Aqui está o método python / boto de 'copiar grupos de segurança' de uma biblioteca personalizada que escrevi para tornar esse tipo de coisa mais fácil / automatizá-los. Por fim, essa foi a solução que eu criei.
vpcId is the Virtual Private Cloud Id
keys is a dictionary with your AWS keys
O resto deve ser direto para descobrir.
def copyEC2SecurityGroup(self, keys, region, securityGroupName, newSecurityGroupName = None, newRegion = None, vpcId = None):
newEc2Connection = None
print("Creating ec2Connection for source region: " + region)
ec2Connection = lib.getEc2Connection(region, keys)
if newRegion is None:
newRegion = region
else:
print("New Region Detected, creating for New region: " + newRegion)
newEc2Connection = lib.getEc2Connection(newRegion, keys)
newRegionInfo = newEc2Connection.region
print("new region is: %s" % newRegion)
if newSecurityGroupName is None:
newSecurityGroupName = securityGroupName
print ("new security group is: %s" % newSecurityGroupName)
# if copying in the same region the new security group cannot have the same name.
if newRegion == region:
if newSecurityGroupName == securityGroupName:
print ("Old and new security groups cannot have the same name when copying to the same region.")
exit(1)
groups = [group for group in ec2Connection.get_all_security_groups() if group.name == securityGroupName]
print"got groups count " + str(len(groups))
if groups:
theOldGroup = groups[0]
print theOldGroup.rules
else:
print("Can't find security group by the name of: %s" % securityGroupName)
exit(1)
print groups
pprint(theOldGroup)
if newEc2Connection is not None:
print("Creating new security group in new region")
sg = newEc2Connection.create_security_group(newSecurityGroupName, newSecurityGroupName, vpcId)
sleep(5)
else:
print("Creating new security group in current region")
sg = ec2Connection.create_security_group(newSecurityGroupName, newSecurityGroupName, vpcId)
sleep(5)
source_groups = []
for rule in theOldGroup.rules:
for grant in rule.grants:
strGrant = str(grant)
print(strGrant)
if strGrant.startswith("sg"):
print("Cannot copy 'security group rule' (%s)... only cidr_ip's e.g. xxx.xxx.xxx.xxx/yy." % strGrant)
continue
grant_nom = grant.name or grant.group_id
if grant_nom:
if grant_nom not in source_groups:
source_groups.append(grant_nom)
sg.authorize(rule.ip_protocol, rule.from_port, rule.to_port, grant)
else:
sg.authorize(rule.ip_protocol, rule.from_port, rule.to_port, grant.cidr_ip)
return sg
