cdocutils.nodes document q)q}q(U nametypesq}q(Xec2 security groupsqNXsecurity_groupsquUsubstitution_defsq}q Uparse_messagesq ]q Ucurrent_sourceq NU decorationq NUautofootnote_startqKUnameidsq}q(hUec2-security-groupsqhUsecurity-groupsquUchildrenq]q(cdocutils.nodes target q)q}q(U rawsourceqX.. _security_groups:UparentqhUsourceqXE/Users/kyleknap/Documents/GitHub/boto/docs/source/security_groups.rstqUtagnameqUtargetqU attributesq}q(Uidsq ]Ubackrefsq!]Udupnamesq"]Uclassesq#]Unamesq$]Urefidq%huUlineq&KUdocumentq'hh]ubcdocutils.nodes section q()q)}q*(hUhhhhUexpect_referenced_by_nameq+}q,hhshUsectionq-h}q.(h"]h#]h!]h ]q/(hheh$]q0(hheuh&Kh'hUexpect_referenced_by_idq1}q2hhsh]q3(cdocutils.nodes title q4)q5}q6(hXEC2 Security Groupsq7hh)hhhUtitleq8h}q9(h"]h#]h!]h ]h$]uh&Kh'hh]q:cdocutils.nodes Text q;XEC2 Security Groupsq(hh7hh5ubaubcdocutils.nodes paragraph q?)q@}qA(hX#Amazon defines a security group as:qBhh)hhhU paragraphqCh}qD(h"]h#]h!]h ]h$]uh&Kh'hh]qEh;X#Amazon defines a security group as:qFqG}qH(hhBhh@ubaubcdocutils.nodes definition_list qI)qJ}qK(hUhh)hhhUdefinition_listqLh}qM(h"]h#]h!]h ]h$]uh&Nh'hh]qNcdocutils.nodes definition_list_item qO)qP}qQ(hX"A security group is a named collection of access rules. These access rules specify which ingress, i.e. incoming, network traffic should be delivered to your instance." hhJhhhUdefinition_list_itemqRh}qS(h"]h#]h!]h ]h$]uh&K h]qT(cdocutils.nodes term qU)qV}qW(hXL"A security group is a named collection of access rules. These access rulesqXhhPhhhUtermqYh}qZ(h"]h#]h!]h ]h$]uh&K h]q[h;XL"A security group is a named collection of access rules. These access rulesq\q]}q^(hhXhhVubaubcdocutils.nodes definition q_)q`}qa(hUh}qb(h"]h#]h!]h ]h$]uhhPh]qch?)qd}qe(hX\specify which ingress, i.e. incoming, network traffic should be delivered to your instance."qfhh`hhhhCh}qg(h"]h#]h!]h ]h$]uh&K h]qhh;X\specify which ingress, i.e. incoming, network traffic should be delivered to your instance."qiqj}qk(hhfhhdubaubahU definitionqlubeubaubh?)qm}qn(hX;To get a listing of all currently defined security groups::qohh)hhhhCh}qp(h"]h#]h!]h ]h$]uh&K h'hh]qqh;X:To get a listing of all currently defined security groups:qrqs}qt(hX:To get a listing of all currently defined security groups:hhmubaubcdocutils.nodes literal_block qu)qv}qw(hX>>> rs = conn.get_all_security_groups() >>> print rs [SecurityGroup:appserver, SecurityGroup:default, SecurityGroup:vnc, SecurityGroup:webserver]hh)hhhU literal_blockqxh}qy(U xml:spaceqzUpreserveq{h ]h!]h"]h#]h$]uh&Kh'hh]q|h;X>>> rs = conn.get_all_security_groups() >>> print rs [SecurityGroup:appserver, SecurityGroup:default, SecurityGroup:vnc, SecurityGroup:webserver]q}q~}q(hUhhvubaubh?)q}q(hXEach security group can have an arbitrary number of rules which represent different network ports which are being enabled. To find the rules for a particular security group, use the rules attribute::hh)hhhhCh}q(h"]h#]h!]h ]h$]uh&Kh'hh]qh;XEach security group can have an arbitrary number of rules which represent different network ports which are being enabled. To find the rules for a particular security group, use the rules attribute:qq}q(hXEach security group can have an arbitrary number of rules which represent different network ports which are being enabled. To find the rules for a particular security group, use the rules attribute:hhubaubhu)q}q(hX>>> sg = rs[1] >>> sg.name u'default' >>> sg.rules [IPPermissions:tcp(0-65535), IPPermissions:udp(0-65535), IPPermissions:icmp(-1--1), IPPermissions:tcp(22-22), IPPermissions:tcp(80-80)]hh)hhhhxh}q(hzh{h ]h!]h"]h#]h$]uh&Kh'hh]qh;X>>> sg = rs[1] >>> sg.name u'default' >>> sg.rules [IPPermissions:tcp(0-65535), IPPermissions:udp(0-65535), IPPermissions:icmp(-1--1), IPPermissions:tcp(22-22), IPPermissions:tcp(80-80)]qq}q(hUhhubaubh?)q}q(hXIn