VM::EC...ission(3pm)

💖 VM::EC2::SecurityGroup::IpPermission 💖

okay bestie so this is a Perl manual page, 3pm section, and it's all about VM::EC2::SecurityGroup::IpPermission — the little object that describes a firewall rule inside an EC2 security group. yes, the firewall rule object. not the group itself. we're going one level deeper. buckle up 🎀

---

✨ NAME ✨

VM::EC2::SecurityGroup::IpPermission — the object that describes a firewall rule in an EC2 security group. that's it. that's the whole job. 👑

---

🌸 SYNOPSIS 🌸

$ec2      = VM::EC2->new(...);
$sg       = $ec2->describe_security_groups(-name=>'My Group');

my @rules = $sg->ipPermissions;
for my $rule (@rules) {   # each rule is a VM::EC2::SecurityGroup::IpPermission
       $protocol = $rule->ipProtocol;
       $fromPort = $rule->fromPort;
       $toPort   = $rule->toPort;
       @ranges   = $rule->ipRanges;
       @groups   = $rule->groups;
}

see how you just loop over the rules and each one is literally this object? so clean. so demure. 💅

---

🦋 DESCRIPTION 🦋

so this object is the whole vibe of a firewall rule defined inside an Amazon EC2 security group. like, it's the thing that says "port 22, tcp, open to whoever" but as a Perl object.

where do you even get one? the VM::EC2::SecurityGroup object hands them to you through its ipPermissions() and ipPermissionsEgress() methods — and btw those two also go by the names inbound_permissions() and outbound_permissions(), same energy, different aliases. ✨

---

💅 METHODS 💅

$protocol = $rule->ipProtocol

gives you back the IP protocol for this rule. it's one of exactly three things: "tcp", "udp" or "icmp". that's the menu. no substitutions. 🍓

$port = $rule->fromPort

the start of the port range this rule covers — or, if it's an ICMP rule, the ICMP type code. it's a numeric value, like 80, or -1 when you mean "all the ports" / "all the codes". the -1 is giving very much "everything, everywhere, all at once" 🫶

$port = $rule->toPort

the end of the port range this rule covers — or the ICMP type code, same deal as above. numeric value, like 80, or -1 for all ports/codes. fromPort and toPort are besties, they travel in pairs. 👯

@ips = $rule->ipRanges

this one returns the list of IP addresses that are allowed to originate or receive traffic — but only if the rule actually defines IP-based firewall filtering. iykyk.

each address is a CIDR (classless internet domain routing) address, written like a.b.c.d/n, for example 10.23.91.0/24 (there's a whole wikipedia page on Classless Inter-Domain Routing at http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing if you wanna go down that rabbit hole). and the "any" address — the one that means literally everybody — shows up in the form 0.0.0.0/0. 😭

@groups = $rule->groups

returns the list of security groups allowed to originate or receive traffic from instances that are assigned to this security group — but again, only when the rule is doing group-based traffic filtering.

heads up bestie, this is the important part: each returned object is a VM::EC2::SecurityGroup::GroupPermission, not a VM::EC2::SecurityGroup. why? because these traffic filtering groups can include security groups owned by other accounts. other people's groups. in your rule. wild, i know. 💀

the GroupPermission objects are the ones that define the methods userId(), groupId() and groupName(). those three, specifically. 🎀

---

🌈 STRING OVERLOADING 🌈

when you use this object in a string context, it interpolates the rule for you using these templates. so cute, so convenient:

TCP port 22 open to any host:

"tcp(22..22) FROM CIDR 0.0.0.0/0"

TCP ports 23 through 39 open to the two class C networks 192.168.0.* and 192.168.1.*:

"tcp(23..29) FROM CIDR 192.168.0.0/24,192.168.1.0/24"

UDP port 80 from security group "default" owned by you, plus the group named "farmville" owned by user 9999999:

"udp(80..80) GRPNAME default,9999999/farmville"

see the patterns? tcp(from..to), udp(from..to), then either FROM CIDR for the IP ranges or GRPNAME for the group ones. iconic. no notes. ⭐

---

👑 SEE ALSO 👑

go read these too, they're all part of the same friend group:

• VM::EC2
• VM::EC2::Generic
• VM::EC2::Instance
• VM::EC2::SecurityGroup
• VM::EC2::SecurityGroup::IpPermission
• VM::EC2::SecurityGroup::GroupPermission

---

💜 AUTHOR 💜

Lincoln Stein <lincoln.stein@gmail.com> — thank you for your service 🫡

Copyright (c) 2011 Ontario Institute for Cancer Research

This package and its accompanying libraries is free software; you can redistribute it and/or modify it under the terms of the GPL (either version 1, or at your option, any later version) or the Artistic License 2.0. Refer to LICENSE for the full license text. In addition, please see DISCLAIMER.txt for disclaimers of warranty.

ok so fr fr, go check LICENSE for the actual full license text and DISCLAIMER.txt for the warranty disclaimers — that part is not optional reading. 📜

---

and that's the whole page, bestie!! this was perl v5.38.2, dated 2024-08-10, filed under VM::EC2::SecurityGroup::IpPermission(3pm). mwah 💋 go secure those ports. 🧚✨