AWS CLIをWindows(でpipを使わずに)、cygwin環境下で使えるようにして、自宅IP(非固定)が変わったらスクリプト一発でEC2のセキュリティグループをアップデートする

# for aws-cli
AWSCLI_HOME=[aws-cliを展開したディレクトリ、cygwinが辿れるように書く]
export PATH=$PATH:$AWSCLI_HOME
alias aws-cli='aws.exe'

$ aws-cli --version
aws-cli/1.11.175 Python/2.7.9 Windows/8 botocore/1.7.33

$ aws ec2 authorize-security-group-ingress --group-id sg-123abc12 --ip-permissions '[{"IpProtocol": "tcp", "FromPort": 3389, "ToPort": 3389, "IpRanges": [{"CidrIp": "203.0.113.0/24", "Description": "RDP access from NY office"}]}]'

{
    "GroupId": "xx-xxxxxxx",
    "IpPermissions": [
        {
            "IpProtocol": "-1", #「全てのプロトコル」は -1 で指定
            "IpRanges": [
                {
                    "CidrIp": "203.0.113.0/24", #取得した自分のIP　※このIPはリファレンスに書いてあったもの
                    "Description": "aws-cli(test)" #説明文
                }
            ]
        }
    ]
}

TARGET_INFO=$(jo -p GroupId="${GROUP_ID}" IpPermissions[]=$(jo IpProtocol="${IP_PROTOCOL}" IpRanges[]=$(jo CidrIp="${MYIP}" Description="MyHomeIP($TODAY)")))

TARGET_INFO=$(jo -p GroupId="${GROUP_ID}" IpPermissions[]=$(jo IpProtocol="${IP_PROTOCOL}" IpRanges[]=$(jo CidrIp="${MYIP}" Description="MyHomeIP($TODAY)")))
echo ${TARGET_INFO} | jq '.' > ${TARGET_INFO_JSON}
TMP=$(cat ${TARGET_INFO_JSON} | sed -e "s/-1/\"-1\"/g")
echo -e "${TMP}" >${TARGET_INFO_JSON}

$ aws ec2 authorize-security-group-ingress --generate-cli-skeleton

{
    "CidrIp": "",
    "FromPort": 0,
    "GroupId": "",
    "GroupName": "",
    "IpPermissions": [
        {
            "FromPort": 0,
            "IpProtocol": "",
            "IpRanges": [
                {
                    "CidrIp": "",
                    "Description": ""
                }
            ],
            "Ipv6Ranges": [
                {
                    "CidrIpv6": "",
                    "Description": ""
                }
            ],
            "PrefixListIds": [
                {
                    "Description": "",
                    "PrefixListId": ""
                }
            ],
            "ToPort": 0,
            "UserIdGroupPairs": [
                {
                    "Description": "",
                    "GroupId": "",
                    "GroupName": "",
                    "PeeringStatus": "",
                    "UserId": "",
                    "VpcId": "",
                    "VpcPeeringConnectionId": ""
                }
            ]
        }
    ],
    "IpProtocol": "",
    "SourceSecurityGroupName": "",
    "SourceSecurityGroupOwnerId": "",
    "ToPort": 0,
    "DryRun": true
}

#!/bin/bash
PATH=[いい感じにパス通す]
export PATH

### SCRIPT ENV ###
retval=0

SCRIPT_DIR=[スクリプトを設置してるディレクトリ]
LOG_DIR=${SCRIPT_DIR}/log
JSON_DIR=${SCRIPT_DIR}/json

TODAY=$(date '+%Y%m%d')
TIME=$(date '+%H%M%S')
MYIP="$(getMyIP.sh)/32"
TARGET_INFO_JSON=${TODAY}_${TIME}.json

cd ${SCRIPT_DIR}

### AWS ENV ###
retval=0
GROUP_ID="xx-xxxxxxxx"
IP_PROTOCOL="-1"

TARGET_INFO=$(jo -p GroupId="${GROUP_ID}" IpPermissions[]=$(jo IpProtocol="${IP_PROTOCOL}" IpRanges[]=$(jo CidrIp="${MYIP}" Description="MyHomeIP($TODAY)")))
echo ${TARGET_INFO} | jq '.' > ${TARGET_INFO_JSON}
TMP=$(cat ${TARGET_INFO_JSON} | sed -e "s/-1/\"-1\"/g")
echo -e "${TMP}" >${TARGET_INFO_JSON}
#cat ${TARGET_INFO_JSON}

### main ###
RESULT=$(aws ec2 authorize-security-group-ingress --cli-input-json file://${TARGET_INFO_JSON} 2>&1 )
retval=$?

#retvalが0以外だったら、ログディレクトリに出しておく
if [ ! $retval -eq 0 ] ; then
  echo $0 > ${LOG_DIR}/${TODAY}_${TIME}.log
  echo $RESULT >> ${LOG_DIR}/${TODAY}_${TIME}.log
  echo "error , watch log -> ${LOG_DIR}/${TODAY}_${TIME}.log" 1>&2
fi

#生成したjsonを退避
mv ${TARGET_INFO_JSON} ${JSON_DIR}/

exit $retval

$ ./update_securitygroup_myip.sh

$ ./update_securitygroup_myip.sh
error , watch log -> [ログディレクトリ]/20171022_192416.log

$ cat [ログディレクトリ]/20171022_192416.log
./update_securitygroup_myip.sh
 An error occurred (InvalidPermission.Duplicate) when calling the AuthorizeSecurityGroupIngress operation: the specified rule "peer: xxx.xxx.xxx.xxx/32, ALL, ALLOW" already exists