EC2-CREATE-NETWORK-ACL-ENTRY(1)

📦 version 1.6.14.1, in ubuntu jammy, ubuntu noble

EC2-CREATE-NETWORK-ACL-ENTRY(1) 🦋💅

ok so bestie, welcome to the User Commands section of the manual, and this page is entirely about ec2-create-network-acl-entry — aka ec2addnae — the little command that adds a rule to a network ACL. yes it's giving firewall energy, yes you're gonna slay. let's go ✨

🎀 NAME 🎀

ec2-create-network-acl-entry — Create a network ACL entry 🫶

✨ SYNOPSIS ✨

 ec2addnae ([ec2-create-network-acl-entry])
 ec2addnae [GENERAL OPTIONS] NETWORK_ACL -n RULE_NUMBER -r CIDR
[--egress] -P PROTOCOL (-p PORT_RANGE | -t ICMP_TYPE_CODE) {--allow |
--deny}

like, that's the whole vibe in four lines. ec2addnae is the main character here 💅

🌸 GENERAL NOTES 🌸

ngl this is the part you don't wanna skip: any command option or parameter may be passed a value of - to say "hey, read the values for this one from stdin instead". that's it, that's the note. iconic behavior fr fr 😌

💖 DESCRIPTION 💖

Create a network ACL entry. periodt.

NETWORK_ACL is the network acl ID to which to add the entry — so you gotta know which ACL you're blessing with a new rule before you do anything. no ACL ID, no rule, bestie 😭

🧚 GENERAL OPTIONS 🧚

these are the options that every command in this family shares. they're the group chat, and the specific options below are the main character 💜

  • -O, --aws-access-key KEY — your AWS Access Key ID. defaults to whatever the AWS_ACCESS_KEY environment variable is set to (if it's set at all).
  • -W, --aws-secret-key KEY — your AWS Secret Access Key. defaults to the value of the AWS_SECRET_KEY environment variable (if set).
  • -T, --security-token TOKEN — AWS delegation token. defaults to the value of the AWS_DELEGATION_TOKEN environment variable (if set).
  • -K, --private-key KEY — 🚨 [DEPRECATED] 🚨 specify KEY as the private key to use. defaults to the value of the EC2_PRIVATE_KEY environment variable (if set). overrides the default.
  • -C, --cert CERT — 🚨 [DEPRECATED] 🚨 specify CERT as the X509 certificate to use. defaults to the value of the EC2_CERT environment variable (if set). overrides the default.
  • -U, --url URL — specify URL as the web service URL to use. defaults to the value of https://ec2.amazonaws.com (us-east-1) or to that of the EC2_URL environment variable (if set). overrides the default.
  • --region REGION — specify REGION as the web service region to use. this option will override the URL specified by the -U URL option and the EC2_URL environment variable. it defaults to the region specified by the EC2_URL environment variable, or us-east-1 if that environment variable is not set.
  • -D, --auth-dry-run — check if you can perform the requested action rather than actually performing it. a little vibe check before the real thing 👀
  • -v, --verbose — verbose output. give me all the lore.
  • -?, --help — display this help.
  • -H, --headers — display column headers.
  • --debug — display additional debugging information.
  • --show-empty-fields — indicate empty fields.
  • --hide-tags — do not display tags for tagged resources.
  • --connection-timeout TIMEOUT — specify a connection timeout TIMEOUT (in seconds).
  • --request-timeout TIMEOUT — specify a request timeout TIMEOUT (in seconds).

👑 SPECIFIC OPTIONS 👑

now THIS is the section that actually builds your rule. it's giving bespoke. it's giving custom. let's break it down 💅

  • -n, --rule-number RULE_NUMBER — the rule number to add. 🔢
  • -r, --cidr CIDR — the IP range to regulate.
  • -P, --protocol PROTOCOL — the IP protocol to regulate. set it to 'all' for wildcard. 🌈
  • -p, --port-range PORT_RANGE — the port range to regulate (TCP and UDP only, bestie, don't try it anywhere else).
  • -t, --icmp-type-code ICMP_TYPE_CODE — the ICMP type and code to regulate.
  • --allow — sets the action to be taken on packets matching the rule to 'allow'. you must specify either this or deny — pick a side, no fence-sitting 🙈
  • --deny — sets the action to be taken on packets matching the rule to 'deny'. you must specify either this or allow. same rule, flipped energy.
  • --egress — specifies an egress rule. the rule is otherwise assumed to be ingress.
⚠️ real talk: you gotta pick exactly one of --allow or --deny, and you gotta pick exactly one of -p PORT_RANGE or -t ICMP_TYPE_CODE (see that ( … | … ) in the synopsis? that's the choose-one vibe). and yes, --egress is opt-in only — no flag means ingress, periodt.

🌈 SEE ALSO 🌈

go read the source of truth, bestie, it's all there:

and that's the whole page!! this one came from the EC2 API command line tools, version 1.6.14.1, api=2014-05, and it lives in the manual as EC2-CREATE-NETWORK-ACL-ENTRY(1). mwah, go add some ACL entries, you got this 🫶✨🎀

📦 where this page comes from