安全组 | 创建（需要审阅） - AMS 高级更改类型参考
更改类型详情附加信息执行输入参数示例：必填参数示例：所有参数

本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。

安全组 | 创建（需要审阅）

创建安全组，并可选择将其与 AWS 资源关联。

完整分类：部署 | 高级堆栈组件 | 安全组 | 创建（需要审阅）

更改类型详情

更改类型 ID

ct-1oxx2g2d7hc90

当前版本

2.0

预期执行时长

240 分钟

AWS 批准

必需

客户批准

如果是提交者，则不需要填写

执行模式

手动

附加信息

创建安全组（需要审查）

AMS 控制台中此更改类型的屏幕截图：

Interface for creating a security group with ID, execution mode, version, and description.

它是如何运作的：

  1. 导航到 “创建 RFC” 页面：在 AMS 控制台的左侧导航窗格中，单击RFCs打开 RFCs 列表页面，然后单击 “创建 R FC”。

  2. 在默认的 “浏览更改类型” 视图中选择常用更改类型 (CT)，或者在 “按类别选择” 视图中选择 CT。

    • 按更改类型浏览：您可以单击 “快速创建” 区域中的常用 CT，立即打开 “运行 RFC” 页面。请注意，您不能使用快速创建来选择较旧的 CT 版本。

      要进行排序 CTs，请使用卡片视图或表格视图中的所有更改类型区域。在任一视图中，选择一个 CT，然后单击 “创建 RFC” 打开 “运行 RFC” 页面。如果适用，“创建 RFC” 按钮旁边会出现 “使用旧版本创建” 选项。

    • 按类别选择：选择类别、子类别、项目和操作，CT 详细信息框将打开，并显示 “使用旧版本创建” 选项（如果适用）。单击 “创建 RFC” 打开 “运行 RFC” 页面。

  3. 在 “运行 RFC” 页面上，打开 CT 名称区域以查看 CT 详细信息框。必须填写主题（如果您在 “浏览更改类型” 视图中选择 CT，则会为您填写此主题）。打开 “其他配置” 区域以添加有关 RFC 的信息。

    在执行配置区域中，使用可用的下拉列表或输入所需参数的值。要配置可选的执行参数，请打开其他配置区域。

  4. 完成后，单击 “运行”。如果没有错误，则会显示成功创建的 RFC 页面，其中包含已提交的 RFC 详细信息和初始运行输出。

  5. 打开运行参数区域以查看您提交的配置。刷新页面以更新 RFC 的执行状态。（可选）取消 RFC 或使用页面顶部的选项创建一个 RFC 的副本。

它是如何运作的：

  1. 使用 Inline Create（您发出包含所有 RFC 和执行参数的create-rfc命令）或模板创建（创建两个 JSON 文件，一个用于 RFC 参数，一个用于执行参数），然后以这两个文件作为输入发出create-rfc命令。这里描述了这两种方法。

  2. 提交带有返回的 RFC ID 的 RFC: aws amscm submit-rfc --rfc-id ID 命令。

    监控 RFC: aws amscm get-rfc --rfc-id ID 命令。

要检查更改类型版本，请使用以下命令：

aws amscm list-change-type-version-summaries --filter Attribute=ChangeTypeId,Value=CT_ID
注意

您可以将任何CreateRfc参数与任何 RFC 一起使用，无论它们是否属于变更类型的架构的一部分。例如，要在 RFC 状态更改时收到通知，请将此行添加到请求的 RFC 参数部分（不是执行参数）。--notification "{\"Email\": {\"EmailRecipients\" : [\"email@example.com\"]}}"有关所有 CreateRfc 参数的列表，请参阅《AMS 变更管理 API 参考》。

内联创建：

使用内联提供的执行参数（内联提供执行参数时使用转义引号）发出 create RFC 命令，然后提交返回的 RFC ID。例如，你可以用这样的东西替换内容：

aws --profile saml amscm create-rfc --change-type-id "ct-1oxx2g2d7hc90" --change-type-version "2.0" --title "Test-SG-RR" --execution-parameters "{\"Description\":\"Test-SG-RR\", \"Name\":\"Test-SG-IC\", \"InboundRules\":{\"Protocol\":\"TCP\", \"PortRange\":\"49152-65535\, \"Source\":\"203.0.113.5/32\"}, \"OutboundRules\":{\"Protocol\":\"TCP\", \"PortRange\":\"49152-65535\, \"Destination\":\"203.0.113.5/32\"}}"

模板创建：

  1. 将此更改类型的执行参数 JSON 架构输出到文件中；此示例将其命名为 CreateSgRrParams .json。

    aws amscm get-change-type-version --change-type-id "ct-1oxx2g2d7hc90" --query "ChangeTypeVersion.ExecutionInputSchema" --output text > CreateSgRrParams.json

  2. 修改并保存 CreateSgRrParams 文件。例如，你可以用这样的东西替换内容：

    {
"Description":      "SG-Create-With-Review",
"Name":             "My-SG",
"VpcId":            "vpc-12345abc",    
"InboundRules":   {
    "Protocol":     "TRAFFIC_PROTOCOL",
    "PortRange":    "PORT_RANGE",
    "Source":       "TRAFFIC_SOURCE"
    },
"OutboundRules":   {
    "Protocol":     "TRAFFIC_PROTOCOL",
    "PortRange":    "PORT_RANGE",
    "Destination":  "TRAFFIC_DESTINATION"
    }
}

  3. 将 RFC 模板 JSON 文件输出到名为 CreateSgRrRfc .json 的文件中：

    aws amscm create-rfc --generate-cli-skeleton > CreateSgRrRfc.json

  4. 修改并保存 CreateSgRrRfc .json 文件。例如，你可以用这样的东西替换内容：

    {
"ChangeTypeVersion":    "2.0",
"ChangeTypeId":         "ct-1oxx2g2d7hc90",
"Title":                "SG-Create-RR-RFC"
}

  5. 创建 RFC，指定 CreateSgRrRfc 文件和 CreateSgRrParams 文件：

    aws amscm create-rfc --cli-input-json file://CreateSgRrRfc.json  --execution-parameters file://CreateSgRrParams.json

    您在响应中收到新 RFC 的 ID，并可以使用它来提交和监控 RFC。在您提交之前，RFC 仍处于编辑状态且无法启动。

注意

有一种用于创建安全组的自动更改类型，即部署 | 高级堆栈组件 | 安全组 | 创建（无需审查）(ct-3pc215bnwb6p7)，它提供了 TCP 和 ICMP 入口和出口规则的选项。如果这些规则足够，则创建 (auto) 更改类型的执行速度将比该更改类型更快。有关详细信息，请参阅安全组 | 创建。

注意

创建安全组后，使用安全组 | 关联将安全组与您的 AMS 资源关联起来。要删除安全组，该安全组必须具有关联的资源。

注意

不需要出站规则；但是，如果未指定出站规则，则使用 “127.0.0.1/32 Blackhole 规则”，这意味着资源只能与自身通信，不能与其他资源通信。使用 AMS 控制台时，您可以看到此默认出站规则，但在使用 AMS API/CLI 时却看不到。

这是 “需要审核” 的变更类型（AMS 操作员必须审核并运行 CT），这意味着 RFC 可能需要更长的时间才能运行，您可能需要通过 RFC 详细信息页面的对应选项与 AMS 沟通。此外，如果您安排 “需要审核” 的更改类型 RFC，请务必留出至少 24 小时的时间，如果在预定的开始时间之前没有获得批准，RFC 将被自动拒绝。

要了解有关 AWS 安全组和创建安全组的更多信息，请参阅安全组规则参考；此页面可以帮助您确定所需的规则，更重要的是，如何命名您的安全组，以便在创建其他资源时选择安全组非常直观。另请参阅适用于 Linux 实例的亚马逊 EC2 and/or 安全组适用于您的 VPC 的安全组。