addition to listing the available security groups you can also create a new security group. I'll follow through the "Three Tier Web Service" example included in the EC2 Developer's Guide for an example of how to create security groups and add rules to them.qhh)hhhhCh}q(h"]h#]h!]h ]h$]uh&K!h'hh]qh;XIn addition to listing the available security groups you can also create a new security group. I'll follow through the "Three Tier Web Service" example included in the EC2 Developer's Guide for an example of how to create security groups and add rules to them.qq}q(hhhhubaubh?)q}q(hX]First, let's create a group for our Apache web servers that allows HTTP access to the world::hh)hhhhCh}q(h"]h#]h!]h ]h$]uh&K&h'hh]qh;X\First, let's create a group for our Apache web servers that allows HTTP access to the world:qq}q(hX\First, let's create a group for our Apache web servers that allows HTTP access to the world:hhubaubhu)q}q(hX>>> web = conn.create_security_group('apache', 'Our Apache Group') >>> web SecurityGroup:apache >>> web.authorize('tcp', 80, 80, '0.0.0.0/0') Truehh)hhhhxh}q(hzh{h ]h!]h"]h#]h$]uh&K)h'hh]qh;X>>> web = conn.create_security_group('apache', 'Our Apache Group') >>> web SecurityGroup:apache >>> web.authorize('tcp', 80, 80, '0.0.0.0/0') Trueqq}q(hUhhubaubh?)q}q(hXThe first argument is the ip protocol which can be one of; tcp, udp or icmp. The second argument is the FromPort or the beginning port in the range, the third argument is the ToPort or the ending port in the range and the last argument is the CIDR IP range to authorize access to.qhh)hhhhCh}q(h"]h#]h!]h ]h$]uh&K/h'hh]qh;XThe first argument is the ip protocol which can be one of; tcp, udp or icmp. The second argument is the FromPort or the beginning port in the range, the third argument is the ToPort or the ending port in the range and the last argument is the CIDR IP range to authorize access to.qq}q(hhhhubaubh?)q}q(hX2Next we create another group for the app servers::qhh)hhhhCh}q(h"]h#]h!]h ]h$]uh&K4h'hh]qh;X1Next we create another group for the app servers:qq}q(hX1Next we create another group for the app servers:hhubaubhu)q}q(hXI>>> app = conn.create_security_group('appserver', 'The application tier')hh)hhhhxh}q(hzh{h ]h!]h"]h#]h$]uh&K6h'hh]qh;XI>>> app = conn.create_security_group('appserver', 'The application tier')qq}q(hUhhubaubh?)q}q(hXWe then want to grant access between the web server group and the app server group. So, rather than specifying an IP address as we did in the last example, this time we will specify another SecurityGroup object.:qhh)hhhhCh}q(h"]h#]h!]h ]h$]uh&K8h'hh]qh;XWe then want to grant access between the web server group and the app server group. So, rather than specifying an IP address as we did in the last example, this time we will specify another SecurityGroup object.:qq}q(hhhhubaubcdocutils.nodes doctest_block q)q}q(hX%>>> app.authorize(src_group=web) Truehh)hNhU doctest_blockqh}q(hzh{h ]h!]h"]h#]h$]uh&Nh'hh]qh;X%>>> app.authorize(src_group=web) TrueqɅq}q(hUhhubaubh?)q}q(hXNow, to verify that the web group now has access to the app servers, we want to temporarily allow SSH access to the web servers from our computer. Let's say that our IP address is 192.168.1.130 as it is in the EC2 Developer Guide. To enable that access::hh)hhhhCh}q(h"]h#]h!]h ]h$]uh&K?h'hh]qh;XNow, to verify that the web group now has access to the app servers, we want to temporarily allow SSH access to the web servers from our computer. Let's say that our IP address is 192.168.1.130 as it is in the EC2 Developer Guide. To enable that access:qЅq}q(hXNow, to verify that the web group now has