module

Krikri::PluginHelpers::Ec2SecurityGroup

Decision logic for amazon.aws.ec2_security_group - manage a security group and its ingress/egress rules via the EC2 Query API (DescribeSecurityGroups/CreateSecurityGroup/ AuthorizeSecurityGroup{Ingress,Egress}/RevokeSecurityGroup{Ingress, Egress}/DeleteSecurityGroup/CreateTags), through the shared PluginHelpers::Ec2Api signed-request helper.

Like Ec2Key, the plan functions take the module params plus the ALREADY-FETCHED DescribeSecurityGroups result and return the exact mutating calls to make; the full #run wires it together and specs drive it through the Ec2Api transport seam.

Behavior mirrors the real module:

  • rules/rules_egress are lists of {proto, from_port, to_port, cidr_ip, cidr_ipv6, group_id, group_name, prefix_list_id} dicts; a rule with no source at all defaults to 0.0.0.0/0.
  • a rule may instead carry ports, a list of single ports and/or "N-M" range strings (real module docs, amazon.aws >= 2.4); each element becomes its own rule (from=to=port, or from=N to=M), expanded against the rule's source list like the real module's expand_rule.
  • rules present on the group but not in the desired list are revoked when purge_rules (resp. purge_rules_egress) is true (the default) - including the default allow-all egress rule AWS creates with every new group, which real Ansible also revokes the first time rules_egress is managed.
  • proto "all" normalizes to "-1" with no port range.

Class methods

describe_filter(name : String, vpc_id : String | Nil) : Array(Tuple(String, Array(String)))

Nested {filter-name => values} pairs describing the name (and, when given, vpc) lookup the plugin performs before planning - feed through Ec2Api.filter_params to flatten for the wire.

Source
diff_rules(desired : Array(Rule), existing : Array(Rule), purge : Bool) : RuleDiff
Source
group_result_fields(sg : SecurityGroup) : Hash(String, JSON::Any)
Source
parse_rules(raw : String | Nil) : Array(Rule)

The rules/rules_egress params arrive as JSON-encoded lists of dicts (the same string-hash the plugin binary receives).

Source
parse_security_groups(root : XML::Node) : Array(SecurityGroup)

DescribeSecurityGroupsResponse -> list of groups.

Source
permission_params(rules : Array(Rule)) : Array(Tuple(String, String))

IpPermissions.N.* pairs for one Authorize/Revoke call covering several rules - N indexes the rules, M the (list) sources within each. prefix is "IpPermissions" for both ingress and egress (the Egress variant of the API call differs by Action name only).

Source
plan_absent(existing : Array(SecurityGroup), group_name : String) : Plan
Source
plan_present(group_name : String, description : String | Nil, vpc_id : String | Nil, ingress : Array(Rule) | Nil, egress : Array(Rule) | Nil, purge_rules : Bool, purge_rules_egress : Bool, tags : Hash(String, String), existing : Array(SecurityGroup)) : Plan
Source
run(params : Hash(String, String)) : Krikri::PluginResult
Source

Nested types