Updated on 2022-01-25 GMT+08:00

Creating a Security Group Rule

Function

This API is used to create a security group rule.

URI

POST /v1/{project_id}/security-group-rules

Request Message

  • Request parameter
    Table 1 Request parameter

    Name

    Mandatory

    Type

    Description

    security_group_rule

    Yes

    Object

    Specifies the security group rule objects. For details, see Table 2.

    Table 2 Description of the security_group_rule field

    Name

    Mandatory

    Type

    Description

    security_group_id

    Yes

    String

    Specifies the security group ID.

    description

    No

    String

    • Provides supplementary information about the security group rule.
    • The value is a string of no more than 255 characters that can contain letters and digits.

    direction

    Yes

    String

    • Possible values are as follows:
      • egress
      • ingress

    ethertype

    No

    String

    • Specifies the IP protocol version.
    • The value can be IPv4 or IPv6.
    • If you do not set this parameter, IPv4 is used by default.

    protocol

    No

    String

    • Specifies the protocol type.
    • The value can be tcp, udp, icmp or an IP protocol number
    • If the parameter is left blank, all protocols are supported.

    port_range_min

    No

    Integer

    • Specifies the start port number.
    • The value ranges from 1 to 65535.
    • The value cannot be greater than the port_range_max value. An empty value indicates all ports. If the protocol is icmp, the value range is shown in ICMP-Port Range Relationship Table.

    port_range_max

    No

    Integer

    • Specifies the end port number.
    • The value ranges from 1 to 65535.
    • If the protocol is not icmp, the value cannot be smaller than the port_range_min value. An empty value indicates all ports. If the protocol is icmp, the value range is shown in ICMP-Port Range Relationship Table.

    remote_ip_prefix

    No

    String

    • Specifies the remote IP address. If the access control direction is set to egress, the parameter specifies the source IP address. If the access control direction is set to ingress, the parameter specifies the destination IP address.
    • The value can be in the CIDR format or IP addresses.
    • The parameter is exclusive with parameter remote_group_id.

    remote_group_id

    No

    String

    • Specifies the ID of the peer security group.
    • The value is exclusive with parameter remote_ip_prefix.
  • Example request
    POST https://{Endpoint}/v1/{project_id}/security-group-rules
    
    {
        "security_group_rule": {
            "direction": "ingress", 
            "port_range_min": "80", 
            "ethertype": "IPv4", 
            "port_range_max": "80", 
            "protocol": "tcp", 
            "remote_group_id": "85cc3048-abc3-43cc-89b3-377341426ac5", 
            "security_group_id": "a7734e61-b545-452d-a3cd-0189cbd9747a"
        }
    }

Response Message

  • Response parameter
    Table 3 Response parameter

    Name

    Type

    Description

    security_group_rule

    Object

    Specifies the security group rule objects. For details, see Table 4.

    Table 4 security_group_rule objects

    Name

    Type

    Description

    id

    String

    Specifies the security group rule ID, which uniquely identifies the security group rule.

    description

    String

    • Provides supplementary information about the security group rule.
    • The value is a string of no more than 255 characters that can contain letters and digits.

    security_group_id

    String

    Specifies the security group rule ID, which uniquely identifies the security group rule.

    direction

    String

    • Specifies the direction of access control.
    • Possible values are as follows:
      • egress
      • ingress

    ethertype

    String

    • Specifies the IP protocol version.
    • The value can be IPv4 or IPv6.

    protocol

    String

    • Specifies the protocol type.
    • The value can be icmp, tcp, or udp.
    • If the parameter is left blank, all protocols are supported.

    port_range_min

    Integer

    • Specifies the start port number.
    • The value ranges from 1 to 65535.
    • The value cannot be greater than the port_range_max value. An empty value indicates all ports. If the protocol is icmp, the value range is shown in ICMP-Port Range Relationship Table.

    port_range_max

    Integer

    • Specifies the end port number.
    • The value ranges from 1 to 65535.
    • If the protocol is not icmp, the value cannot be smaller than the port_range_min value. An empty value indicates all ports. If the protocol is icmp, the value range is shown in ICMP-Port Range Relationship Table.

    remote_ip_prefix

    String

    • Specifies the remote IP address. If the access control direction is set to egress, the parameter specifies the source IP address. If the access control direction is set to ingress, the parameter specifies the destination IP address.
    • The value can be in the CIDR format or IP addresses.
    • The parameter is exclusive with parameter remote_group_id.

    remote_group_id

    String

    • Specifies the ID of the peer security group.
    • The value is exclusive with parameter remote_ip_prefix.

    tenant_id

    String

    • Specifies the ID of the project to which the security group rule belongs.
  • Example response
    {
        "security_group_rule": {
            "direction": "ingress",
            "ethertype": "IPv4",
            "id": "2bc0accf-312e-429a-956e-e4407625eb62",
            "description": "",
            "port_range_max": 80,
            "port_range_min": 80,
            "protocol": "tcp",
            "remote_group_id": "85cc3048-abc3-43cc-89b3-377341426ac5",
            "remote_ip_prefix": null,
            "security_group_id": "a7734e61-b545-452d-a3cd-0189cbd9747a",
            "tenant_id": "e4f50856753b4dc6afee5fa6b9b6c550"
        }
    }

Status Code

See Status Codes.

Error Code

See Error Codes.