access to the app servers, we want to temporarily allow SSH access to the web servers from our computer. Let's say that our IP address is 192.168.1.130 as it is in the EC2 Developer Guide. To enable that access:hhubaubhu)q}q(hX_>>> web.authorize(ip_protocol='tcp', from_port=22, to_port=22, cidr_ip='192.168.1.130/32') Truehh)hhhhxh}q(hzh{h ]h!]h"]h#]h$]uh&KDh'hh]qh;X_>>> web.authorize(ip_protocol='tcp', from_port=22, to_port=22, cidr_ip='192.168.1.130/32') Trueqׅq}q(hUhhubaubh?)q}q(hX5Now that this access is authorized, we could ssh into an instance running in the web group and then try to telnet to specific ports on servers in the appserver group, as shown in the EC2 Developer's Guide. When this testing is complete, we would want to revoke SSH access to the web server group, like this::hh)hhhhCh}q(h"]h#]h!]h ]h$]uh&KGh'hh]qh;X4Now that this access is authorized, we could ssh into an instance running in the web group and then try to telnet to specific ports on servers in the appserver group, as shown in the EC2 Developer's Guide. When this testing is complete, we would want to revoke SSH access to the web server group, like this:qޅq}q(hX4Now that this access is authorized, we could ssh into an instance running in the web group and then try to telnet to specific ports on servers in the appserver group, as shown in the EC2 Developer's Guide. When this testing is complete, we would want to revoke SSH access to the web server group, like this:hhubaubhu)q}q(hX>>> web.rules [IPPermissions:tcp(80-80), IPPermissions:tcp(22-22)] >>> web.revoke('tcp', 22, 22, cidr_ip='192.168.1.130/32') True >>> web.rules [IPPermissions:tcp(80-80)]hh)hhhhxh}q(hzh{h ]h!]h"]h#]h$]uh&KLh'hh]qh;X>>> web.rules [IPPermissions:tcp(80-80), IPPermissions:tcp(22-22)] >>> web.revoke('tcp', 22, 22, cidr_ip='192.168.1.130/32') True >>> web.rules [IPPermissions:tcp(80-80)]q允q}q(hUhhubaubeubehUU transformerqNU footnote_refsq}qUrefnamesq}qUsymbol_footnotesq]qUautofootnote_refsq]qUsymbol_footnote_refsq]qU citationsq]qh'hU current_lineqNUtransform_messagesq]qcdocutils.nodes system_message q)q}q(hUh}q(h"]UlevelKh ]h!]Usourcehh#]h$]UlineKUtypeUINFOquh]qh?)q}q(hUh}r(h"]h#]h!]h ]h$]uhhh]rh;X5Hyperlink target "security-groups" is not referenced.rr}r(hUhhubahhCubahUsystem_messagerubaUreporterrNUid_startrKU autofootnotesr]r U citation_refsr }r Uindirect_targetsr ]r Usettingsr(cdocutils.frontend Values ror}r(Ufootnote_backlinksrKUrecord_dependenciesrNU rfc_base_urlrUhttp://tools.ietf.org/html/rU tracebackrUpep_referencesrNUstrip_commentsrNU toc_backlinksrUentryrU language_coderUenrU datestamprNU report_levelrKU _destinationrNU halt_levelr KU strip_classesr!Nh8NUerror_encoding_error_handlerr"Ubackslashreplacer#Udebugr$NUembed_stylesheetr%Uoutput_encoding_error_handlerr&Ustrictr'U sectnum_xformr(KUdump_transformsr)NU docinfo_xformr*KUwarning_streamr+NUpep_file_url_templater,Upep-%04dr-Uexit_status_levelr.KUconfigr/NUstrict_visitorr0NUcloak_email_addressesr1Utrim_footnote_reference_spacer2Uenvr3NUdump_pseudo_xmlr4NUexpose_internalsr5NUsectsubtitle_xformr6U source_linkr7NUrfc_referencesr8NUoutput_encodingr9Uutf-8r:U source_urlr;NUinput_encodingr<U utf-8-sigr=U_disable_configr>NU id_prefixr?UU tab_widthr@KUerror_encodingrAUUTF-8rBU_sourcerChUgettext_compactrDU generatorrENUdump_internalsrFNU smart_quotesrGU pep_base_urlrHUhttp://www.python.org/dev/peps/rIUsyntax_highlightrJUlongrKUinput_encoding_error_handlerrLj'Uauto_id_prefixrMUidrNUdoctitle_xformrOUstrip_elements_with_classesrPNU _config_filesrQ]Ufile_insertion_enabledrRU raw_enabledrSKU dump_settingsrTNubUsymbol_footnote_startrUKUidsrV}rW(hh)hh)uUsubstitution_namesrX}rYhh'h}rZ(h"]h ]h!]Usourcehh#]h$]uU footnotesr[]r\Urefidsr]}r^h]r_hasub.