Cant revoke ingress with boto3 on TCP range

Question

This is my code snippet I'm using:

import boto3

ip_check_list = [
  "1.2.3.4/32",
  "5.6.7.8/32",

]

for region in ['us-east-1']:
  client = boto3.client('ec2',region_name=region)
  paginator = client.get_paginator('describe_security_groups')
  page_iterator = paginator.paginate()
  for page in page_iterator:
    for sg in page['SecurityGroups']:
      for lb in sg['IpPermissions']:
        for ip in lb['IpRanges']:
          from_port = lb.get('FromPort')
          to_port = lb.get('ToPort')
          ip_proto=lb['IpProtocol']
          if sg['GroupId'] == 'sg-12345' and ip['CidrIp'] in ip_check_list:
            try:
              if from_port:
                response = client.revoke_security_group_ingress (
                  GroupId=sg['GroupId'],
                  IpPermissions=[
                    {
                      'FromPort': from_port,
                      'ToPort': to_port,
                      'IpProtocol': ip_proto,
                      'IpRanges': [
                        {
                          'CidrIp': ip['CidrIp']
                        }
                      ]
                    }
                  ]
                )
              else:
                response = client.revoke_security_group_ingress (
                  GroupId=sg['GroupId'],
                  IpPermissions=[
                    {
                      'IpProtocol': ip_proto,
                      'IpRanges': [
                        {
                          'CidrIp': ip['CidrIp']
                        }
                      ]
                    }
                  ]
                )
            except Exception as e:
              print e
              print sg['GroupId']

However I get the following error:

An error occurred (InvalidParameterValue) when calling the RevokeSecurityGroupIngress operation: Invalid value 'Must specify both from and to ports with TCP/UDP.' for portRange.

The SG rule in question:

           "IpPermissions": [
                {
                    "PrefixListIds": [],
                    "FromPort": 0,
                    "IpRanges": [
                        {
                            "CidrIp": "1.2.3.4/32"
                        }
                    ],
                    "ToPort": 65535,
                    "IpProtocol": "tcp",
                    "UserIdGroupPairs": [],
                    "Ipv6Ranges": []
                }
            ],

* EDIT *: Found my error, when I was checking "if from_port" I wasn't accommodating the the valid value of 0, so the block was getting inadvertently skipped.

Answer 1

Found my error, when I was checking "if from_port" I wasn't accommodating the the valid value of 0, so the block was getting inadvertently skipped.

Answer 2

Boto3 docs say:

For the TCP and UDP protocols, you must also specify the destination port or range of ports.

So you need to provide some port values for the second revoke_security_group_ingress. Maybe some default values, or all entire port range.