如何写批量配置安全组规则脚本

wen 实用脚本 2026-06-26 237

本文目录导读：

如何写批量配置安全组规则脚本

阿里云安全组批量配置脚本（Python）
使用YAML配置文件方式（更灵活）
批量配置脚本（Shell版本）
规则模板文件（rules_template.json）
使用说明
最佳实践建议

我来帮你编写批量配置安全组规则的脚本,以下是针对不同云平台的实现方案：

阿里云安全组批量配置脚本（Python）

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
批量配置阿里云安全组规则脚本
"""
import json
import sys
from aliyunsdkcore.client import AcsClient
from aliyunsdkecs.request.v20140526 import AuthorizeSecurityGroupRequest
class SecurityGroupManager:
    def __init__(self, access_key_id, access_key_secret, region_id):
        self.client = AcsClient(
            access_key_id,
            access_key_secret,
            region_id
        )
    def add_inbound_rules(self, security_group_id, rules):
        """
        批量添加入方向规则
        rules格式: [
            {
                "ip_protocol": "tcp",
                "port_range": "22/22",
                "source_cidr_ip": "0.0.0.0/0",
                "description": "SSH访问",
                "priority": "100"
            },
            ...
        ]
        """
        success_count = 0
        error_count = 0
        for rule in rules:
            try:
                request = AuthorizeSecurityGroupRequest.AuthorizeSecurityGroupRequest()
                request.set_SecurityGroupId(security_group_id)
                request.set_IpProtocol(rule['ip_protocol'])
                request.set_PortRange(rule['port_range'])
                request.set_SourceCidrIp(rule['source_cidr_ip'])
                request.set_NicType(rule.get('nic_type', 'internet'))
                request.set_Policy(rule.get('policy', 'Accept'))
                request.set_Priority(rule.get('priority', '100'))
                request.set_Description(rule.get('description', ''))
                response = self.client.do_action_with_exception(request)
                success_count += 1
                print(f"✓ 规则添加成功: {rule['description']}")
            except Exception as e:
                error_count += 1
                print(f"✗ 规则添加失败: {rule['description']} - {str(e)}")
        print(f"\n完成: 成功 {success_count} 条, 失败 {error_count} 条")
        return success_count, error_count
# 配置文件示例
RULES_CONFIG = [
    {
        "ip_protocol": "tcp",
        "port_range": "22/22",
        "source_cidr_ip": "10.0.0.0/8",
        "description": "内网SSH"
    },
    {
        "ip_protocol": "tcp",
        "port_range": "80/80",
        "source_cidr_ip": "0.0.0.0/0",
        "description": "HTTP访问"
    },
    {
        "ip_protocol": "tcp",
        "port_range": "443/443",
        "source_cidr_ip": "0.0.0.0/0",
        "description": "HTTPS访问"
    },
    {
        "ip_protocol": "tcp",
        "port_range": "3306/3306",
        "source_cidr_ip": "192.168.0.0/16",
        "description": "MySQL数据库访问"
    }
]
if __name__ == "__main__":
    # 配置阿里云认证信息
    ACCESS_KEY_ID = "your-access-key-id"
    ACCESS_KEY_SECRET = "your-access-key-secret"
    REGION_ID = "cn-hangzhou"
    SECURITY_GROUP_ID = "sg-xxxxxxxxx"
    # 创建管理对象
    manager = SecurityGroupManager(ACCESS_KEY_ID, ACCESS_KEY_SECRET, REGION_ID)
    # 批量添加规则
    success, error = manager.add_inbound_rules(SECURITY_GROUP_ID, RULES_CONFIG)

使用YAML配置文件方式（更灵活）

# security_rules.yaml
# 安全组规则配置文件
security_groups:
  - id: "sg-xxxxxxxx1"
    name: "web-server"
    inbound_rules:
      # SSH访问
      - protocol: tcp
        port: 22
        source_ip: "10.0.0.0/8"
        description: "内网SSH"
      # Web服务
      - protocol: tcp
        port: 80
        source_ip: "0.0.0.0/0"
        description: "HTTP"
      - protocol: tcp
        port: 443
        source_ip: "0.0.0.0/0"
        description: "HTTPS"
      # API服务
      - protocol: tcp
        port: 8080-8090
        source_ip: "192.168.1.0/24"
        description: "API服务"
      # 数据库
      - protocol: tcp
        port: 3306
        source_ip: "192.168.0.0/16"
        description: "MySQL"
      # ICMP
      - protocol: icmp
        port: -1/-1
        source_ip: "10.0.0.0/8"
        description: "内网Ping"
  - id: "sg-xxxxxxxx2"
    name: "database-server"
    inbound_rules:
      - protocol: tcp
        port: 3306
        source_ip: "10.0.0.0/8"
        description: "MySQL"
      - protocol: tcp
        port: 6379
        source_ip: "10.0.0.0/8"
        description: "Redis"

批量配置脚本（Shell版本）

#!/bin/bash
# 批量配置安全组规则脚本（通用版）
# 阿里云配置
ALIYUN_ACCESS_KEY="your-access-key"
ALIYUN_SECRET_KEY="your-secret-key"
REGION="cn-hangzhou"
SECURITY_GROUP_ID="sg-xxxxxxxx"
# 规则配置文件
RULES_FILE="rules.txt"
# 颜色输出
GREEN='\033[0;32m'
RED='\033[0;31m'
NC='\033[0m'
# 检查必要工具
check_dependencies() {
    if ! command -v aliyun &> /dev/null; then
        echo "错误: 未安装阿里云CLI工具"
        echo "安装命令: pip install aliyun-cli"
        exit 1
    fi
}
# 添加安全组规则
add_security_rule() {
    local protocol=$1
    local port=$2
    local source_ip=$3
    local desc=$4
    echo -e "${GREEN}添加规则:${NC} $protocol $port $source_ip - $desc"
    aliyun ecs AuthorizeSecurityGroup \
        --region $REGION \
        --SecurityGroupId $SECURITY_GROUP_ID \
        --IpProtocol $protocol \
        --PortRange $port \
        --SourceCidrIp $source_ip \
        --Description "$desc" \
        --Policy Accept \
        --Priority 100
    if [ $? -eq 0 ]; then
        echo -e "${GREEN}✓ 成功${NC}"
    else
        echo -e "${RED}✗ 失败${NC}"
    fi
}
# 批量处理规则文件
process_rules_file() {
    if [ ! -f "$RULES_FILE" ]; then
        echo "规则文件 $RULES_FILE 不存在"
        echo "创建示例文件..."
        cat > $RULES_FILE << EOF
# 格式: protocol port_range source_ip description
tcp 22/22 10.0.0.0/8 SSH访问
tcp 80/80 0.0.0.0/0 HTTP服务
tcp 443/443 0.0.0.0/0 HTTPS服务
tcp 8080/8080 10.0.0.0/8 Web服务
tcp 3306/3306 192.168.0.0/16 MySQL数据库
icmp -1/-1 10.0.0.0/8 Ping检测
EOF
        echo "示例文件已创建，请修改后重新运行"
        return 1
    fi
    echo "开始批量添加安全组规则..."
    echo "=========================="
    # 跳过注释行和空行
    grep -v '^#' $RULES_FILE | grep -v '^$' | while read line; do
        protocol=$(echo $line | awk '{print $1}')
        port=$(echo $line | awk '{print $2}')
        source_ip=$(echo $line | awk '{print $3}')
        description=$(echo $line | awk '{$1=$2=$3=""; print $0}' | sed 's/^[ \t]*//')
        add_security_rule "$protocol" "$port" "$source_ip" "$description"
        sleep 0.5  # 避免API限流
    done
    echo "=========================="
    echo "批量配置完成"
}
# 清理规则
clear_rules() {
    echo "此操作将删除所有规则，确认？(y/n)"
    read answer
    if [ "$answer" = "y" ]; then
        echo "获取现有规则..."
        aliyun ecs DescribeSecurityGroupAttribute \
            --region $REGION \
            --SecurityGroupId $SECURITY_GROUP_ID \
            --query 'Permissions.Permission[*].[IpProtocol,PortRange,SourceCidrIp]' \
            --output text
        # 此处添加删除规则逻辑
        echo "请手动确认删除"
    fi
}
# 主菜单
main_menu() {
    echo "安全组规则管理工具"
    echo "1. 批量添加规则"
    echo "2. 查看现有规则"  
    echo "3. 退出"
    echo "请选择(1-3): "
    read choice
    case $choice in
        1)
            process_rules_file
            ;;
        2)
            aliyun ecs DescribeSecurityGroupAttribute \
                --region $REGION \
                --SecurityGroupId $SECURITY_GROUP_ID
            ;;
        3)
            exit 0
            ;;
        *)
            echo "无效选择"
            ;;
    esac
}
# 主程序
check_dependencies
main_menu

规则模板文件（rules_template.json）

{
  "inbound_rules": [
    {
      "description": "SSH - 管理员访问",
      "protocol": "tcp",
      "port": "22/22",
      "source": "10.0.0.0/8",
      "priority": 100
    },
    {
      "description": "HTTP - Web服务",
      "protocol": "tcp", 
      "port": "80/80",
      "source": "0.0.0.0/0",
      "priority": 100
    },
    {
      "description": "HTTPS - 加密访问",
      "protocol": "tcp",
      "port": "443/443", 
      "source": "0.0.0.0/0",
      "priority": 100
    },
    {
      "description": "应用端口",
      "protocol": "tcp",
      "port": "3000-4000",
      "source": "10.0.0.0/8",
      "priority": 100
    },
    {
      "description": "数据库访问",
      "protocol": "tcp",
      "port": "3306/3306",
      "source": "10.0.0.0/8", 
      "priority": 50
    }
  ]
}

使用说明

安装依赖：

# Python版本
pip install aliyun-python-sdk-ecs
# Shell版本
pip install aliyun-cli

配置认证信息：
- 替换脚本中的 ACCESS_KEY_ID 和 ACCESS_KEY_SECRET
- 修改 SECURITY_GROUP_ID 为目标安全组ID

运行脚本：

# Python版本
python security_group_config.py
# Shell版本
chmod +x security_group_config.sh
./security_group_config.sh

最佳实践建议

最小权限原则：只开放必要的端口
限制来源IP：尽量使用指定IP段而非0.0.0.0/0
分批执行：重要规则逐条添加，避免批量失误
备份现有规则：修改前先导出当前规则
测试验证：先在测试环境验证

需要针对其他云平台（AWS、腾讯云、华为云）的脚本，或者更具体的功能，请提供更多需求。

本文地址： https://www.bmjup.com/post/8649.html