Zend_Service_Amazon_Ec2: Security Groups

Security Group Maintenance

Example 743. Create a new Security Group

create a new security group. Every instance is launched in a security group. If no security group is specified during launch, the instances are launched in the default security group. Instances within the same security group have unrestricted network access to each other. Instances will reject network access attempts from other instances in a different security group.

create returns boolean TRUE or FALSE

$ec2_sg = new Zend_Service_Amazon_Ec2_Securitygroups('aws_key',
                                                     'aws_secret_key');
$return = $ec2_sg->create('mygroup', 'my group description');

Example 744. Describe a Security Group

describe returns information about security groups that you own.

If you specify security group names, information about those security groups is returned. Otherwise, information for all security groups is returned. If you specify a group that does not exist, a fault is returned.

describe will return an array containing information about security groups which includes the ownerId, groupName, groupDescription and an array containing all the rules for that security group.

$ec2_sg = new Zend_Service_Amazon_Ec2_Securitygroups('aws_key',
                                                     'aws_secret_key');
$return = $ec2_sg->describe('mygroup');

Example 745. Delete a Security Group

delete will remove the security group. If you attempt to delete a security group that contains instances, a fault is returned. If you attempt to delete a security group that is referenced by another security group, a fault is returned. For example, if security group B has a rule that allows access from security group A, security group A cannot be deleted until the allow rule is removed.

delete returns boolean TRUE or FALSE.

$ec2_sg = new Zend_Service_Amazon_Ec2_Securitygroups('aws_key',
                                                     'aws_secret_key');
$return = $ec2_sg->delete('mygroup');

Authorizing Access

Example 746. Authorizing by IP

authorizeIp Adds permissions to a security group based on an IP address, protocol type and port range.

Permissions are specified by the IP protocol (TCP, UDP or ICMP), the source of the request (by IP range or an Amazon EC2 user-group pair), the source and destination port ranges (for TCP and UDP), and the ICMP codes and types (for ICMP). When authorizing ICMP, -1 can be used as a wildcard in the type and code fields.

Permission changes are propagated to instances within the security group as quickly as possible. However, depending on the number of instances, a small delay might occur.

authorizeIp returns boolean TRUE or FALSE

$ec2_sg = new Zend_Service_Amazon_Ec2_Securitygroups('aws_key',
                                                     'aws_secret_key');
$return = $ec2_sg->authorizeIp('mygroup',
                                'protocol',
                                'fromPort',
                                'toPort',
                                'ipRange');

Example 747. Authorize By Group

authorizeGroup Adds permissions to a security group.

Permission changes are propagated to instances within the security group as quickly as possible. However, depending on the number of instances, a small delay might occur.

authorizeGroup returns boolean TRUE or FALSE.

$ec2_sg = new Zend_Service_Amazon_Ec2_Securitygroups('aws_key',
                                                     'aws_secret_key');
$return = $ec2_sg->authorizeGroup('mygroup', 'securityGroupName', 'ownerId');

Revoking Access

Example 748. Revoke by IP

revokeIp Revokes permissions to a security group based on an IP address, protocol type and port range. The permissions used to revoke must be specified using the same values used to grant the permissions.

Permissions are specified by the IP protocol (TCP, UDP or ICMP), the source of the request (by IP range or an Amazon EC2 user-group pair), the source and destination port ranges (for TCP and UDP), and the ICMP codes and types (for ICMP). When authorizing ICMP, -1 can be used as a wildcard in the type and code fields.

Permission changes are propagated to instances within the security group as quickly as possible. However, depending on the number of instances, a small delay might occur.

revokeIp returns boolean TRUE or FALSE

$ec2_sg = new Zend_Service_Amazon_Ec2_Securitygroups('aws_key',
                                                     'aws_secret_key');
$return = $ec2_sg->revokeIp('mygroup',
                             'protocol',
                             'fromPort',
                             'toPort',
                             'ipRange');

Example 749. Revoke By Group

revokeGroup Adds permissions to a security group. The permissions to revoke must be specified using the same values used to grant the permissions.

Permission changes are propagated to instances within the security group as quickly as possible. However, depending on the number of instances, a small delay might occur.

revokeGroup returns boolean TRUE or FALSE.

$ec2_sg = new Zend_Service_Amazon_Ec2_Securitygroups('aws_key',
                                                     'aws_secret_key');
$return = $ec2_sg->revokeGroup('mygroup', 'securityGroupName', 'ownerId');