import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
@Override
protected DeferredResult<RemoteResourcesPage> getExternalResources(
        String nextPageLink) {
    this.service.logFine(() -> "Getting SecurityGroups from AWS");
    DescribeSecurityGroupsRequest securityGroupsRequest = new DescribeSecurityGroupsRequest();

    String msg = "Getting AWS Security Groups [" + this.request.original.resourceReference
            + "]";

    AWSDeferredResultAsyncHandler<DescribeSecurityGroupsRequest, DescribeSecurityGroupsResult> asyncHandler =
            new AWSDeferredResultAsyncHandler<>(this.service, msg);
    this.amazonEC2Client.describeSecurityGroupsAsync(securityGroupsRequest, asyncHandler);

    return asyncHandler.toDeferredResult().thenCompose((securityGroupsResult) -> {

        RemoteResourcesPage page = new RemoteResourcesPage();

        for (SecurityGroup securityGroup : securityGroupsResult.getSecurityGroups()) {

            page.resourcesPage.put(securityGroup.getGroupId(), securityGroup);
        }

        return DeferredResult.completed(page);
    });
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
public static void tearDownTestVpc(
        AmazonEC2AsyncClient client, VerificationHost host,
        Map<String, Object> awsTestContext, boolean isMock) {
    if (!isMock && !vpcIdExists(client, AWS_DEFAULT_VPC_ID)) {
        final String vpcId = (String) awsTestContext.get(VPC_KEY);
        final String subnetId = (String) awsTestContext.get(SUBNET_KEY);
        final String internetGatewayId = (String) awsTestContext.get(INTERNET_GATEWAY_KEY);
        final String securityGroupId = (String) awsTestContext.get(SECURITY_GROUP_KEY);
        // clean up VPC and all its dependencies if creating one at setUp
        deleteSecurityGroupUsingEC2Client(client, host, securityGroupId);
        SecurityGroup securityGroup = new AWSSecurityGroupClient(client)
                .getSecurityGroup(AWS_DEFAULT_GROUP_NAME, vpcId);
        if (securityGroup != null) {
            deleteSecurityGroupUsingEC2Client(client, host, securityGroup.getGroupId());
        }
        deleteSubnet(client, subnetId);
        detachInternetGateway(client, vpcId, internetGatewayId);
        deleteInternetGateway(client, internetGatewayId);
        deleteVPC(client, vpcId);
    }
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
private void validateAWSArtifacts(String securityGroupDescriptionLink,
        AuthCredentialsServiceState creds) throws Throwable {

    SecurityGroupState securityGroup = getSecurityGroupState(securityGroupDescriptionLink);

    AWSSecurityGroupClient client = new AWSSecurityGroupClient(
            AWSUtils.getAsyncClient(creds, this.region, getExecutor()));
    // if any artifact is not present then an error will be thrown
    SecurityGroup sg = client.getSecurityGroupById(
            securityGroup.customProperties.get(AWSSecurityGroupService.SECURITY_GROUP_ID));
    assertNotNull(sg);
    assertNotNull(sg.getIpPermissions());
    assertTrue(sg.getIpPermissions().size() == 2);
    // check that there is a rule that enables internal communication
    assertTrue(isInternalRule(sg.getGroupId(), sg.getIpPermissions()));
    assertNotNull(sg.getIpPermissionsEgress());
    // there are two egress rules (one that was added as part of this test, and the default one)
    assertTrue(sg.getIpPermissionsEgress().size() == 2);
    // check that there is a rule that enables internal communication
    assertTrue(isInternalRule(sg.getGroupId(), sg.getIpPermissionsEgress()));
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
@Test
public void testDefaultSecurityGroupPorts() throws Throwable {
    // create the group
    String groupId = this.client.createDefaultSecurityGroup(null);

    // allow the default ports
    this.client.addIngressRules(groupId, this.client.getDefaultRules(this.subnet));

    // get the updated CM group
    SecurityGroup group = this.client.getDefaultSecurityGroup(null);

    List<IpPermission> rules = group.getIpPermissions();

    assertTrue(rules.size() > 0);
    validateDefaultRules(rules);

    // lets delete the default CM group
    this.client.deleteSecurityGroup(groupId);
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
@Test
public void testAllocateSecurityGroupUpdate() throws Throwable {
    String groupId = this.client.createDefaultSecurityGroup(null);

