是否可以使用 Cloudformation 删除 aws 安全组默认出口允许所有规则？

Question

I Know that terraform does remove the default behavior of AWS.But is it possible to do that with the cloudformation?

Answer 1

The CloudFormation documentation has a dedicated section for that:

• Remove Default Rule :

When you specify a VPC security group, Amazon EC2 creates a default egress rule that allows egress traffic on all ports and IP protocols to any location. The default rule is removed only when you specify one or more egress rules. If you want to remove the default rule and limit egress traffic to just the localhost (127.0.0.1/32) , use the following example.

sgwithoutegress:
  Type: AWS::EC2::SecurityGroup
  Properties:
    GroupDescription: Limits security group egress traffic
    SecurityGroupEgress:
    - CidrIp: 127.0.0.1/32
      IpProtocol: "-1"
    VpcId:
      Ref: myVPC

Not that this does not remove physically the egress rule from the security group. This will lead to the following egress rule being created:

Instead of the default one: