Translated from 日本語 • View original Hello. This is Komiya.
This time I will introduce you to Piculet and not update the rules with the group file. I want to organize or delete it a little, but it's too much to do by hand, I'm worried about operation misses, it's a hassle, and I want to go home quickly, so if I want to check which one is linked to it in bulk, or if I want to update it in bulk, it's a way to do it with a for loop and CLI. When applying for a relaxation of the upper limit of the SecurityGroup, this kind of work is necessary when the communication performance is caught in the way the SG is written.
I'm not very good at using it, but I'll post it for now. Please use it at your own risk. It seems that there are many people who are doing similar things and know more sophisticated methods. I feel that Mr. Inada and other cooperative members of our company seem to be more knowledgeable. Masakari welcomes you. When I asked Mr. Inada, he said that I should use text more and use join, so I think he will write something soon.
Obtaining instance information linked to the SecurityGroup ID
I think this can be done casually because it only gets existing information and does not update it. First, make a list (put the SG you want to delete)
vi listfile
sg-xxxxxxxx,SG_hoge_dev1
sg-yyyyyyyy,SG_fuga_dev2
...
list=listfile
profile=xxxx
Load the list and run describe-instances
for i in `cat $list|grep -v elb`
do
groupid=`echo $i |awk -F, '{print $1}'`
groupname=`echo $i |awk -F, '{print $2}'`
echo $i
aws ec2 describe-instances --profile ${profile} --filters Name=instance.group-id,Values=$groupid --output text \
--query 'Reservations[]. Instances[*]. [InstanceId,PrivateIpAddress,Tags[? Key==`Name`]. Value[]]' --output json \
|sed -e '/\]/d' -e '/\[/d' -e '/^$/d' -e 's/ //g'|perl -pe 's/,[ ]*\n/,/g'|sort -t , -k 3
echo ""
done
It is used to create a listfile from the results and remove or replace the SG.
Obtain ELB information linked to the SecurityGroup ID
for i in `cat $list`
do
groupid=`echo $i |awk -F, '{print $1}'`
groupname=`echo $i |awk -F, '{print $2}'`
echo $i
aws elb describe-load-balancers --profile ${profile} \
--query 'LoadBalancerDescriptions[*]. [LoadBalancerName,SecurityGroups]' --output=json \
|sed -e 's/\[//g' -e 's/\],//g' -e 's/\]//g' -e 's/ //g'|perl -pe "s/,\n/,/g" \
|sed -e '/^$/d'|perl -pe 's/,\n/,/g'|grep $groupid
echo ""
done
It is used to create a listfile from the results and remove or replace the SG.
Change the SecurityGroup of an instance to a specific SecurityGroup
Please use it at your own risk.
list=xxxxx
for i in `cat $list|grep -v xxxxx`
do
instanceid=`echo $i|awk -F, '{print $1}'|sed -e 's/"//g'`
attached_groups=`aws ec2 describe-instance-attribute --instance-id ${instanceid} --attribute groupSet --profile ${profile} --output=text|grep GROUPS|awk '{print $2}'|perl -pe 's/\n/ /g'`
add_groupid="sg-xxxxxxxx"
groupids=`echo ${add_groupid}`
echo $i
echo "curgroupids: ${attached_groups}"
echo "newgroupids: ${groupids}"
aws ec2 modify-instance-attribute --instance-id ${instanceid} --groups ${groupids} --profile ${profile} --no-dry-run
echo "result:"
aws ec2 describe-instance-attribute --instance-id ${instanceid} --attribute groupSet --profile ${profile} --output=text|grep GROUPS|awk '{print $2}'
echo ""
done
*If you want to check only the current situation, please uncheck the modify-instance-attribute line and run it. Please change the literal string as appropriate.
Remove a specific SecurityGroup from the SecurityGroup of the instance
for i in `cat $list|grep xxxxxxx`
do
instanceid=`echo $i|awk -F, '{print $1}'|sed -e 's/"//g'`
attached_groups=`aws ec2 describe-instance-attribute --instance-id ${instanceid} --attribute groupSet --profile ${profile} --output=text|grep GROUPS|awk '{print $2}'|perl -pe 's/\n/ /g'`
groupids=`echo ${attached_groups}|sed -e 's/sg-aaaaaaaa//g'|tr -s ' '`
echo $i
echo "curgroupids: ${attached_groups}"
echo "newgroupids: ${groupids}"
aws ec2 modify-instance-attribute --instance-id ${instanceid} --groups ${groupids} --profile ${profile} --no-dry-run
echo "result:"
aws ec2 describe-instance-attribute --instance-id ${instanceid} --attribute groupSet --profile ${profile} --output=text|grep GROUPS|awk '{print $2}'
echo ""
done
*If you want to check only the current situation, please uncheck the modify-instance-attribute line and run it. Please change the literal string as appropriate.
Change the ELB's SecurityGroup to a specific SecurityGroup
for i in `cat $list|grep ELB`
do
elbname=`echo $i|awk -F, '{print $1}'|sed -e 's/"//g'`
add_groupid="sg-bbbbbbbb"
echo $elbname
current_groups=`aws elb describe-load-balancers --profile ${profile} --load-balancer-names ${elbname} --query 'LoadBalancerDescriptions[*]. [LoadBalancerName,SecurityGroups]' --output=text|grep sg-|sed -e 's/\t/ /'`
newgroupids=`echo ${add_groupid}`
echo "curgroupid: ${current_groups}"
echo "newgroupid: ${newgroupids}"
aws elb apply-security-groups-to-load-balancer --load-balancer-name ${elbname} --security-groups ${newgroupids} --profile ${profile}
echo "result:"
aws elb describe-load-balancers --profile ${profile} --load-balancer-names ${elbname} --query 'LoadBalancerDescriptions[*]. [LoadBalancerName,SecurityGroups]' --output=text|grep sg-
echo ""
done
*If you only want to check the current situation, please uncheck the line in apply-security-groups-to-load-balancer and run it. Please change the literal string as appropriate.
Remove a specific SecurityGroup from the ELB's SecurityGroup
for i in `cat $list|grep ELB`
do
elbname=`echo $i|awk -F, '{print $1}'|sed -e 's/"//g'`
echo $elbname
current_groups=`aws elb describe-load-balancers --profile ${profile} --load-balancer-names ${elbname} --query 'LoadBalancerDescriptions[*]. [LoadBalancerName,SecurityGroups]' --output=text|grep sg-|sed -e 's/\t/ /'`
newgroupids=`echo ${current_groups}|sed -e 's/sg-cccccccc//g'|tr -s ' '`
echo "curgroupid: ${current_groups}"
echo "newgroupid: ${newgroupids}"
aws elb apply-security-groups-to-load-balancer --load-balancer-name ${elbname} --security-groups ${newgroupids} --profile ${profile}
echo "result:"
aws elb describe-load-balancers --profile ${profile} --load-balancer-names ${elbname} --query 'LoadBalancerDescriptions[*]. [LoadBalancerName,SecurityGroups]' --output=text|grep sg-
echo ""
done
*If you only want to check the current situation, please uncheck the line in apply-security-groups-to-load-balancer and run it. Please change the literal string as appropriate. I think it would be a good idea to pipe it up to the point where you can see help or man, and cut off the parts that are handed over to see the results of execution. If you type aws elb describe-load-balancers help, the manual will appear.
Thank you for watching.