TerraformでAWS VPC, subnet, SecurityGroup,NATインスタンスを作成するコード
実行環境
- Windows 10 Home (1919)
- Git Bash (git version 2.25.1.windows.1)
- AWS CLI (aws-cli/2.0.3 Python/3.7.5 Windows/10 botocore/2.0.0dev7)
- Terraform (v0.12.26)
作成する構成
まっさらな環境にVPCVPC, subnet, SecurityGroup,NATインスタンスを作成する。
NATで利用するAMI(amzn-ami-vpc-nat)は「amzn-ami-vpc-nat-2018.03.0.20191219.0-x86_64-ebs - ami-0744cc369a48918e2」。
SecurtyGroupは自宅からの接続のみを許可する。
main.tf
provider "aws" {
profile = "prj01-profile"
region = "us-west-2"
}
resource "aws_vpc" "prj01VPC" {
cidr_block = "10.10.0.0/16"
instance_tenancy = "default"
tags = {
Name = "prj01VPC"
CostGroup = "prj01"
}
}
resource "aws_subnet" "prj01PublicSubnet1a" {
vpc_id = aws_vpc.prj01VPC.id
cidr_block = "10.10.1.0/24"
availability_zone = "us-west-2a"
tags = {
Name = "prj01PublicSubnet1a"
CostGroup = "prj01"
}
}
resource "aws_internet_gateway" "prj01IGW" {
vpc_id = aws_vpc.prj01VPC.id
tags = {
Name = "prj01IGW"
CostGroup = "prj01"
}
}
resource "aws_route_table" "prj01PublicRoute" {
vpc_id = aws_vpc.prj01VPC.id
route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.prj01IGW.id
}
}
resource "aws_route_table_association" "prj01public-a" {
subnet_id = aws_subnet.prj01PublicSubnet1a.id
route_table_id = aws_route_table.prj01PublicRoute.id
}
resource "aws_security_group" "prj01SGpublic" {
name = "prj01SGpublic"
description = "Prj01 Public Subnet SG"
vpc_id = aws_vpc.prj01VPC.id
ingress {
description = "TLS from home"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["xxx.xxx.xxx.xxx/32"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
resource "aws_instance" "prj01NAT" {
ami = "ami-0744cc369a48918e2"
instance_type = "t2.micro"
key_name = "prj01keypair"
subnet_id = aws_subnet.prj01PublicSubnet1a.id
vpc_security_group_ids = [aws_security_group.prj01SGpublic.id]
associate_public_ip_address = "true"
tags = {
Name = "prj01NAT"
CostGroup = "prj01"
}
}
output "prj01NAT-EIP" {
value = "${aws_instance.prj01NAT.public_ip}"
}
(自宅のグローバルIPだけ、xxxでマスク)
実行
前提
前提としてaws cliのprofileおよびkeypairは作成済み。
$ aws configure list --profile prj01-profile
Name Value Type Location
---- ----- ---- --------
profile prj01-profile manual --profile
access_key ****************FCES shared-credentials-file
secret_key ****************4Idw shared-credentials-file
region us-west-2 config-file ~/.aws/config
$ aws ec2 describe-key-pairs
{
"KeyPairs": [
{
"KeyPairId": "key-0ba9cb72d459cbeb4",
"KeyFingerprint": "e9:ec:b7:f9:3d:d0:6b:81:6d:aa:92:92:70:e5:0c:51:e7:5d:89:e7",
"KeyName": "prj01keypair",
"Tags": []
}
]
}
実行前の状態確認
$ aws ec2 describe-vpcs --region=us-west-2
{
"Vpcs": []
}
$ aws ec2 describe-subnets --region=us-west-2
{
"Subnets": []
}
$ aws ec2 describe-internet-gateways --region=us-west-2
{
"InternetGateways": []
}
$ aws ec2 describe-route-tables --region=us-west-2
{
"RouteTables": []
}
$ aws ec2 describe-security-groups --region=us-west-2
{
"SecurityGroups": [
{
"Description": "default group",
"GroupName": "default",
：(中略)
}
]
}
$ aws ec2 describe-instances --region=us-west-2
{
"Reservations": []
}
plan
$ ../terraform.exe plan
Refreshing Terraform state in-memory prior to plan...
The refreshed state will be used to calculate this plan, but will not be
persisted to local or remote state storage.