    List<IpPermission> rules = new ArrayList<>();
    IpRange ipRange = new IpRange().withCidrIp(DEFAULT_ALLOWED_NETWORK);
    rules.add(new IpPermission()
            .withIpProtocol(DEFAULT_PROTOCOL)
            .withFromPort(22)
            .withToPort(22)
            .withIpv4Ranges(ipRange));
    this.client.addIngressRules(groupId, rules);
    SecurityGroup updatedGroup = this.client.getDefaultSecurityGroup(null);
    validateDefaultRules(updatedGroup.getIpPermissions());
    this.client.deleteSecurityGroup(groupId);
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
/**
 * This method fetches all security groups in an aws account.
 * @return List<SecurityGroup> returns all security groups.
 * @throws AmazonClientException 
 */
public List<SecurityGroup> getAllSecurityGroups() throws AmazonClientException {
    
    List<SecurityGroup> allSecurityGroups;
    
    try {
        
       DescribeSecurityGroupsResult describeSecurityGroupsResult = this.amazonEc2.describeSecurityGroups();
       allSecurityGroups = describeSecurityGroupsResult.getSecurityGroups();
       
    } catch(AmazonClientException e) {
       System.out.println("ERROR : fetching all security groups in the account.");
       throw e;
    }
    
    List<String> allSecurityGroupsNames = allSecurityGroups.stream().map(e -> e.getGroupName()).collect(Collectors.toList());
    System.out.println("INFO : Security Groups Names : " + allSecurityGroupsNames);
    
    return allSecurityGroups;
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
/**
 * This method returns list of Evaluation objects.
 * @param nonCompliantSecurityGroups
 * @return List<Evaluation> returns list of Evaluation objects.
 */
private List<Evaluation> createEvaluations(List<SecurityGroup> nonCompliantSecurityGroups) {
    
    List<Evaluation> evaluations = new ArrayList<>();
    
    if ( nonCompliantSecurityGroups == null || nonCompliantSecurityGroups.size() > 0 ) {
        
        for(SecurityGroup sg: nonCompliantSecurityGroups) {
            
            String securityGroupName = sg.getGroupName();
            Evaluation evaluation = new Evaluation();
            evaluation.setComplianceResourceId(securityGroupName);
            evaluation.setComplianceResourceType(COMPLIANCE_RESOURCE_TYPE);
            evaluation.setComplianceType(ComplianceType.NON_COMPLIANT);
            evaluation.setOrderingTimestamp(new Date());
            evaluations.add(evaluation);
        }
    }
    
    System.out.println("INFO : Number of evaluations : " + evaluations.size());
    return evaluations;
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
/**
 * Validates the actual security group permissions against the pre-defined network rules.
 *
 * @param client              the EC2 client
 * @param configuration       the configuration to be validated
 * @param accumulator         the exception condition accumulator
 * @param localizationContext the localization context
 */
private void checkSecurityGroups(AmazonEC2Client client,
                                 Configured configuration,
                                 PluginExceptionConditionAccumulator accumulator,
                                 LocalizationContext localizationContext) {
  List<String> securityGroupIds = EC2InstanceTemplate.CSV_SPLITTER.splitToList(
      configuration.getConfigurationValue(SECURITY_GROUP_IDS, localizationContext));
  List<SecurityGroup> securityGroups = Collections.emptyList();
  try {
    DescribeSecurityGroupsResult result = client.describeSecurityGroups(
        new DescribeSecurityGroupsRequest().withGroupIds(securityGroupIds));
    securityGroups = result.getSecurityGroups();
  } catch (AmazonServiceException e) {
    if (!e.getErrorCode().startsWith(INVALID_SECURITY_GROUP)) {
      throw Throwables.propagate(e);
    }
    // Otherwise, the error should be caught in anther validation,
    // EC2InstanceTemplateConfigurationValidator.checkSecurityGroupIds()
  }

  for (Direction direction : Direction.values()) {
    checkRulesForSecurityGroups(securityGroups, direction, accumulator,
        localizationContext);
  }
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
public static String getSecurityGroupId() {
	connect();
	
	DescribeSecurityGroupsRequest req = new DescribeSecurityGroupsRequest();
	
	ArrayList<String> groupNames = new ArrayList<String>();
	groupNames.add(Configuration.SECURITY_GROUP_NAME);
	req.setGroupNames(groupNames);
	
