'AWS CLI - Create script to add my IP to security group

I'm trying to create a script to add my IP adress to AWS VPC security groups somthing like

>  aws ec2 modify-security-group-rules --group-id GROUPID\
> --security-group-rules SecurityGroupRuleId= RULEID\
SecurityGroupRule={IpProtocol:'tcp',FromPort:433,ToPort:433,CidrIpv4:'MYIP'}

But I keep getting different errors like -

IpProtocol:tcp, type: <class 'str'>, valid types: <class 'dict'>

Can anyone please help figure out the correct syntax for this?

UPDATE: I tried a new syntax that seems to work better

SecurityGroupRule={{IpProtocol=tcp},{FromPort=433},{ToPort=433},{CidrIpv4='IP'}}

But now I get a different error from AWS -

Invalid value for portRange. Must specify both from and to ports with TCP/UDP.

UPDATE: For reference - Here's the workaround I used- (based on John Rotenstein answer) Instead of modifying the rule I create a new one each time and save the rule ID so I can delete it next time I run the script

IP=`curl -s http://whatismyip.akamai.com/`
aws ec2 revoke-security-group-ingress \
         --group-id GROUP_ID         \
         --security-group-rule-ids $(cat ruleid_1.txt)
       
    aws ec2 authorize-security-group-ingress --group-id GROUP_ID\
--ip-permissions "IpProtocol"="tcp","FromPort"=433,"ToPort"=443,"IpRanges"="[{CidrIp=$IP/32,Description=Shalev}]"|jq '.SecurityGroupRules[0].SecurityGroupRuleId' -r > ruleid_1.txt
bashaws-cliamazon-vpc


Solution 1:[1]

For reference - Here's the workaround I used- (based on John Rotenstein answer) Instead of modifying the rule I create a new one each time and save the rule ID so I can delete it next time I run the script

IP=`curl -s http://whatismyip.akamai.com/`

aws ec2 revoke-security-group-ingress \
         --group-id GROUP_ID         \
         --security-group-rule-ids $(cat ruleid_1.txt)
   


aws ec2 authorize-security-group-ingress --group-id GROUP_ID\
--ip-permissions "IpProtocol"="tcp","FromPort"=433,"ToPort"=443,"IpRanges"="[{CidrIp=$IP/32,Description=Shalev}]"|jq '.SecurityGroupRules[0].SecurityGroupRuleId' -r > ruleid_1.txt

Solution 2:[2]

Place value of parameter --security-group-rules inside quotes. Both of the following seem to work for me (on Amazon Linux 2) -

  • Using double quotes for complete value, with description in single quotes-
aws ec2 modify-security-group-rules --group-id sg-xxx
   --security-group-rules "SecurityGroupRuleId=sgr-xxx,SecurityGroupRule={Description='SSH
   Test1',CidrIpv4=x.x.x.x/32,IpProtocol=tcp,FromPort=22,ToPort=22}"
  • Using single quotes for complete value, with description in double quotes-
aws ec2 modify-security-group-rules --group-id sg-xxx
   --security-group-rules 'SecurityGroupRuleId=sgr-xxx,SecurityGroupRule={Description="SSH
   Test2",CidrIpv4=x.x.x.x/32,IpProtocol=tcp,FromPort=22,ToPort=22}'

Solution 3:[3]

Here is a way to use the aws CLI to change a rule. Requires "ec2:ModifySecurityGroupRules" permission.

aws ec2 describe-security-group-rules help

aws ec2 modify-security-group-rules --group-id sg--???????
 --security-group-rules SecurityGroupRuleId=sgr---???????,SecurityGroupRule={IpProtocol=tcp,FromPort=22,ToPort=22,CidrIpv4=IP/32,Description="Regra
 Alterada"}

Solution 4:[4]

Here's a script I use to add my current IP address to a Security Group:

IP=`curl -s http://whatismyip.akamai.com/`
aws ec2 authorize-security-group-ingress --group-name XXX --protocol tcp --port 22 --cidr $IP/32 --output text

It uses Akamai to retrieve my public IP address and then adds it to the desired Security Group.

Note that there is a limit to the number of rules in a Security Group, so eventually you will need to remove unused entries.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 Shalev
Solution 2 Akshat Sachdeva
Solution 3 Carlos Leffa
Solution 4 John Rotenstein

Related Questions