------------------------------------------------------------------------
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# aws_instance.prj01NAT will be created
+ resource "aws_instance" "prj01NAT" {
+ ami = "ami-0744cc369a48918e2"
+ arn = (known after apply)
+ associate_public_ip_address = true
+ availability_zone = (known after apply)
+ cpu_core_count = (known after apply)
+ cpu_threads_per_core = (known after apply)
+ get_password_data = false
+ host_id = (known after apply)
+ id = (known after apply)
+ instance_state = (known after apply)
+ instance_type = "t2.micro"
+ ipv6_address_count = (known after apply)
+ ipv6_addresses = (known after apply)
+ key_name = "prj01keypair"
+ network_interface_id = (known after apply)
+ outpost_arn = (known after apply)
+ password_data = (known after apply)
+ placement_group = (known after apply)
+ primary_network_interface_id = (known after apply)
+ private_dns = (known after apply)
+ private_ip = (known after apply)
+ public_dns = (known after apply)
+ public_ip = (known after apply)
+ security_groups = (known after apply)
+ source_dest_check = true
+ subnet_id = (known after apply)
+ tags = {
+ "CostGroup" = "prj01"
+ "Name" = "prj01NAT"
}
+ tenancy = (known after apply)
+ volume_tags = (known after apply)
+ vpc_security_group_ids = (known after apply)
+ ebs_block_device {
+ delete_on_termination = (known after apply)
+ device_name = (known after apply)
+ encrypted = (known after apply)
+ iops = (known after apply)
+ kms_key_id = (known after apply)
+ snapshot_id = (known after apply)
+ volume_id = (known after apply)
+ volume_size = (known after apply)
+ volume_type = (known after apply)
}
+ ephemeral_block_device {
+ device_name = (known after apply)
+ no_device = (known after apply)
+ virtual_name = (known after apply)
}
+ metadata_options {
+ http_endpoint = (known after apply)
+ http_put_response_hop_limit = (known after apply)
+ http_tokens = (known after apply)
}
+ network_interface {
+ delete_on_termination = (known after apply)
+ device_index = (known after apply)
+ network_interface_id = (known after apply)
}
+ root_block_device {
+ delete_on_termination = (known after apply)
+ device_name = (known after apply)
+ encrypted = (known after apply)
+ iops = (known after apply)
+ kms_key_id = (known after apply)
+ volume_id = (known after apply)
+ volume_size = (known after apply)
+ volume_type = (known after apply)
}
}
# aws_internet_gateway.prj01IGW will be created
+ resource "aws_internet_gateway" "prj01IGW" {
+ arn = (known after apply)
+ id = (known after apply)
+ owner_id = (known after apply)
+ tags = {
+ "CostGroup" = "prj01"
+ "Name" = "prj01IGW"
}
+ vpc_id = (known after apply)
}
# aws_route_table.prj01PublicRoute will be created
+ resource "aws_route_table" "prj01PublicRoute" {
+ id = (known after apply)
+ owner_id = (known after apply)
+ propagating_vgws = (known after apply)
+ route = [
+ {
+ cidr_block = "0.0.0.0/0"
+ egress_only_gateway_id = ""
+ gateway_id = (known after apply)
+ instance_id = ""
+ ipv6_cidr_block = ""
+ nat_gateway_id = ""
+ network_interface_id = ""
+ transit_gateway_id = ""
+ vpc_peering_connection_id = ""
},
]
+ vpc_id = (known after apply)
}
# aws_route_table_association.prj01public-a will be created
+ resource "aws_route_table_association" "prj01public-a" {
+ id = (known after apply)
+ route_table_id = (known after apply)
+ subnet_id = (known after apply)
}
# aws_security_group.prj01SGpublic will be created
+ resource "aws_security_group" "prj01SGpublic" {
+ arn = (known after apply)
+ description = "Prj01 Public Subnet SG"
+ egress = [
+ {
+ cidr_blocks = [
+ "0.0.0.0/0",
]
+ description = ""
+ from_port = 0
+ ipv6_cidr_blocks = []
+ prefix_list_ids = []
+ protocol = "-1"
+ security_groups = []
+ self = false
+ to_port = 0
},
]
+ id = (known after apply)
+ ingress = [
+ {
+ cidr_blocks = [
+ "xxx.xxx.xxx.xxx/32",
]
+ description = "TLS from home"
+ from_port = 22
+ ipv6_cidr_blocks = []
+ prefix_list_ids = []
+ protocol = "tcp"
+ security_groups = []
+ self = false
+ to_port = 22
},
]
+ name = "prj01SGpublic"
+ owner_id = (known after apply)
+ revoke_rules_on_delete = false
+ vpc_id = (known after apply)
}
# aws_subnet.prj01PublicSubnet1a will be created
+ resource "aws_subnet" "prj01PublicSubnet1a" {
+ arn = (known after apply)
+ assign_ipv6_address_on_creation = false
+ availability_zone = "us-west-2a"
+ availability_zone_id = (known after apply)
+ cidr_block = "10.10.1.0/24"
+ id = (known after apply)
+ ipv6_cidr_block = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
+ map_public_ip_on_launch = false
+ owner_id = (known after apply)
+ tags = {
+ "CostGroup" = "prj01"
+ "Name" = "prj01PublicSubnet1a"
}
+ vpc_id = (known after apply)
}
# aws_vpc.prj01VPC will be created
+ resource "aws_vpc" "prj01VPC" {
+ arn = (known after apply)
+ assign_generated_ipv6_cidr_block = false
+ cidr_block = "10.10.0.0/16"
+ default_network_acl_id = (known after apply)
+ default_route_table_id = (known after apply)
+ default_security_group_id = (known after apply)
+ dhcp_options_id = (known after apply)
+ enable_classiclink = (known after apply)
+ enable_classiclink_dns_support = (known after apply)
+ enable_dns_hostnames = (known after apply)
+ enable_dns_support = true
+ id = (known after apply)
+ instance_tenancy = "default"
+ ipv6_association_id = (known after apply)
+ ipv6_cidr_block = (known after apply)
+ main_route_table_id = (known after apply)
+ owner_id = (known after apply)
+ tags = {
+ "CostGroup" = "prj01"
+ "Name" = "prj01VPC"
}
}
Plan: 7 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
Note: You didn't specify an "-out" parameter to save this plan, so Terraform
can't guarantee that exactly these actions will be performed if
"terraform apply" is subsequently run.
実行(apply)
$ ../terraform.exe apply
An execution plan has been generated and is shown below.
Resource actions are indicated with the following symbols:
+ create
Terraform will perform the following actions:
# aws_instance.prj01NAT will be created
+ resource "aws_instance" "prj01NAT" {
+ ami = "ami-0744cc369a48918e2"
+ arn = (known after apply)
+ associate_public_ip_address = true
+ availability_zone = (known after apply)
+ cpu_core_count = (known after apply)
+ cpu_threads_per_core = (known after apply)
+ get_password_data = false
+ host_id = (known after apply)
+ id = (known after apply)
+ instance_state = (known after apply)
+ instance_type = "t2.micro"
+ ipv6_address_count = (known after apply)
+ ipv6_addresses = (known after apply)
+ key_name = "prj01keypair"
+ network_interface_id = (known after apply)
+ outpost_arn = (known after apply)
+ password_data = (known after apply)
+ placement_group = (known after apply)
+ primary_network_interface_id = (known after apply)
+ private_dns = (known after apply)
+ private_ip = (known after apply)
+ public_dns = (known after apply)
+ public_ip = (known after apply)
+ security_groups = (known after apply)
+ source_dest_check = true
+ subnet_id = (known after apply)
+ tags = {
+ "CostGroup" = "prj01"
+ "Name" = "prj01NAT"
}
+ tenancy = (known after apply)
+ volume_tags = (known after apply)
+ vpc_security_group_ids = (known after apply)
+ ebs_block_device {
+ delete_on_termination = (known after apply)
+ device_name = (known after apply)
+ encrypted = (known after apply)
+ iops = (known after apply)
+ kms_key_id = (known after apply)
+ snapshot_id = (known after apply)
+ volume_id = (known after apply)
+ volume_size = (known after apply)
+ volume_type = (known after apply)
}
+ ephemeral_block_device {
+ device_name = (known after apply)
+ no_device = (known after apply)
+ virtual_name = (known after apply)
}
+ metadata_options {
+ http_endpoint = (known after apply)
+ http_put_response_hop_limit = (known after apply)
+ http_tokens = (known after apply)
}
+ network_interface {
+ delete_on_termination = (known after apply)
+ device_index = (known after apply)
+ network_interface_id = (known after apply)
}
+ root_block_device {
+ delete_on_termination = (known after apply)
+ device_name = (known after apply)
+ encrypted = (known after apply)
+ iops = (known after apply)
+ kms_key_id = (known after apply)
+ volume_id = (known after apply)
+ volume_size = (known after apply)
+ volume_type = (known after apply)
}
}
# aws_internet_gateway.prj01IGW will be created
+ resource "aws_internet_gateway" "prj01IGW" {
+ arn = (known after apply)
+ id = (known after apply)
+ owner_id = (known after apply)
+ tags = {
+ "CostGroup" = "prj01"
+ "Name" = "prj01IGW"
}
+ vpc_id = (known after apply)
}
# aws_route_table.prj01PublicRoute will be created
+ resource "aws_route_table" "prj01PublicRoute" {
+ id = (known after apply)
+ owner_id = (known after apply)
+ propagating_vgws = (known after apply)
+ route = [
+ {
+ cidr_block = "0.0.0.0/0"
+ egress_only_gateway_id = ""
+ gateway_id = (known after apply)
+ instance_id = ""
+ ipv6_cidr_block = ""
+ nat_gateway_id = ""
+ network_interface_id = ""
+ transit_gateway_id = ""
+ vpc_peering_connection_id = ""
},
]
+ vpc_id = (known after apply)
}
# aws_route_table_association.prj01public-a will be created
+ resource "aws_route_table_association" "prj01public-a" {
+ id = (known after apply)
+ route_table_id = (known after apply)
+ subnet_id = (known after apply)
}
# aws_security_group.prj01SGpublic will be created
+ resource "aws_security_group" "prj01SGpublic" {
+ arn = (known after apply)
+ description = "Prj01 Public Subnet SG"
+ egress = [
+ {
+ cidr_blocks = [
+ "0.0.0.0/0",
]
+ description = ""
+ from_port = 0
+ ipv6_cidr_blocks = []
+ prefix_list_ids = []
+ protocol = "-1"
+ security_groups = []
+ self = false
+ to_port = 0
},
]
+ id = (known after apply)
+ ingress = [
+ {
+ cidr_blocks = [
+ "xxx.xxx.xxx.xxx/32",
]
+ description = "TLS from home"
+ from_port = 22
+ ipv6_cidr_blocks = []
+ prefix_list_ids = []
+ protocol = "tcp"
+ security_groups = []
+ self = false
+ to_port = 22
},
]
+ name = "prj01SGpublic"
+ owner_id = (known after apply)
+ revoke_rules_on_delete = false
+ vpc_id = (known after apply)
}
# aws_subnet.prj01PublicSubnet1a will be created
+ resource "aws_subnet" "prj01PublicSubnet1a" {
+ arn = (known after apply)
+ assign_ipv6_address_on_creation = false
+ availability_zone = "us-west-2a"
+ availability_zone_id = (known after apply)
+ cidr_block = "10.10.1.0/24"
+ id = (known after apply)
+ ipv6_cidr_block = (known after apply)
+ ipv6_cidr_block_association_id = (known after apply)
+ map_public_ip_on_launch = false
+ owner_id = (known after apply)
+ tags = {
+ "CostGroup" = "prj01"
+ "Name" = "prj01PublicSubnet1a"
}
+ vpc_id = (known after apply)
}
# aws_vpc.prj01VPC will be created
+ resource "aws_vpc" "prj01VPC" {
+ arn = (known after apply)
+ assign_generated_ipv6_cidr_block = false
+ cidr_block = "10.10.0.0/16"
+ default_network_acl_id = (known after apply)
+ default_route_table_id = (known after apply)
+ default_security_group_id = (known after apply)
+ dhcp_options_id = (known after apply)
+ enable_classiclink = (known after apply)
+ enable_classiclink_dns_support = (known after apply)
+ enable_dns_hostnames = (known after apply)
+ enable_dns_support = true
+ id = (known after apply)
+ instance_tenancy = "default"
+ ipv6_association_id = (known after apply)
+ ipv6_cidr_block = (known after apply)
+ main_route_table_id = (known after apply)
+ owner_id = (known after apply)
+ tags = {
+ "CostGroup" = "prj01"
+ "Name" = "prj01VPC"
}
}
Plan: 7 to add, 0 to change, 0 to destroy.
Do you want to perform these actions?
Terraform will perform the actions described above.
Only 'yes' will be accepted to approve.