	DescribeSecurityGroupsResult res = client.describeSecurityGroups(req);
	List<SecurityGroup> securityGroups = res.getSecurityGroups();
	
	if (securityGroups == null || securityGroups.size() == 0)
		return null;
	
	return securityGroups.get(0).getGroupId();
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
@Override
public Map<String, SecurityGroupCheckDetails> check(final Collection<String> groupIds, final String account, final Region region) {
    final DescribeSecurityGroupsRequest describeSecurityGroupsRequest = new DescribeSecurityGroupsRequest();
    describeSecurityGroupsRequest.setGroupIds(groupIds);
    final AmazonEC2Client amazonEC2Client = clientProvider.getClient(
            AmazonEC2Client.class,
            account, region);
    final DescribeSecurityGroupsResult describeSecurityGroupsResult = amazonEC2Client.describeSecurityGroups(
            describeSecurityGroupsRequest);


    final ImmutableMap.Builder<String, SecurityGroupCheckDetails> result = ImmutableMap.builder();

    for (final SecurityGroup securityGroup : describeSecurityGroupsResult.getSecurityGroups()) {
        final List<String> offendingRules = securityGroup.getIpPermissions().stream()
                .filter(isOffending)
                .map(Object::toString)
                .collect(toList());
        if (!offendingRules.isEmpty()) {
            final SecurityGroupCheckDetails details = new SecurityGroupCheckDetails(
                    securityGroup.getGroupName(), ImmutableList.copyOf(offendingRules));
            result.put(securityGroup.getGroupId(), details);
        }
    }
    return result.build();
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
@SuppressWarnings("unchecked")
@Before
public void setUp() throws Exception {
    final ClientProvider mockClientProvider = mock(ClientProvider.class);
    final AmazonEC2Client mockEC2 = mock(AmazonEC2Client.class);
    mockPredicate = (Predicate<IpPermission>) mock(Predicate.class);

    when(mockClientProvider.getClient(any(), any(), any())).thenReturn(mockEC2);

    securityGroupsChecker = new SecurityGroupsCheckerImpl(mockClientProvider, mockPredicate);

    final DescribeSecurityGroupsResult securityGroups = new DescribeSecurityGroupsResult()
            .withSecurityGroups(new SecurityGroup()
                    .withGroupId("sg-12345678")
                    .withGroupName("my-sec-group")
                    .withIpPermissions(new IpPermission()
                            .withIpProtocol("tcp")
                            .withIpv4Ranges(new IpRange().withCidrIp("0.0.0.0/0"))
                            .withFromPort(0)
                            .withToPort(65535)
                            .withIpv6Ranges(new Ipv6Range().withCidrIpv6("::/0"))
                            .withUserIdGroupPairs(new UserIdGroupPair()
                                    .withUserId("111222333444")
                                    .withGroupId("sg-11223344"))));
    when(mockEC2.describeSecurityGroups(any())).thenReturn(securityGroups);
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
/**
 * {@inheritDoc}
 */
@Override
public List<SecurityGroup> getSecurityGroups(Long userNo, Long platformNo) {
    // セキュリティグループを取得
    AwsProcessClient awsProcessClient = awsProcessClientFactory.createAwsProcessClient(userNo, platformNo);
    DescribeSecurityGroupsRequest request = new DescribeSecurityGroupsRequest();
    PlatformAws platformAws = platformAwsDao.read(platformNo);
    if (BooleanUtils.isTrue(platformAws.getVpc())) {
        // VPCの場合、VPC IDが同じものを抽出
        request.withFilters(new Filter().withName("vpc-id").withValues(platformAws.getVpcId()));
    } else {
        // 非VPCの場合、VPC IDが空のものを抽出
        request.withFilters(new Filter().withName("vpc-id").withValues(""));
    }
    DescribeSecurityGroupsResult result = awsProcessClient.getEc2Client().describeSecurityGroups(request);
    List<SecurityGroup> securityGroups = result.getSecurityGroups();

    // ソート
    Collections.sort(securityGroups, Comparators.COMPARATOR_SECURITY_GROUP);

    return securityGroups;
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
@Override
@SuppressWarnings("rawtypes")
protected boolean isEqual(AbstractResource newResource) {
    SecurityGroup oldSG = this.getResource();
    SecurityGroup newSG = (SecurityGroup) newResource.getResource();

    if (notEqual(oldSG.getOwnerId(), newSG.getOwnerId())) return false;
    if (notEqual(oldSG.getGroupName(), newSG.getGroupName())) return false;
    if (notEqual(oldSG.getGroupId(), newSG.getGroupId())) return false;
    if (notEqual(oldSG.getDescription(), newSG.getDescription())) return false;
    if (notEqualIpPermission(oldSG.getIpPermissions(), newSG.getIpPermissions())) return false;
    if (notEqualIpPermission(oldSG.getIpPermissionsEgress(), newSG.getIpPermissionsEgress())) return false;
    if (notEqual(oldSG.getVpcId(), newSG.getVpcId())) return false;
    if (notEqualCollection(oldSG.getTags(), newSG.getTags())) return false;

