Add Tag to a security group rule

0

Hi,

Is there a way to add a Tag (a name) to a rule in a security group using CloudFormation template? Well, maybe the question is not clear enough. Let's see an example:

"CGExternalSecurityGroup": {
    "Type": "AWS::EC2::SecurityGroup",
    "Properties": {
        "VpcId": {
	    "Ref": "CacheGuardVPC"
        },
        "GroupDescription": "These rules specify allowed traffic incoming from the external NIC.",
        "SecurityGroupIngress": [
	    {"Description": "Allow Web traffic", "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "CidrIp": "0.0.0.0/0"}
        ],
	"Tags": [
	    {
                "Key": "Name",
                "Value": "CGExternalSG"
	    }
        ]
    }
}

In the above example, we want to add the Tag name "WebTraffic" to the rule {"Description": "Allow Web traffic", "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "CidrIp": "0.0.0.0/0"} so we can quickly identify the rule purpose in the AWS UI. As this is possible when using the AWS UI , we hope to find a solution to do it in our template.

Best Regards,

CG

profile picture
已提問 10 個月前檢視次數 321 次
1 個回答
1

Hi, as per https://github.com/aws-cloudformation/cloudformation-coverage-roadmap/issues/819 tags are not supported for IAM policies in standard CloudFormation. The public documentation confirms it.

What I do personally in similar situation is that I launch an EC2 in same template with UserData for my shell commands (aws cli, regular shell, etc.) I put a CFN DependsOn on the resources that I want to modify to make that they are created when the shell commands are executed at EC2 start. My last shell command is a Linux shutdown to remain frugal on costs.

I know that it is not the most elegant solution that you can hope for but it works well.

Another way to go is CommandRunner: https://aws.amazon.com/blogs/mt/running-bash-commands-in-aws-cloudformation-templates/

Best,

Didier

profile pictureAWS
專家
已回答 10 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南