AWS API Changes

2024/10/30 - Amazon Elastic Compute Cloud - 3 new 7 updated api methods

Changes This release adds two new capabilities to VPC Security Groups: Security Group VPC Associations and Shared Security Groups.

DescribeSecurityGroupVpcAssociations (new)

Link ¶

Describes security group VPC associations made with AssociateSecurityGroupVpc.

See also: AWS API Documentation

Request Syntax

client.describe_security_group_vpc_associations(
    Filters=[
        {
            'Name': 'string',
            'Values': [
                'string',
            ]
        },
    ],
    NextToken='string',
    MaxResults=123,
    DryRun=True|False
)

type Filters

list

param Filters

Security group VPC association filters.

group-id : The security group ID.
vpc-id : The ID of the associated VPC.
vpc-owner-id : The account ID of the VPC owner.
state : The state of the association.
tag:<key> : The key/value combination of a tag assigned to the resource. Use the tag key in the filter name and the tag value as the filter value. For example, to find all resources that have a tag with the key Owner and the value TeamA , specify tag:Owner for the filter name and TeamA for the filter value.
tag-key : The key of a tag assigned to the resource. Use this filter to find all resources assigned a tag with a specific key, regardless of the tag value.

(dict) --

A filter name and value pair that is used to return a more specific list of results from a describe operation. Filters can be used to match a set of resources by specific criteria, such as tags, attributes, or IDs.

If you specify multiple filters, the filters are joined with an AND , and the request returns only results that match all of the specified filters.
- Name (string) --
  
  The name of the filter. Filter names are case-sensitive.
- Values (list) --
  
  The filter values. Filter values are case-sensitive. If you specify multiple values for a filter, the values are joined with an OR , and the request returns all results that match any of the specified values.
  - (string) --

type NextToken

string

param NextToken

The token returned from a previous paginated request. Pagination continues from the end of the items returned by the previous request.

type MaxResults

integer

param MaxResults

The maximum number of items to return for this request. To get the next page of items, make another request with the token returned in the output. For more information, see Pagination.

type DryRun

boolean

param DryRun

Checks whether you have the required permissions for the action, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation . Otherwise, it is UnauthorizedOperation .

rtype

dict

returns

Response Syntax

{
    'SecurityGroupVpcAssociations': [
        {
            'GroupId': 'string',
            'VpcId': 'string',
            'VpcOwnerId': 'string',
            'State': 'associating'|'associated'|'association-failed'|'disassociating'|'disassociated'|'disassociation-failed',
            'StateReason': 'string'
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) --
- SecurityGroupVpcAssociations (list) --
  
  The security group VPC associations.
  - (dict) --
    
    A security group association with a VPC that you made with AssociateSecurityGroupVpc.
    - GroupId (string) --
      
      The association's security group ID.
    - VpcId (string) --
      
      The association's VPC ID.
    - VpcOwnerId (string) --
      
      The Amazon Web Services account ID of the owner of the VPC.
    - State (string) --
      
      The association's state.
    - StateReason (string) --
      
      The association's state reason.
- NextToken (string) --
  
  The token to include in another request to get the next page of items. This value is null when there are no more items to return.

DisassociateSecurityGroupVpc (new)

Link ¶

Disassociates a security group from a VPC. You cannot disassociate the security group if any Elastic network interfaces in the associated VPC are still associated with the security group. Note that the disassociation is asynchronous and you can check the status of the request with DescribeSecurityGroupVpcAssociations.

See also: AWS API Documentation

Request Syntax

client.disassociate_security_group_vpc(
    GroupId='string',
    VpcId='string',
    DryRun=True|False
)

type GroupId

string

param GroupId

[REQUIRED]

A security group ID.

type VpcId

string

param VpcId

[REQUIRED]

A VPC ID.

type DryRun

boolean

param DryRun

rtype

dict

returns

Response Syntax

{
    'State': 'associating'|'associated'|'association-failed'|'disassociating'|'disassociated'|'disassociation-failed'
}

Response Structure

(dict) --
- State (string) --
  
  The state of the disassociation.

AssociateSecurityGroupVpc (new)

Link ¶

Associates a security group with another VPC in the same Region. This enables you to use the same security group with network interfaces and instances in the specified VPC.

Note

The VPC you want to associate the security group with must be in the same Region.
You can associate the security group with another VPC if your account owns the VPC or if the VPC was shared with you.
You must own the security group and the VPC that it was created in.
You cannot use this feature with default security groups.
You cannot use this feature with the default VPC.

See also: AWS API Documentation

Request Syntax

client.associate_security_group_vpc(
    GroupId='string',
    VpcId='string',
    DryRun=True|False
)

type GroupId

string

param GroupId

[REQUIRED]

A security group ID.

type VpcId

string

param VpcId

[REQUIRED]

A VPC ID.

type DryRun

boolean

param DryRun

rtype

dict

returns

Response Syntax

{
    'State': 'associating'|'associated'|'association-failed'|'disassociating'|'disassociated'|'disassociation-failed'
}

Response Structure

(dict) --
- State (string) --
  
  The state of the association.

AuthorizeSecurityGroupEgress (updated)

Link ¶
Changes (response)

{'SecurityGroupRules': {'SecurityGroupRuleArn': 'string'}}

Adds the specified outbound (egress) rules to a security group.