Enter a value: yes
aws_vpc.prj01VPC: Creating...
aws_vpc.prj01VPC: Creation complete after 9s [id=vpc-07f01f8953bec8054]
aws_internet_gateway.prj01IGW: Creating...
aws_subnet.prj01PublicSubnet1a: Creating...
aws_security_group.prj01SGpublic: Creating...
aws_subnet.prj01PublicSubnet1a: Creation complete after 4s [id=subnet-002a899cff16b1c1e]
aws_internet_gateway.prj01IGW: Creation complete after 4s [id=igw-0a3ed75c307556d56]
aws_route_table.prj01PublicRoute: Creating...
aws_security_group.prj01SGpublic: Creation complete after 6s [id=sg-011197b779f8fc187]
aws_instance.prj01NAT: Creating...
aws_route_table.prj01PublicRoute: Creation complete after 3s [id=rtb-0572913cf77f4d732]
aws_route_table_association.prj01public-a: Creating...
aws_route_table_association.prj01public-a: Creation complete after 0s [id=rtbassoc-00749569edc659d21]
aws_instance.prj01NAT: Still creating... [10s elapsed]
aws_instance.prj01NAT: Still creating... [20s elapsed]
aws_instance.prj01NAT: Creation complete after 28s [id=i-0ead2524f144ce254]
Apply complete! Resources: 7 added, 0 changed, 0 destroyed.
Outputs:
prj01NAT-EIP = 34.220.64.163
接続確認
$ ssh -i ../../key/prj01keypair.pem ec2-user@34.220.64.163
The authenticity of host '34.220.64.163 (34.220.64.163)' can't be established.
ECDSA key fingerprint is SHA256:fT4x/XtdVtiIkGYGJp4oy2F1w/lHhCYHfh0Czg1QP5c.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '34.220.64.163' (ECDSA) to the list of known hosts.
__| __|_ )
_| ( / Amazon Linux AMI
___|\___|___|
https://aws.amazon.com/amazon-linux-ami/2018.03-release-notes/
12 package(s) needed for security, out of 27 available
Run "sudo yum update" to apply all updates.
[ec2-user@ip-10-10-1-59 ~]$
無事接続できた。
作成されたものの状態確認
$ aws ec2 describe-vpcs --region=us-west-2
{
"Vpcs": [
{
"CidrBlock": "10.10.0.0/16",
"DhcpOptionsId": "dopt-0ebee8b328487036e",
"State": "available",
"VpcId": "vpc-07f01f8953bec8054",
"OwnerId": "679788997248",
"InstanceTenancy": "default",
"CidrBlockAssociationSet": [
{
"AssociationId": "vpc-cidr-assoc-0c9db0dd4f6e7f945",
"CidrBlock": "10.10.0.0/16",
"CidrBlockState": {
"State": "associated"
}
}
],
"IsDefault": false,
"Tags": [
{
"Key": "CostGroup",
"Value": "prj01"
},
{
"Key": "Name",
"Value": "prj01VPC"
}
]
}
]
}
$ aws ec2 describe-subnets --region=us-west-2
{
"Subnets": [
{
"AvailabilityZone": "us-west-2a",
"AvailabilityZoneId": "usw2-az2",
"AvailableIpAddressCount": 250,
"CidrBlock": "10.10.1.0/24",
"DefaultForAz": false,
"MapPublicIpOnLaunch": false,
"State": "available",
"SubnetId": "subnet-002a899cff16b1c1e",
"VpcId": "vpc-07f01f8953bec8054",
"OwnerId": "679788997248",
"AssignIpv6AddressOnCreation": false,
"Ipv6CidrBlockAssociationSet": [],
"Tags": [
{
"Key": "CostGroup",
"Value": "prj01"
},
{
"Key": "Name",
"Value": "prj01PublicSubnet1a"
}
],
"SubnetArn": "arn:aws:ec2:us-west-2:679788997248:subnet/subnet-002a899cff16b1c1e"
}
]
}
$ aws ec2 describe-internet-gateways --region=us-west-2
{
"InternetGateways": [
{
"Attachments": [
{
"State": "available",
"VpcId": "vpc-07f01f8953bec8054"
}
],
"InternetGatewayId": "igw-0a3ed75c307556d56",
"OwnerId": "679788997248",
"Tags": [
{
"Key": "CostGroup",
"Value": "prj01"
},
{
