Cloudformation template(JSON) for security group with 50 CIDR IPs (Ingress)

I am creating Cloud formation template for security group with ingress rule of over 50 CIDR IPs. In Parameters, I used Commadelimited list for Multiple CIDR IPs. Instead of creating seperate values in SecurityGroupIngress for each CIDR IP, Is it possible to include multiple CidrIps in single code.

                    {
                        "IpProtocol" : "tcp",
                        "CidrIp" : "54.183.255.128/26",
                        "FromPort" : "443",
                        "ToPort" : "443"
                    },
                    {
                        "IpProtocol" : "tcp",
                        "CidrIp" : "54.228.16.0/26", 
                        "FromPort" : "443",
                        "ToPort" : "443"
                    },
                    {
                        "IpProtocol" : "tcp",
                        "CidrIp" :  "54.232.40.64/26", 
                        "FromPort" : "443",
                        "ToPort" : "443"
                    },
                    {
                        "IpProtocol" : "tcp",
                        "CidrIp" : "54.241.32.64/26", 
                        "FromPort" : "443",
                        "ToPort" : "443"
                    },

Template I want to use like below. But here I can able to get only 1 position CIDR IPs.

{
    "AWSTemplateFormatVersion": "2010-09-09",
    "Description": "HTTPS - Security Group",
    "Parameters": {
        "VPC": {
            "Type": "AWS::EC2::VPC::Id",
            "Description": "VPC where the Security Group will belong"
        },
        "Name": {
            "Type": "String",
            "Description": "Name Tag of the Security Group"
        },
        "DbSubnetIpBlocks": {
            "Description": "Comma-delimited list of CIDR blocks",
            "Type": "CommaDelimitedList"
        }
    },
    "Resources": {
        "MySG": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupDescription": {
                    "Ref": "Description"
                },
                "VpcId": {
                    "Ref": "VPC"
                },
                "SecurityGroupIngress": [
                    {
                        "IpProtocol": "tcp",
                        "CidrIp": {
                            "Fn::Select": [
                                "1",
                                {
                                    "Ref": "DbSubnetIpBlocks"
                                }
                            ]
                        },
                        "FromPort": "443",
                        "ToPort": "443"
                    }
                ]
            }
        }
    },
    "Outputs": {
        "SecurityGroupID": {
            "Description": "Security Group ID",
            "Value": {
                "Ref": "MySG"
            }
        }

1 answer

  • answered 2021-11-27 11:31 Marcin

    Sadly its not possible. One security group (SG) rule applies to only one CIDR range.

    There is a limit of 60 rules in a SG, which you can request to be increased.

    Although a single SG rule can refer to single CIDR, you can create CloudFormation macro or custom resource to automatically create all these rules for you.

How many English words
do you know?
Test your English vocabulary size, and measure
how many words do you know
Online Test
Powered by Examplum