0

[使用 salt --version: 2015.5.0] 我想添加一个允许来自另一个安全组的所有流量的规则

我的支柱中有这个：

securitygroups:
    groups:
       - name: NFS
         region: us-east-1
         vpc_id: vpc-1234
         description: desc
         rules:
           - ip_protocol: -1
             from_port: -1
             to_port: -1
             ec2_group: sg123456

API 建议使用 -1 来指定所有IpProtcol。但我收到了这个错误：

----------
          ID: secgroups_NFSecurityGroup
    Function: boto_secgroup.present
        Name: NFSecurityGroup
      Result: False
     Comment: An exception occurred in this state: Traceback (most recent call last):
                File "/usr/lib/python2.6/site-packages/salt/state.py", line 1563, in call
                  **cdata['kwargs'])
                File "/usr/lib/python2.6/site-packages/salt/states/boto_secgroup.py", line 140, in present
                  _ret = _rules_present(name, rules, vpc_id, region, key, keyid, profile)
                File "/usr/lib/python2.6/site-packages/salt/states/boto_secgroup.py", line 345, in _rules_present
                  to_delete, to_create = _get_rule_changes(rules, sg['rules'])
                File "/usr/lib/python2.6/site-packages/salt/states/boto_secgroup.py", line 265, in _get_rule_changes
                  raise SaltInvocationError(msg.format(ip_protocol))
              SaltInvocationError: Invalid ip_protocol traffic specified in security group rule.
     Started: 03:09:58.163808
    Duration: 235.323 ms

from_port: -1 和to_port: -1 如果我指定 ip_protocol: icmp|tcp|udp 工作正常

4

1 回答 1

0

我认为-1协议的价值仅适用于作为 VPC 一部分的安全组。对于 EC2-Classic，我认为您必须添加三个单独的规则，每个协议一个。

于 2015-07-02T15:00:28.850 回答