要更好地了解 AWS 的一般安全性，请参阅安全、身份和合规性最佳实践。

创建安全组后，使用安全组 | 关联将安全组与您的 AMS 资源关联起来。要删除安全组，该安全组必须具有关联的资源。

执行输入参数

有关执行输入参数的详细信息，请参见变更架构类型 ct-1oxx2g2d7hc90。

示例：必填参数

{
  "VpcId": "vpc-12345abc",
  "Name": "app1-webserver",
  "Description": "App1 group",
  "InboundRules": [],
  "OutboundRules": []
}

示例：所有参数

{
  "VpcId": "vpc-1234abcd",
  "Name": "app1-webserver",
  "Description": "App1 group",
  "AssociatedResources": [
    "i-1234abcd",
    "i-234abcd1",
    "i-34abcd12",
    "i-4abcd123",
    "i-abcd1234",
    "i-1234567890abcdefg",
    "i-234567890abcdefg1",
    "i-34567890abcdefg12",
    "i-4567890abcdefg123",
    "i-567890abcdefg1234"
  ],
  "InboundRules": [
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "TCP", "PortRange":"80", "Source": "192.168.0.0/16", "Description": "Client1" }
  ],
  "OutboundRules": [
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" },
    { "Protocol": "ALL", "PortRange": "ALL", "Destination": "192.168.0.0/16", "Description": "Client1" }
  ],
  "Priority": "Medium",
  "Tags": [
    { "Key": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV", "Value": "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrst" },
    { "Key": "B", "Value": "bb" },
    { "Key": "C", "Value": "cc" },
    { "Key": "D", "Value": "dd" },
    { "Key": "E", "Value": "ee" },
    { "Key": "F", "Value": "ff" },
    { "Key": "G", "Value": "gg" },
    { "Key": "H", "Value": "hh" },
    { "Key": "I", "Value": "ii" },
    { "Key": "J", "Value": "jj" },
    { "Key": "K", "Value": "kk" },
    { "Key": "L", "Value": "ll" },
    { "Key": "M", "Value": "mm" },
    { "Key": "N", "Value": "nn" },
    { "Key": "O", "Value": "oo" },
    { "Key": "P", "Value": "pp" },
    { "Key": "Q", "Value": "qq" },
    { "Key": "R", "Value": "rr" },
    { "Key": "S", "Value": "ss" },
    { "Key": "T", "Value": "tt" },
    { "Key": "U", "Value": "uu" },
    { "Key": "V", "Value": "vv" },
    { "Key": "W", "Value": "ww" },
    { "Key": "X", "Value": "xx" },
    { "Key": "Y", "Value": "yy" },
    { "Key": "Z", "Value": "zz" },
    { "Key": "a", "Value": "aa" },
    { "Key": "b", "Value": "bb" },
    { "Key": "c", "Value": "cc" },
    { "Key": "d", "Value": "dd" },
    { "Key": "e", "Value": "ee" },
    { "Key": "f", "Value": "ff" },
    { "Key": "g", "Value": "gg" },
    { "Key": "h", "Value": "hh" },
    { "Key": "i", "Value": "ii" },
    { "Key": "j", "Value": "jj" },
    { "Key": "k", "Value": "kk" },
    { "Key": "l", "Value": "ll" },
    { "Key": "m", "Value": "mm" },
    { "Key": "n", "Value": "nn" },
    { "Key": "o", "Value": "oo" },
    { "Key": "p", "Value": "pp" },
    { "Key": "q", "Value": "qq" },
    { "Key": "r", "Value": "rr" },
    { "Key": "s", "Value": "ss" },
    { "Key": "t", "Value": "tt" },
    { "Key": "u", "Value": "uu" },
    { "Key": "v", "Value": "vv" },
    { "Key": "w", "Value": "ww" },
    { "Key": "x", "Value": "xx" }
  ]
}