AWS EC2: Updating Security Groups using the AWS Command Line Tool

Working with multiple clients with their own AWS setups and security groups makes it difficult to work remotely sometimes. For instance, updating the many security groups with my current (dynamic) IP address so I can SSH into the server. To solve this problem, I created a shell script to manage the situation.

Using the aws ec2 command line tool, you can issue a set of commands to query, delete and add IP rules to the firewall. The script below allows you to:

• Select a AWS profile to use (setup using the aws tool)
• Specify one or more security groups to edit (under the same profile)
• Any fixed IP addresses that should remain constant
• The tcp port for the IP rules

The Script

Running the Script

Give the appropriate execute permissions to the script, e.g. chmod 755 aws-security.sh, then call the script using ./aws-security.sh

Caveats

Please note the following before running the script:

• All existing rules matching the protocol (tcp) and port will be deleted by running this script. Please make sure any required IP addresses are added to fixed_ips.
• The script will add your current IP address by default. If this already exists in fixed_ips, a error will be thrown by the aws tool.

AWS Security Policy

It’s a good idea to set up a AIM policy to manage access to your AWS account. With that in mind, you can create a new AIM user with the below access policy to restrict access to modifying the security group rules. This policy can be modified to restrict modifications to a specific security group by updating the “Resource”.