EC2-AUTHORIZE(1)

📦 version 1.6.14.1, in ubuntu jammy, ubuntu noble

💖 ec2-authorize — the manual page but make it a group chat 💖

okay bestie, sit down, hydrate, because today we're learning ec2-authorize, the ec2-authorize command from the User Commands manual. it grants permissions to a specified group. that's it, that's the vibe. it's giving "let them in, but only through the door i choose" 💅

✨ NAME ✨

ec2-authorize — Grant permissions to a specified group 🫶

✨ SYNOPSIS ✨

ec2auth ([ec2-authorize])
ec2auth [GENERAL OPTIONS] GROUP [SPECIFIC OPTIONS]

✨ GENERAL NOTES ✨

bestie listen. any command option or parameter can be handed a value of - and that means "pls read the values for this option from stdin" 🎀. yes literally any of them. iconic behavior honestly.

✨ DESCRIPTION ✨

Grant selected permissions to a specified group. that's the whole mission. ✨

the GROUP parameter is the name or the ID of the group you're granting this permission to.

⚠️ important heads up: VPC security groups for non-default VPCs must be specified by ID. no name, no nickname, no "you know the one" — the ID. periodt. 💀

✨ GENERAL OPTIONS ✨

these are the universal ones, the base layer, the everyday carry:

  • -O, --aws-access-key KEY — your AWS Access Key ID. defaults to whatever the AWS_ACCESS_KEY environment variable is (if it's set). 🔑
  • -W, --aws-secret-key KEY — your AWS Secret Access Key. defaults to the value of the AWS_SECRET_KEY environment variable (if set). 🤫
  • -T, --security-token TOKEN — AWS delegation token. defaults to the value of the AWS_DELEGATION_TOKEN environment variable (if set). 🎫
  • -K, --private-key KEY — [DEPRECATED] specify KEY as the private key to use. defaults to the value of the EC2_PRIVATE_KEY environment variable (if set), and overrides the default. it's deprecated bestie, it's giving "we don't do that anymore" 🙈
  • -C, --cert CERT — [DEPRECATED] specify CERT as the X509 certificate to use. defaults to the value of the EC2_CERT environment variable (if set), and overrides the default. also deprecated, also a relic, we respect the history tho 💜
  • -U, --url URL — specify URL as the web service URL to use. defaults to https://ec2.amazonaws.com (that's us-east-1) or to the value of the EC2_URL environment variable (if set), and it overrides the default. 🌐
  • --region REGION — specify REGION as the web service region to use. this option overrides the URL you gave with -U URL and overrides the EC2_URL environment variable. it defaults to the region specified by the EC2_URL environment variable, or us-east-1 if that environment variable isn't set. so like, it's the boss of the URL situation, lowkey. 👑
  • -D, --auth-dry-run — check whether you can perform the requested action instead of actually doing it. a lil rehearsal, a dress rehearsal if you will. 🎭
  • -v, --verbose — verbose output. give me ALL the details. 🗣️
  • -?, --help — display this help. the classic. 🆘
  • -H, --headers — display column headers. 📋
  • --debug — display additional debugging information. 🔍
  • --show-empty-fields — indicate empty fields. 🕳️
  • --hide-tags — do not display tags for tagged resources. 🏷️
  • --connection-timeout TIMEOUT — specify a connection timeout TIMEOUT, in seconds. ⏱️
  • --request-timeout TIMEOUT — specify a request timeout TIMEOUT, in seconds. ⏳

✨ SPECIFIC OPTIONS ✨

now the fun part, the actual rule-making. this is where you decide who gets in and how 🚪✨

  • --egress — specifies an egress rule. otherwise, ingress is assumed. so like, no flag = traffic coming in, flag = traffic going out. 🌊
  • -P, --protocol PROTOCOL — may be either a protocol name or a protocol number. note that non-VPC security groups only allow tcp, udp and icmp rules. for non-VPC groups the protocol may be left blank, in which case it defaults to tcp if a source subnet is specified, to tcp and udp if a source group and port range are specified, and to tcp, udp and icmp if only a source group is specified. for VPC groups the protocol all must be explicitly specified. so yes, VPC needs you to say all out loud, no mind reading 🧠✨
  • -p, --port-range PORT-RANGE — range of ports to open. if the tcp or udp protocol is specified (or implied by default), then the range of ports to grant access to may optionally be specified as a single integer, or as a range (min-max). specifying -1 defaults to all ports. all of them. every single one. 😳
  • -t, --icmp-type-code TYPE:CODE — icmp type and code. if the icmp protocol is specified, then icmp type and code may optionally be specified as type:code, where both type and code are integers and compliant with RFC792. type or code (or both) may be specified as -1, which is a wildcard covering all types or codes. 🃏
  • -o, --source-or-dest-group SOURCE-OR-DEST-GROUP [--source-or-dest-group...] — source or destination security group to be authorized, specified as an EC2 security group name, e.g. default. this may be specified more than once to allow network traffic from multiple security groups. stack 'em up bestie 🫂
  • -u, --source-or-dest-group-user SOURCE-OR-DEST-GROUP-USER [--source-or-dest-group-user...] — the owner of the security group specified using -o. if specified only once, the same user will be used for all specified groups. however, if specified once per -o, each user is mapped to a group in order. anything else is invalid. 🚫 this option is invalid for VPC security groups — VPC source groups must be owned by the authorizing user. no exceptions, no wiggle room 💀
  • -s, --cidr CIDR — the network source from which traffic is to be authorized in the case of an ingress request, or to which traffic is to be authorized in the case of an egress request. specified as a CIDR subnet range, e.g. 205.192.8.45/24. this may be specified more than once to allow traffic from multiple subnets. 🌈 if no subnet and no group are specified, this defaults to the wildcard CIDR 0.0.0.0/0. (yes. everyone. the whole internet. be careful 💀)
  • --source-subnet — like --cidr, but for ingress requests only. for backward compatibility. 👵
  • --dest-subnet — like --cidr, but for egress requests only. for backward compatibility. 👴

✨ SEE ALSO ✨

go read more, bestie, the docs are right there:

and that's the whole page, you ate that fr fr 💅✨ this was the EC2 API command line tools page, version 1.6.14.1, api=2014-05-01 — shoutout to the source and the version for making this whole thing possible 🫶 mwah, go authorize something responsibly, ily bye 💖🎀🦋

📦 where this page comes from