Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have some security groups that have quite a few rules in them. Rather than having to recreate the same rules for a number of security groups just to accommodate minor differences, is it possible to copy a security group to use as a starting point, or use inheritance, etc?

share|improve this question
    
You can apply multiple security groups to a single resource. Making a copy of a security group seems like a bad idea. Just add the new rules to a new group and apply it to the right instances. –  Ladadadada May 23 '13 at 6:51
    
I just tried searching for this info but cant find anything that shows how to add additional security groups to a singe EC2 instance. Can you provide a link? –  BillR May 23 '13 at 21:07
    
I just wrote a new function in a Python Boto class library I slowly add to. A PITA I shouldn't have had to deal with (as are a lot of things) but at least now I have a simpler and more straight forward interface to do this than anything else I've seen. –  BillR Aug 22 '13 at 17:02

3 Answers 3

up vote 2 down vote accepted

Doesn't look like you can copy security groups from the web interface. You can however use the AWS CLI to create security groups:

ws ec2 describe-security-groups --group-names MySecurityGroup
{
    "securityGroupInfo": [
        {
            "ipPermissionsEgress": [],
            "groupId": "sg-903004f8",
            "ipPermissions": [],
            "groupName": "MySecurityGroup",
            "ownerId": "803981987763",
            "groupDescription": "AWS-CLI-Example"
        }
    ],
    "requestId": "afb680df-d7b1-4f6a-b1a7-344fdb1e3532"
}

And add rules:

aws ec2 authorize-security-group-ingress --group-name MySecurityGroup --ip-protocol tcp --from-port 22 --to-port 22 --cidr-ip 0.0.0.0/0
{
    "return": "true",
    "requestId": "c24a1c93-150b-4a0a-b56b-b149c0e660d2"
}

From there you should be able to figure out how to simplify the creation of your security groups.

share|improve this answer
    
yeah I figured this was the route that would need to be taken... was thinking about doing something similar to this using boto too. Thanks for the example... will give you the thumbs up for it. Thanks. –  BillR May 23 '13 at 0:12

Consider having a look at this blog. It might be useful for what you are looking at.

http://ry4an.org/unblog/post/ec2_security_group_tools/

share|improve this answer
    
I wrote some Python Boto stuff to do this. Easier to use than anything I've seen. –  BillR Aug 22 '13 at 17:14
    
please summarize the contents of your link –  Ward Aug 23 '13 at 3:26

Due to lack of a proper way of doing this online, I created a super simple script to handle it. Have a look if you're interested.

https://github.com/pedropregueiro/migrate-ec2-secgroups

share|improve this answer
    
This is not really a good candidate for an "answer" submission. Might be useful as a comment when you have enough rep to post those. –  Andrew B May 22 at 16:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.