从java中的另一个安全组创建Aws安全组入站规则

Question

我有多个AWS安全组，我想从另一个安全组在一个安全组中创建入站流量规则。我可以从AWS控制台做到这一点，但我想使用java api实现自动化。我怎么能做到呢？

对于使用Cidr块的简单规则，我使用了AuthorizeSecurityGroupingResequest，但在这里我找不到实现这一点的方法。

示例代码：

AuthorizeSecurityGroupIngressRequest authorizeSecurityGroupIngressRequest =new AuthorizeSecurityGroupIngressRequest();
authorizeSecurityGroupIngressRequest.withFromPort(securityGroupIngressRequestParam.getFromPort());
authorizeSecurityGroupIngressRequest.withIpProtocol(securityGroupIngressRequestParam.getIpProtocols().getName());
authorizeSecurityGroupIngressRequest.withToPort(securityGroupIngressRequestParam.getToPort());
authorizeSecurityGroupIngressRequest.withCidrIp(securityGroupIngressRequestParam.getCidrBlock());
authorizeSecurityGroupIngressRequest.setGroupId(securityGroupIngressRequestParam.getSecurityGroupId());
amazonEc2Client.authorizeSecurityGroupIngress(authorizeSecurityGroupIngressRequest);

Answer 1

经过Aws Apis的一些尝试和错误，我找到了适合我的解决方案。

我们可以使用IpPermission模型，而不是使用api设置规则详细信息来添加sourceSecurityGroupId。

   AuthorizeSecurityGroupIngressRequest authorizeSecurityGroupIngressRequest = new AuthorizeSecurityGroupIngressRequest();

    IpPermission ipPermission = new IpPermission();
    ipPermission.withFromPort(securityGroupIngressRequestParam.getFromPort()).withToPort(securityGroupIngressRequestParam.getToPort())
        .withIpProtocol(securityGroupIngressRequestParam.getIpProtocols().getName());

    if (!StringUtil.isEmpty(securityGroupIngressRequestParam.getCidrBlock())) {
      ipPermission.withIpRanges(securityGroupIngressRequestParam.getCidrBlock());
    } else if (!StringUtil.isEmpty(securityGroupIngressRequestParam.getSourceSecurityGroupId())) {
      UserIdGroupPair userIdGroupPairs = new UserIdGroupPair();
      userIdGroupPairs.setGroupId(securityGroupIngressRequestParam.getSourceSecurityGroupId());
      ipPermission.withUserIdGroupPairs(userIdGroupPairs);
    } else {
      // TODO throw exception
    }

    authorizeSecurityGroupIngressRequest.withIpPermissions(ipPermission);
    authorizeSecurityGroupIngressRequest.setGroupId(securityGroupIngressRequestParam.getSecurityGroupId());

    amazonEc2Client.authorizeSecurityGroupIngress(authorizeSecurityGroupIngressRequest);