alibabacloud-ecs-security-group

ECS Security Group and Network Management

Manage security groups and network configurations for Alibaba Cloud ECS instances.

Pre-check: Alibaba Cloud CLI must be installed and at least version 3.3.3.

aliyun version   # must be >= 3.3.3

Pre-check: Alibaba Cloud Credentials Required

aliyun configure list

If no valid profile exists, STOP and guide user to configure credentials.

Pre-check: Aliyun CLI plugin update required

aliyun configure set --auto-plugin-install true
aliyun plugin update

Observability (MUST follow for every aliyun command)

Upon loading this skill, generate a random session ID (32-char lowercase hex string) once for the entire session.

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

Core Workflow

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters MUST be confirmed with the user.

1. Security Group Management

# List security groups in a VPC
aliyun ecs describe-security-groups --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Create security group
aliyun ecs create-security-group --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --security-group-name "<GroupName>" \
  --security-group-type normal \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Delete security group (must have no instances)
aliyun ecs delete-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

2. Security Group Rules

# View security group rules
aliyun ecs describe-security-group-attribute --security-group-id <SecurityGroupId> \
  --direction ingress \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Add inbound rule (e.g., allow SSH from specific CIDR)
aliyun ecs authorize-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 22/22 \
  --source-cidr-ip <SourceCIDR> \
  --policy accept \
  --priority 1 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Add outbound rule
aliyun ecs authorize-security-group-egress --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 443/443 \
  --dest-cidr-ip <DestCIDR> \
  --policy accept \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Revoke inbound rule
aliyun ecs revoke-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 22/22 \
  --source-cidr-ip <SourceCIDR> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}