    return true;
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
@Override
public Collection<String> listRuleSets() {
    DescribeSecurityGroupsRequest request = new DescribeSecurityGroupsRequest();
    DescribeSecurityGroupsResult result = null;
    try {
        result = client.describeSecurityGroups( request );
    }
    catch ( Exception e ) {
        LOG.warn( "Error while getting security groups", e );
        return new LinkedList<String>();
    }
    Collection<String> groups = new ArrayList<String>();
    for( SecurityGroup group : result.getSecurityGroups() ) {
        groups.add( group.getGroupName() );
    }
    return groups;
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
public void createDescribeSecurityGroupResult(String vpcId,
        String SecurityGroupIds) {
    Collection<SecurityGroup> securityGroup = new ArrayList<SecurityGroup>();
    for (int i = 0; i < SecurityGroupIds.split(",").length; i++) {
        securityGroup.add(new SecurityGroup()
                .withGroupId(SecurityGroupIds.split(",")[i])
                .withGroupName(SecurityGroupIds.split(",")[i])
                .withVpcId(vpcId));
    }
    DescribeSecurityGroupsResult securityGroupResult = new DescribeSecurityGroupsResult()
            .withSecurityGroups(securityGroup);
    doReturn(securityGroupResult).when(ec2).describeSecurityGroups();
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
public static List<String> getOrCreateDefaultSecurityGroup(AmazonEC2AsyncClient amazonEC2Client,
        AWSNicContext nicCtx) {

    AWSSecurityGroupClient client = new AWSSecurityGroupClient(amazonEC2Client);
    // in case no group is configured in the properties, attempt to discover the default one
    if (nicCtx != null && nicCtx.vpc != null) {
        try {
            SecurityGroup group = client.getSecurityGroup(
                    DEFAULT_SECURITY_GROUP_NAME,
                    nicCtx.vpc.getVpcId());
            if (group != null) {
                return Arrays.asList(group.getGroupId());
            }
        } catch (AmazonServiceException t) {
            if (!t.getMessage().contains(
                    DEFAULT_SECURITY_GROUP_NAME)) {
                throw t;
            }
        }
    }

    // if the group doesn't exist an exception is thrown. We won't throw a
    // missing group exception
    // we will continue and create the group
    String groupId = client.createDefaultSecurityGroupWithDefaultRules(nicCtx.vpc);

    return Collections.singletonList(groupId);
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
public SecurityGroup getSecurityGroupById(String groupId) {
    SecurityGroup cellGroup = null;

    DescribeSecurityGroupsRequest req = new DescribeSecurityGroupsRequest()
            .withGroupIds(groupId);
    DescribeSecurityGroupsResult cellGroups = this.client.describeSecurityGroups(req);
    if (cellGroups != null) {
        cellGroup = cellGroups.getSecurityGroups().get(0);
    }
    return cellGroup;
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
public List<SecurityGroup> getSecurityGroups(List<String> names, String vpcId) {

        DescribeSecurityGroupsRequest req = new DescribeSecurityGroupsRequest();

        req.withFilters(new Filter(AWS_GROUP_NAME_FILTER, names));
        if (vpcId != null) {
            req.withFilters(new Filter(AWS_VPC_ID_FILTER, Collections.singletonList(vpcId)));
        }

        DescribeSecurityGroupsResult groups = this.client.describeSecurityGroups(req);
        return groups != null ? groups.getSecurityGroups() : Collections.emptyList();
    }
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
public SecurityGroup getSecurityGroup(String name, String vpcId) {
    SecurityGroup cellGroup = null;

    DescribeSecurityGroupsRequest req = new DescribeSecurityGroupsRequest()
            .withFilters(new Filter("group-name", Collections.singletonList(name)));
    if (vpcId != null) {
        req.withFilters(new Filter("vpc-id", Collections.singletonList(vpcId)));
    }
    DescribeSecurityGroupsResult cellGroups = this.client.describeSecurityGroups(req);
    if (cellGroups != null && !cellGroups.getSecurityGroups().isEmpty()) {
        cellGroup = cellGroups.getSecurityGroups().get(0);
    }
    return cellGroup;
}
 

import com.amazonaws.services.ec2.model.SecurityGroup; //导入依赖的package包/类
public SecurityGroup getDefaultSecurityGroup(String vpcId) {
    SecurityGroup cellGroup = null;

    DescribeSecurityGroupsRequest req = new DescribeSecurityGroupsRequest()
            .withFilters(new Filter("group-name",
                    Collections.singletonList(DEFAULT_SECURITY_GROUP_NAME)));
    if (vpcId != null) {
        req.withFilters(new Filter("vpc-id", Collections.singletonList(vpcId)));
    }
    DescribeSecurityGroupsResult cellGroups = this.client.describeSecurityGroups(req);
    if (cellGroups != null && !cellGroups.getSecurityGroups().isEmpty()) {
        cellGroup = cellGroups.getSecurityGroups().get(0);
    }
    return cellGroup;
}