自动更新安全组规则中放通登录的公网 IP

vi CreateSecurityGroupPolicies.py   # CreateSecurityGroupPolicies.py表示脚本名称

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import json
import optparse
import socket
import subprocess
import sys

# 默认配置，可直接在此处修改，也可通过传参来调整
HOSTNAME = socket.gethostname()  # 主机名，用于区分不同客户端的放通策略
MAX_RESERVED_NUM = 1  # 自动放通策略的最大保留数量，用于清理过期的策略，存在多个出口IP时，可以按需调整
POLICY_PROTOCOL = 'TCP'  # 要放通的协议，通常是: TCP
POLICY_PORT = '22'  # 要放通的端口，通常是: 22(Linux/Unix)、3389(Windows)


def get_policy_description():
    return 'Auto-Created-For-Hostname-%s' % HOSTNAME


def get_describe_filters():
    return [{
        'Name': 'direction',
        'Values': ['INBOUND']
    }, {
        'Name': 'poly',
        'Values': ['ACCEPT']
    }, {
        'Name': 'protocol-type',
        'Values': [POLICY_PROTOCOL]
    }, {
        'Name': 'port',
        'Values': [POLICY_PORT]
    }, {
        'Name': 'description',
        'Values': [get_policy_description()]
    }]


def get_create_policy():
    return {'Ingress': [{
        'PolicyIndex': 0,
        'Action': 'ACCEPT',
        'Protocol': POLICY_PROTOCOL,
        'Port': POLICY_PORT,
        'CidrBlock': 'MY_PUBLIC_IP',  # MY_PUBLIC_IP 会自动替换为本地公网IP
        'PolicyDescription': get_policy_description(),
    }]}


def get_delete_filters(policies):
    _registry = {}
    delete_index_list = []
    for item in policies:
        if len(_registry) < MAX_RESERVED_NUM \\
                and item['CidrBlock'] not in _registry:
            _registry[item['CidrBlock']] = None
        else:
            delete_index_list.append(item['PolicyIndex'])

    delete_filters = {'Ingress': []}
    for index in delete_index_list:
        delete_filters['Ingress'].append({
            'PolicyIndex': index,
            'Action': 'ACCEPT',
            'Protocol': POLICY_PROTOCOL,
            'Port': POLICY_PORT,
            'PolicyDescription': get_policy_description(),
        })

    return delete_filters


def tccli_cmd(cmd):
    p = subprocess.Popen('tccli %s' % cmd, shell=True,
                         stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    std_out, std_err = p.communicate()

    if p.returncode:
        sys.stderr.write(std_err.decode('utf-8'))
        sys.exit(p.returncode)

    if std_out:
        return json.loads(std_out.decode('utf-8'))


def main(SecurityGroupId):
    # 添加放通本地公网IP的规则
    tccli_cmd('vpc CreateSecurityGroupPolicies '
              '--SecurityGroupId %r '
              '--SecurityGroupPolicySet %r '
              % (SecurityGroupId, json.dumps(get_create_policy())))

    # 查询匹配特定条件的规则
    r = tccli_cmd('vpc DescribeSecurityGroupPolicies '
                  '--SecurityGroupId %r '
                  '--Filters %r '
                  '--filter "SecurityGroupPolicySet.Ingress" '
                  '--output json'
                  % (SecurityGroupId, json.dumps(get_describe_filters())))

    # 删除最大保留量以外的规则
    delete_filters = get_delete_filters(r)
    if delete_filters['Ingress']:
        tccli_cmd('vpc DeleteSecurityGroupPolicies '
                  '--SecurityGroupId %r '
                  '--SecurityGroupPolicySet %r '
                  % (SecurityGroupId, json.dumps(delete_filters)))

    print('done.')


if __name__ == '__main__':
    usage = 'usage: %prog [options] SecurityGroupId [SecurityGroupId ...]'
    parser = optparse.OptionParser(usage=usage)

    parser.add_option('-r', '--region')
    parser.add_option('-n', '--max-reserved-num', type=int,
                      help='default %r' % MAX_RESERVED_NUM)
    parser.add_option('-N', '--hostname', help='default %r' % HOSTNAME)
    parser.add_option('-p', '--port', help='default %r' % POLICY_PORT)
    parser.add_option('-P', '--protocol', help='default %r' % POLICY_PROTOCOL)

    options, args = parser.parse_args()

    if options.hostname is not None:
        HOSTNAME = options.hostname

    if options.max_reserved_num is not None:
        MAX_RESERVED_NUM = options.max_reserved_num

    if options.port is not None:
        POLICY_PORT = options.port

    if options.protocol is not None:
        POLICY_PROTOCOL = options.protocol

    # 设置 TCCLI 工作地域
    if options.region:
        tccli_cmd('configure set region %s' % options.region)

    for SecurityGroupId in set(args):
        main(SecurityGroupId)

python CreateSecurityGroupPolicies.py -r ap-guangzhou  sg-xxxx -p 22
# ap-guangzhou表示安全组所在地域，sg-xxxx表示安全组ID，22表示需要放通的端口


python CreateSecurityGroupPolicies.py -N MY_MAC -n 15 -r ap-guangzhou sg-xxxx -p 22
# MY_MAC表示HOSTNAME名字，15表示MAX_RESERVED_NUM数量，ap-guangzhou表示安全组所在地域，sg-xxxx表示安全组ID，22表示需要放通的端口