"Key": "Name",
"Value": "prj01IGW"
}
]
}
]
}
$ aws ec2 describe-route-tables --region=us-west-2
{
"RouteTables": [
{
"Associations": [
{
"Main": true,
"RouteTableAssociationId": "rtbassoc-0acb7861b8f970d0c",
"RouteTableId": "rtb-00e81b7edaf3874c0",
"AssociationState": {
"State": "associated"
}
}
],
"PropagatingVgws": [],
"RouteTableId": "rtb-00e81b7edaf3874c0",
"Routes": [
{
"DestinationCidrBlock": "10.10.0.0/16",
"GatewayId": "local",
"Origin": "CreateRouteTable",
"State": "active"
}
],
"Tags": [],
"VpcId": "vpc-07f01f8953bec8054",
"OwnerId": "679788997248"
},
{
"Associations": [
{
"Main": false,
"RouteTableAssociationId": "rtbassoc-00749569edc659d21",
"RouteTableId": "rtb-0572913cf77f4d732",
"SubnetId": "subnet-002a899cff16b1c1e",
"AssociationState": {
"State": "associated"
}
}
],
"PropagatingVgws": [],
"RouteTableId": "rtb-0572913cf77f4d732",
"Routes": [
{
"DestinationCidrBlock": "10.10.0.0/16",
"GatewayId": "local",
"Origin": "CreateRouteTable",
"State": "active"
},
{
"DestinationCidrBlock": "0.0.0.0/0",
"GatewayId": "igw-0a3ed75c307556d56",
"Origin": "CreateRoute",
"State": "active"
}
],
"Tags": [],
"VpcId": "vpc-07f01f8953bec8054",
"OwnerId": "679788997248"
}
]
}
$ aws ec2 describe-security-groups --region=us-west-2
{
"SecurityGroups": [
{
"Description": "default group",
"GroupName": "default",
"IpPermissions": [
{
"FromPort": 0,
"IpProtocol": "udp",
"IpRanges": [],
"Ipv6Ranges": [],
"PrefixListIds": [],
"ToPort": 65535,
"UserIdGroupPairs": [
{
"GroupId": "sg-f26ffcc2",
"GroupName": "default",
"UserId": "679788997248"
}
]
},
{
"FromPort": -1,
"IpProtocol": "icmp",
"IpRanges": [],
"Ipv6Ranges": [],
"PrefixListIds": [],
"ToPort": -1,
"UserIdGroupPairs": [
{
"GroupId": "sg-f26ffcc2",
"GroupName": "default",
"UserId": "679788997248"
}
]
},
{
"FromPort": 0,
"IpProtocol": "tcp",
"IpRanges": [],
"Ipv6Ranges": [],
"PrefixListIds": [],
"ToPort": 65535,
"UserIdGroupPairs": [
{
"GroupId": "sg-f26ffcc2",
"GroupName": "default",
"UserId": "679788997248"
}
]
}
],
"OwnerId": "679788997248",
"GroupId": "sg-f26ffcc2",
"IpPermissionsEgress": []
},
{
"Description": "quick-start-1",
"GroupName": "quick-start-1",
"IpPermissions": [
{
"FromPort": 22,
"IpProtocol": "tcp",
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"Ipv6Ranges": [],
"PrefixListIds": [],
"ToPort": 22,
"UserIdGroupPairs": []
},
{
"FromPort": -1,
"IpProtocol": "icmp",
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"Ipv6Ranges": [],
"PrefixListIds": [],
"ToPort": -1,
"UserIdGroupPairs": []
}
],
"OwnerId": "679788997248",
"GroupId": "sg-486dfe78",
"IpPermissionsEgress": []
},
{
"Description": "Prj01 Public Subnet SG",
"GroupName": "prj01SGpublic",
"IpPermissions": [
{
"FromPort": 22,
"IpProtocol": "tcp",
"IpRanges": [
{
"CidrIp": "xxx.xxx.xxx.xxx/32",
"Description": "TLS from home"
}
],
"Ipv6Ranges": [],
"PrefixListIds": [],
"ToPort": 22,
"UserIdGroupPairs": []
}
],
"OwnerId": "679788997248",
"GroupId": "sg-011197b779f8fc187",
"IpPermissionsEgress": [
{
"IpProtocol": "-1",
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"Ipv6Ranges": [],
"PrefixListIds": [],
"UserIdGroupPairs": []
}
],
"VpcId": "vpc-07f01f8953bec8054"
},
{
