG1",
                    "Key": "Name"
                 }
            ],
           "IpPermissions": [
                {
                    "IpProtocol": "tcp",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    "UserIdGroupPairs": [
                        {
                             "UserId": "987654321000",
                             "GroupId": "sg-1234abcd",
                             "GroupName":
                        }
                    ],
                    "PrefixListIds": []
                    "FromPort": 22,
                    "ToPort": 22,
              ],
           "GroupName": "MySecurityGroup",
           "VpcId": "vpc-87654321",
           "OwnerId": "123456789000",
           "GroupId": "sg-12345678",
        }
    ]
}

Pages connexes

Méthodes API correspondantes

AWS™ et Amazon Web Services™ sont des marques de commerce d'Amazon Technologies, Inc. ou de ses affiliées aux États-Unis et/ou dans les autres pays.