本文目录导读：
我来帮你编写批量配置安全组规则的脚本,以下是针对不同云平台的实现方案：
阿里云安全组批量配置脚本（Python）
#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
批量配置阿里云安全组规则脚本
"""
import json
import sys
from aliyunsdkcore.client import AcsClient
from aliyunsdkecs.request.v20140526 import AuthorizeSecurityGroupRequest
class SecurityGroupManager:
def __init__(self, access_key_id, access_key_secret, region_id):
self.client = AcsClient(
access_key_id,
access_key_secret,
region_id
)
def add_inbound_rules(self, security_group_id, rules):
"""
批量添加入方向规则
rules格式: [
{
"ip_protocol": "tcp",
"port_range": "22/22",
"source_cidr_ip": "0.0.0.0/0",
"description": "SSH访问",
"priority": "100"
},
...
]
"""
success_count = 0
error_count = 0
for rule in rules:
try:
request = AuthorizeSecurityGroupRequest.AuthorizeSecurityGroupRequest()
request.set_SecurityGroupId(security_group_id)
request.set_IpProtocol(rule['ip_protocol'])
request.set_PortRange(rule['port_range'])
request.set_SourceCidrIp(rule['source_cidr_ip'])
request.set_NicType(rule.get('nic_type', 'internet'))
request.set_Policy(rule.get('policy', 'Accept'))
request.set_Priority(rule.get('priority', '100'))
request.set_Description(rule.get('description', ''))
response = self.client.do_action_with_exception(request)
success_count += 1
print(f"✓ 规则添加成功: {rule['description']}")
except Exception as e:
error_count += 1
print(f"✗ 规则添加失败: {rule['description']} - {str(e)}")
print(f"\n完成: 成功 {success_count} 条, 失败 {error_count} 条")
return success_count, error_count
# 配置文件示例
RULES_CONFIG = [
{
"ip_protocol": "tcp",
"port_range": "22/22",
"source_cidr_ip": "10.0.0.0/8",
"description": "内网SSH"
},
{
"ip_protocol": "tcp",
"port_range": "80/80",
"source_cidr_ip": "0.0.0.0/0",
"description": "HTTP访问"
},
{
"ip_protocol": "tcp",
"port_range": "443/443",
"source_cidr_ip": "0.0.0.0/0",
"description": "HTTPS访问"
},
{
"ip_protocol": "tcp",
"port_range": "3306/3306",
"source_cidr_ip": "192.168.0.0/16",
"description": "MySQL数据库访问"
}
]
if __name__ == "__main__":
# 配置阿里云认证信息
ACCESS_KEY_ID = "your-access-key-id"
ACCESS_KEY_SECRET = "your-access-key-secret"
REGION_ID = "cn-hangzhou"
SECURITY_GROUP_ID = "sg-xxxxxxxxx"
# 创建管理对象
manager = SecurityGroupManager(ACCESS_KEY_ID, ACCESS_KEY_SECRET, REGION_ID)
# 批量添加规则
success, error = manager.add_inbound_rules(SECURITY_GROUP_ID, RULES_CONFIG)
使用YAML配置文件方式（更灵活）
# security_rules.yaml
# 安全组规则配置文件
security_groups:
- id: "sg-xxxxxxxx1"
name: "web-server"
inbound_rules:
# SSH访问
- protocol: tcp
port: 22
source_ip: "10.0.0.0/8"
description: "内网SSH"
# Web服务
- protocol: tcp
port: 80
source_ip: "0.0.0.0/0"
description: "HTTP"
- protocol: tcp
port: 443
source_ip: "0.0.0.0/0"
description: "HTTPS"
# API服务
- protocol: tcp
port: 8080-8090
source_ip: "192.168.1.0/24"
description: "API服务"
# 数据库
- protocol: tcp
port: 3306
source_ip: "192.168.0.0/16"
description: "MySQL"
# ICMP
- protocol: icmp
port: -1/-1
source_ip: "10.0.0.0/8"
description: "内网Ping"
- id: "sg-xxxxxxxx2"
name: "database-server"
inbound_rules:
- protocol: tcp
port: 3306
source_ip: "10.0.0.0/8"
description: "MySQL"
- protocol: tcp
port: 6379
source_ip: "10.0.0.0/8"
description: "Redis"
批量配置脚本（Shell版本）
#!/bin/bash
# 批量配置安全组规则脚本（通用版）
# 阿里云配置
ALIYUN_ACCESS_KEY="your-access-key"
ALIYUN_SECRET_KEY="your-secret-key"
REGION="cn-hangzhou"
SECURITY_GROUP_ID="sg-xxxxxxxx"
# 规则配置文件
RULES_FILE="rules.txt"
# 颜色输出
GREEN='\033[0;32m'
RED='\033[0;31m'
NC='\033[0m'
# 检查必要工具
check_dependencies() {
if ! command -v aliyun &> /dev/null; then
echo "错误: 未安装阿里云CLI工具"
echo "安装命令: pip install aliyun-cli"
exit 1
fi
}
# 添加安全组规则
add_security_rule() {
local protocol=$1
local port=$2
local source_ip=$3
local desc=$4
echo -e "${GREEN}添加规则:${NC} $protocol $port $source_ip - $desc"
aliyun ecs AuthorizeSecurityGroup \
--region $REGION \
--SecurityGroupId $SECURITY_GROUP_ID \
--IpProtocol $protocol \
--PortRange $port \
--SourceCidrIp $source_ip \
--Description "$desc" \
--Policy Accept \
--Priority 100
if [ $? -eq 0 ]; then
echo -e "${GREEN}✓ 成功${NC}"
else
echo -e "${RED}✗ 失败${NC}"
fi
}
# 批量处理规则文件
process_rules_file() {
if [ ! -f "$RULES_FILE" ]; then
echo "规则文件 $RULES_FILE 不存在"
echo "创建示例文件..."