"Description": "default VPC security group",
"GroupName": "default",
"IpPermissions": [
{
"IpProtocol": "-1",
"IpRanges": [],
"Ipv6Ranges": [],
"PrefixListIds": [],
"UserIdGroupPairs": [
{
"GroupId": "sg-02a3b4125c3e94cd6",
"UserId": "679788997248"
}
]
}
],
"OwnerId": "679788997248",
"GroupId": "sg-02a3b4125c3e94cd6",
"IpPermissionsEgress": [
{
"IpProtocol": "-1",
"IpRanges": [
{
"CidrIp": "0.0.0.0/0"
}
],
"Ipv6Ranges": [],
"PrefixListIds": [],
"UserIdGroupPairs": []
}
],
"VpcId": "vpc-07f01f8953bec8054"
}
]
}
$ aws ec2 describe-instances --region=us-west-2
{
"Reservations": [
{
"Groups": [],
"Instances": [
{
"AmiLaunchIndex": 0,
"ImageId": "ami-0744cc369a48918e2",
"InstanceId": "i-0ead2524f144ce254",
"InstanceType": "t2.micro",
"KeyName": "prj01keypair",
"LaunchTime": "2020-07-14T20:21:15+00:00",
"Monitoring": {
"State": "disabled"
},
"Placement": {
"AvailabilityZone": "us-west-2a",
"GroupName": "",
"Tenancy": "default"
},
"PrivateDnsName": "ip-10-10-1-59.us-west-2.compute.internal",
"PrivateIpAddress": "10.10.1.59",
"ProductCodes": [],
"PublicDnsName": "",
"PublicIpAddress": "34.220.64.163",
"State": {
"Code": 16,
"Name": "running"
},
"StateTransitionReason": "",
"SubnetId": "subnet-002a899cff16b1c1e",
"VpcId": "vpc-07f01f8953bec8054",
"Architecture": "x86_64",
"BlockDeviceMappings": [
{
"DeviceName": "/dev/xvda",
"Ebs": {
"AttachTime": "2020-07-14T20:21:15+00:00",
"DeleteOnTermination": true,
"Status": "attached",
"VolumeId": "vol-01040fdbd785ac7b0"
}
}
],
"ClientToken": "D9FFD1E8-29B1-4BC9-BF89-0DB594B3460D",
"EbsOptimized": false,
"EnaSupport": true,
"Hypervisor": "xen",
"NetworkInterfaces": [
{
"Association": {
"IpOwnerId": "amazon",
"PublicDnsName": "",
"PublicIp": "34.220.64.163"
},
"Attachment": {
"AttachTime": "2020-07-14T20:21:15+00:00",
"AttachmentId": "eni-attach-00044a8099cfdad43",
"DeleteOnTermination": true,
"DeviceIndex": 0,
"Status": "attached"
},
"Description": "",
"Groups": [
{
"GroupName": "prj01SGpublic",
"GroupId": "sg-011197b779f8fc187"
}
],
"Ipv6Addresses": [],
"MacAddress": "06:0d:c9:db:e6:f2",
"NetworkInterfaceId": "eni-0d1d1ba4cb5fef465",
"OwnerId": "679788997248",
"PrivateIpAddress": "10.10.1.59",
"PrivateIpAddresses": [
{
"Association": {
"IpOwnerId": "amazon",
"PublicDnsName": "",
"PublicIp": "34.220.64.163"
},
"Primary": true,
"PrivateIpAddress": "10.10.1.59"
}
],
"SourceDestCheck": true,
"Status": "in-use",
"SubnetId": "subnet-002a899cff16b1c1e",
"VpcId": "vpc-07f01f8953bec8054",
"InterfaceType": "interface"
}
],
"RootDeviceName": "/dev/xvda",
"RootDeviceType": "ebs",
"SecurityGroups": [
{
"GroupName": "prj01SGpublic",
"GroupId": "sg-011197b779f8fc187"
}
],
"SourceDestCheck": true,
"Tags": [
{
"Key": "Name",
"Value": "prj01NAT"
},
{
"Key": "CostGroup",
"Value": "prj01"
}
],
"VirtualizationType": "hvm",
"CpuOptions": {
"CoreCount": 1,
"ThreadsPerCore": 1
},
"CapacityReservationSpecification": {
"CapacityReservationPreference": "open"
},
"HibernationOptions": {
"Configured": false
},
"MetadataOptions": {
"State": "applied",
"HttpTokens": "optional",
"HttpPutResponseHopLimit": 1,
"HttpEndpoint": "enabled"
}
}
],
"OwnerId": "679788997248",
"ReservationId": "r-0621a71842792f593"
}
]
}