CODEWITHSUNDEEP
amazon-web-servicesamazon-ec2boto3
Anup
Anup

Reputation: 41

CIDR block 'sg-1234' malformed error is thrown in boto3

security_group_id=response['GroupId'] -> This is from response

sg = security_group_id+'/32'  -> IPv4

result = ec2.authorize_security_group_egress(GroupId=security_group_id,IpPermissions=[
        {
        'IpProtocol': 'tcp','FromPort': 3306,'ToPort': 123,'IpRanges': [{'CidrIp':sg,'Description': 'Testing sg attach.'}]
        }])

ERROR Message:

An error occurred (InvalidParameterValue) when calling the AuthorizeSecurityGroupEgress operation: CIDR block sg-a932b3c1/32 is malformed

Upvotes: 0

Views: 2428

Answers (2)

Anup
Anup

Reputation: 41

def create_my_group():

try:
    # Get default VPC ID

    response = ec2_client.describe_vpcs()
    vpc_id = response.get('Vpcs', [{}])[0].get('VpcId', '')
    print("VPC-Id: ",vpc_id)

    # Create a group with access only through SSH

    security_con1 = ec2_client.create_security_group(GroupName='SSH_Access',VpcId=vpc_id,
        Description="This will allow only SSH access to EC2.")
    security_group_id1=security_con1['GroupId']

    print("Created security group for EC2 Webserver.")
    print("Now, attaching rules to this group......")
    time.sleep(2)

    # Create rule for SSH only access

    rule = ec2_client.authorize_security_group_ingress(GroupId=security_group_id1,IpPermissions=[
        {'IpProtocol': 'tcp','FromPort': 22,'ToPort': 22,'IpRanges': [{'CidrIp': '0.0.0.0/0'}]},
        {'IpProtocol': 'tcp','FromPort': 443,'ToPort': 443,'IpRanges': [{'CidrIp': '0.0.0.0/0'}]}
        ]
    )

    print("Finished setting up EC2 security group.")
    time.sleep(2)

    # Create a group with access only through authorized group

    security_con2 = ec2_client.create_security_group(GroupName='DB_Access',VpcId=vpc_id,
        Description="This will allow only SSH access to DB.")
    security_group_id2=security_con2['GroupId']

    print("Created security group for DB-Webserver.")
    print("Now, attaching rules to this group......")
    time.sleep(2)

    # Create access rule to access DB_access from users of SSH_Access group only

    rule2 = ec2_client.authorize_security_group_ingress(GroupId=security_group_id2,
        IpPermissions=[
            {
            'IpProtocol':'tcp','IpRanges':[],'FromPort':3306,'ToPort':3306,"UserIdGroupPairs": [{"GroupId": security_group_id1}]
            }
        ]
    )
    print("Finished setting up DB security group.")

except ClientError as e:
    print(e)

Upvotes: 1

helloV
helloV

Reputation: 52393

You have to specify a valid CIDR IP range. sg-a932b3c1/32 is not a valid CIDR.

CidrIp (string) -- The CIDR IPv4 address range. We recommend that you specify the CIDR range in a set of IP permissions instead.

Are you confusing with: SourceSecurityGroupName ?

SourceSecurityGroupName (string) -- The name of a destination security group. To authorize outbound access to a destination security group, we recommend that you use a set of IP permissions instead.

Upvotes: 4

Related Questions