cat > $RULES_FILE << EOF
# 格式: protocol port_range source_ip description
tcp 22/22 10.0.0.0/8 SSH访问
tcp 80/80 0.0.0.0/0 HTTP服务
tcp 443/443 0.0.0.0/0 HTTPS服务
tcp 8080/8080 10.0.0.0/8 Web服务
tcp 3306/3306 192.168.0.0/16 MySQL数据库
icmp -1/-1 10.0.0.0/8 Ping检测
EOF
echo "示例文件已创建，请修改后重新运行"
return 1
fi
echo "开始批量添加安全组规则..."
echo "=========================="
# 跳过注释行和空行
grep -v '^#' $RULES_FILE | grep -v '^$' | while read line; do
protocol=$(echo $line | awk '{print $1}')
port=$(echo $line | awk '{print $2}')
source_ip=$(echo $line | awk '{print $3}')
description=$(echo $line | awk '{$1=$2=$3=""; print $0}' | sed 's/^[ \t]*//')
add_security_rule "$protocol" "$port" "$source_ip" "$description"
sleep 0.5 # 避免API限流
done
echo "=========================="
echo "批量配置完成"
}
# 清理规则
clear_rules() {
echo "此操作将删除所有规则，确认？(y/n)"
read answer
if [ "$answer" = "y" ]; then
echo "获取现有规则..."
aliyun ecs DescribeSecurityGroupAttribute \
--region $REGION \
--SecurityGroupId $SECURITY_GROUP_ID \
--query 'Permissions.Permission[*].[IpProtocol,PortRange,SourceCidrIp]' \
--output text
# 此处添加删除规则逻辑
echo "请手动确认删除"
fi
}
# 主菜单
main_menu() {
echo "安全组规则管理工具"
echo "1. 批量添加规则"
echo "2. 查看现有规则"
echo "3. 退出"
echo "请选择(1-3): "
read choice
case $choice in
1)
process_rules_file
;;
2)
aliyun ecs DescribeSecurityGroupAttribute \
--region $REGION \
--SecurityGroupId $SECURITY_GROUP_ID
;;
3)
exit 0
;;
*)
echo "无效选择"
;;
esac
}
# 主程序
check_dependencies
main_menu
规则模板文件（rules_template.json）
{
"inbound_rules": [
{
"description": "SSH - 管理员访问",
"protocol": "tcp",
"port": "22/22",
"source": "10.0.0.0/8",
"priority": 100
},
{
"description": "HTTP - Web服务",
"protocol": "tcp",
"port": "80/80",
"source": "0.0.0.0/0",
"priority": 100
},
{
"description": "HTTPS - 加密访问",
"protocol": "tcp",
"port": "443/443",
"source": "0.0.0.0/0",
"priority": 100
},
{
"description": "应用端口",
"protocol": "tcp",
"port": "3000-4000",
"source": "10.0.0.0/8",
"priority": 100
},
{
"description": "数据库访问",
"protocol": "tcp",
"port": "3306/3306",
"source": "10.0.0.0/8",
"priority": 50
}
]
}
使用说明
-
安装依赖：
# Python版本 pip install aliyun-python-sdk-ecs # Shell版本 pip install aliyun-cli
-
配置认证信息：
- 替换脚本中的
ACCESS_KEY_ID和ACCESS_KEY_SECRET - 修改
SECURITY_GROUP_ID为目标安全组ID
- 替换脚本中的
-
运行脚本：
# Python版本 python security_group_config.py # Shell版本 chmod +x security_group_config.sh ./security_group_config.sh
最佳实践建议
- 最小权限原则：只开放必要的端口
- 限制来源IP：尽量使用指定IP段而非0.0.0.0/0
- 分批执行：重要规则逐条添加，避免批量失误
- 备份现有规则：修改前先导出当前规则
- 测试验证：先在测试环境验证
需要针对其他云平台（AWS、腾讯云、华为云）的脚本，或者更具体的功能，请提供更多需求。
