EC2-REVOKE(1)

📦 version 1.6.14.1, in ubuntu jammy, ubuntu noble

okay so bestie, sit down, hydrate, because this is EC2-REVOKE, and it lives in the User Commands manual — that's section 1 if you're keeping score 💅. It's the little command that takes permissions away from a security group, and honestly? Sometimes you gotta be the one who says "no <3" to a port. Let's get into it.

🌸 NAME 🌸

ec2-revoke — revoke permissions from a group 🚫🔐

✨ SYNOPSIS ✨

ec2revoke ([ec2-revoke])
ec2revoke [GENERAL OPTIONS] GROUP [SPECIFIC OPTIONS]

💌 GENERAL NOTES 💌

Any command option/parameter may be passed a value of - to indicate that values for that option should be read from stdin. So like, if you don't wanna type your secret in the shell where everyone can see it, you can pipe it in instead. Very demure, very mindful 🎀

🦋 DESCRIPTION 🦋

Revoke selected permissions from a specified group. That's the whole vibe — you point at a group, you point at a rule, and the rule is gone.

The GROUP parameter is name or ID of the group to revoke this permission from.

⚠️ heads up bestie: VPC security groups for non-default VPCs must be specified by ID. Not name. ID. The name will not save you here, I promise. 💀

👑 GENERAL OPTIONS 👑

  • -O, --aws-access-key KEY — Your AWS Access Key ID. Defaults to the value of the AWS_ACCESS_KEY environment variable (if set).
  • -W, --aws-secret-key KEY — Your AWS Secret Access Key. Defaults to the value of the AWS_SECRET_KEY environment variable (if set). 🤫
  • -T, --security-token TOKEN — AWS delegation token. Defaults to the value of the AWS_DELEGATION_TOKEN environment variable (if set).
  • -K, --private-key KEY — [DEPRECATED] Specify KEY as the private key to use. Defaults to the value of the EC2_PRIVATE_KEY environment variable (if set). Overrides the default. (it's giving legacy, ngl 🙈)
  • -C, --cert CERT — [DEPRECATED] Specify CERT as the X509 certificate to use. Defaults to the value of the EC2_CERT environment variable (if set). Overrides the default.
  • -U, --url URL — Specify URL as the web service URL to use. Defaults to the value of https://ec2.amazonaws.com (us-east-1) or to that of the EC2_URL environment variable (if set). Overrides the default.
  • --region REGION — Specify REGION as the web service region to use. This option will override the URL specified by the -U URL option and EC2_URL environment variable. This option defaults to the region specified by the EC2_URL environment variable or us-east-1 if this environment variable is not set.
  • -D, --auth-dry-run — Check if you can perform the requested action rather than actually performing it. A little "can I?" moment before you commit. Iconic.
  • -v, --verbose — Verbose output. Give me all the lore.
  • -?, --help — Display this help.
  • -H, --headers — Display column headers.
  • --debug — Display additional debugging information.
  • --show-empty-fields — Indicate empty fields.
  • --hide-tags — Do not display tags for tagged resources.
  • --connection-timeout TIMEOUT — Specify a connection timeout TIMEOUT (in seconds).
  • --request-timeout TIMEOUT — Specify a request timeout TIMEOUT (in seconds).

💅 SPECIFIC OPTIONS 💅

  • --egress — Specifies an egress rule. Otherwise ingress is assumed. Pick your direction, babe ✨
  • -P, --protocol PROTOCOL — May be either a protocol name or a protocol number. Note that non-VPC security groups only allow tcp, udp and icmp rules. For non-VPC groups the protocol may be left blank, in which case it will default to tcp if a source subnet is specified, to tcp and udp if a source group and port range are specified, and to tcp, udp and icmp if only a source group is specified. For VPC groups the protocol all must be explicitly specified. (yes, explicitly. no shortcuts. 👀)
  • -p, --port-range PORT-RANGE — Range of ports to open. If the tcp or udp protocol are specified (or implied by default), then the range of ports to grant access to may optionally be specified as a single integer, or as a range (min-max). Specifying -1 defaults to all ports.
  • -t, --icmp-type-code TYPE:CODE — icmp type and code. If the icmp protocol is specified, then icmp type and code may optionally be specified as type:code, where both type and code are integers and compliant with RFC792. Type or code (or both) may be specified as -1 which is a wildcard covering all types or codes.
  • -o, --source-or-dest-group SOURCE-OR-DEST-GROUP [--source-or-dest-group...] — Source or destination security group to be authorized, specified as an EC2 security group name, e.g. default. This may be specified more than once to allow network traffic from multiple security groups.
  • -u, --source-or-dest-group-user SOURCE-OR-DEST-GROUP-USER [--source-or-dest-group-user...] — The owner of the security group specified using -o. If specified only once, the same user will be used for all specified groups. However, if specified once per -o, each user is mapped to a group in order. Anything else is invalid. This option is invalid for VPC security groups. VPC source groups must be owned by the authorizing user.
  • -s, --cidr CIDR — The network source from which traffic is to be authorized in the case of an ingress request, or to which traffic is to be authorized in the case of an egress request. Specified as a CIDR subnet range, e.g. 205.192.8.45/24. This may be specified more than once to allow traffic from multiple subnets. If no subnet and no group are specified, this will default to the wildcard CIDR 0.0.0.0/0.
  • --source-subnet — Like --cidr, but for ingress requests only. For backward compatibility.
  • --dest-subnet — Like --cidr, but for egress requests only. For backward compatibility.

🔗 SEE ALSO 🔗

and that's the whole page, no cap 🫶 go forth and revoke responsibly, my little cloud gremlin. mwah 💋

💖 this masterpiece of a manual came to you from the EC2 API command line tools, version 1.6.14.1, api=2014-05-01 — she's a lil vintage, she's a lil iconic, and she ate. periodt. 🎀✨

📦 where this page comes from