An outbound rule permits instances to send traffic to the specified IPv4 or IPv6 address ranges, the IP address ranges specified by a prefix list, or the instances that are associated with a source security group. For more information, see Security group rules.

You must specify exactly one of the following destinations: an IPv4 or IPv6 address range, a prefix list, or a security group. You must specify a protocol for each rule (for example, TCP). If the protocol is TCP or UDP, you must also specify a port or port range. If the protocol is ICMP or ICMPv6, you must also specify the ICMP type and code.

Rule changes are propagated to instances associated with the security group as quickly as possible. However, a small delay might occur.

For examples of rules that you can add to security groups for specific access scenarios, see Security group rules for different use cases in the Amazon EC2 User Guide .

For information about security group quotas, see Amazon VPC quotas in the Amazon VPC User Guide .

See also: AWS API Documentation

Request Syntax

client.authorize_security_group_egress(
    TagSpecifications=[
        {
            'ResourceType': 'capacity-reservation'|'client-vpn-endpoint'|'customer-gateway'|'carrier-gateway'|'coip-pool'|'dedicated-host'|'dhcp-options'|'egress-only-internet-gateway'|'elastic-ip'|'elastic-gpu'|'export-image-task'|'export-instance-task'|'fleet'|'fpga-image'|'host-reservation'|'image'|'import-image-task'|'import-snapshot-task'|'instance'|'instance-event-window'|'internet-gateway'|'ipam'|'ipam-pool'|'ipam-scope'|'ipv4pool-ec2'|'ipv6pool-ec2'|'key-pair'|'launch-template'|'local-gateway'|'local-gateway-route-table'|'local-gateway-virtual-interface'|'local-gateway-virtual-interface-group'|'local-gateway-route-table-vpc-association'|'local-gateway-route-table-virtual-interface-group-association'|'natgateway'|'network-acl'|'network-interface'|'network-insights-analysis'|'network-insights-path'|'network-insights-access-scope'|'network-insights-access-scope-analysis'|'placement-group'|'prefix-list'|'replace-root-volume-task'|'reserved-instances'|'route-table'|'security-group'|'security-group-rule'|'snapshot'|'spot-fleet-request'|'spot-instances-request'|'subnet'|'subnet-cidr-reservation'|'traffic-mirror-filter'|'traffic-mirror-session'|'traffic-mirror-target'|'transit-gateway'|'transit-gateway-attachment'|'transit-gateway-connect-peer'|'transit-gateway-multicast-domain'|'transit-gateway-policy-table'|'transit-gateway-route-table'|'transit-gateway-route-table-announcement'|'volume'|'vpc'|'vpc-endpoint'|'vpc-endpoint-connection'|'vpc-endpoint-service'|'vpc-endpoint-service-permission'|'vpc-peering-connection'|'vpn-connection'|'vpn-gateway'|'vpc-flow-log'|'capacity-reservation-fleet'|'traffic-mirror-filter-rule'|'vpc-endpoint-connection-device-type'|'verified-access-instance'|'verified-access-group'|'verified-access-endpoint'|'verified-access-policy'|'verified-access-trust-provider'|'vpn-connection-device-type'|'vpc-block-public-access-exclusion'|'ipam-resource-discovery'|'ipam-resource-discovery-association'|'instance-connect-endpoint'|'ipam-external-resource-verification-token',
            'Tags': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ]
        },
    ],
    DryRun=True|False,
    GroupId='string',
    SourceSecurityGroupName='string',
    SourceSecurityGroupOwnerId='string',
    IpProtocol='string',
    FromPort=123,
    ToPort=123,
    CidrIp='string',
    IpPermissions=[
        {
            'IpProtocol': 'string',
            'FromPort': 123,
            'ToPort': 123,
            'UserIdGroupPairs': [
                {
                    'Description': 'string',
                    'UserId': 'string',
                    'GroupName': 'string',
                    'GroupId': 'string',
                    'VpcId': 'string',
                    'VpcPeeringConnectionId': 'string',
                    'PeeringStatus': 'string'
                },
            ],
            'IpRanges': [
                {
                    'Description': 'string',
                    'CidrIp': 'string'
                },
            ],
            'Ipv6Ranges': [
                {
                    'Description': 'string',
                    'CidrIpv6': 'string'
                },
            ],
            'PrefixListIds': [
                {
                    'Description': 'string',
                    'PrefixListId': 'string'
                },
            ]
        },
    ]
)

type TagSpecifications

list

param TagSpecifications

The tags applied to the security group rule.

(dict) --

The tags to apply to a resource when the resource is being created. When you specify a tag, you must specify the resource type to tag, otherwise the request will fail.

Note

The Valid Values lists all the resource types that can be tagged. However, the action you're using might not support tagging all of these resource types. If you try to tag a resource type that is unsupported for the action you're using, you'll get an error.
- ResourceType (string) --
  
  The type of resource to tag on creation.
- Tags (list) --
  
  The tags to apply to the resource.
  - (dict) --
    
    Describes a tag.
    - Key (string) --
      
      The key of the tag.
      
      Constraints: Tag keys are case-sensitive and accept a maximum of 127 Unicode characters. May not begin with aws: .
    - Value (string) --
      
      The value of the tag.
      
      Constraints: Tag values are case-sensitive and accept a maximum of 256 Unicode characters.

type DryRun

boolean

param DryRun

type GroupId

string

param GroupId

[REQUIRED]

The ID of the security group.

type SourceSecurityGroupName

string

param SourceSecurityGroupName