AWS ec2 documentation change

Service: ec2 · 2025-06-28 · Documentation high

File: ec2/latest/devguide/example_ec2_AuthorizeSecurityGroupIngress_section.md

Summary

Added multiple PowerShell examples showing how to configure security group ingress rules for EC2-VPC and EC2-Classic, including CIDR restrictions and security group references

Security assessment

The changes document proper security group configuration practices including IP restriction and port management, but there is no evidence of addressing a specific security vulnerability. Shows security best practices for network access control.

Diff

diff --git a/ec2/latest/devguide/example_ec2_AuthorizeSecurityGroupIngress_section.md b/ec2/latest/devguide/example_ec2_AuthorizeSecurityGroupIngress_section.md
index 1c86ade38..98858a03f 100644
--- a//ec2/latest/devguide/example_ec2_AuthorizeSecurityGroupIngress_section.md
+++ b//ec2/latest/devguide/example_ec2_AuthorizeSecurityGroupIngress_section.md
@@ -887,0 +888,86 @@ PowerShell
+**Tools for PowerShell V5**
+    
+
+**Example 1: This example defines ingress rules for a security group for EC2-VPC. These rules grant access to a specific IP address for SSH (port 22) and RDC (port 3389). Note that you must identify security groups for EC2-VPC using the security group ID not the security group name. The syntax used by this example requires PowerShell version 3 or higher.**
+    
+    
+    $ip1 = @{ IpProtocol="tcp"; FromPort="22"; ToPort="22"; IpRanges="203.0.113.25/32" }
+    $ip2 = @{ IpProtocol="tcp"; FromPort="3389"; ToPort="3389"; IpRanges="203.0.113.25/32" }
+    
+    Grant-EC2SecurityGroupIngress -GroupId sg-12345678 -IpPermission @( $ip1, $ip2 )
+    
+
+**Example 2: With PowerShell version 2, you must use New-Object to create the IpPermission objects.**
+    
+    
+    $ip1 = New-Object Amazon.EC2.Model.IpPermission
+    $ip1.IpProtocol = "tcp"
+    $ip1.FromPort = 22
+    $ip1.ToPort = 22
+    $ip1.IpRanges.Add("203.0.113.25/32")
+    
+    $ip2 = new-object Amazon.EC2.Model.IpPermission
+    $ip2.IpProtocol = "tcp"
+    $ip2.FromPort = 3389
+    $ip2.ToPort = 3389
+    $ip2.IpRanges.Add("203.0.113.25/32")
+    
+    Grant-EC2SecurityGroupIngress -GroupId sg-12345678 -IpPermission @( $ip1, $ip2 )
+    
+
+**Example 3: This example defines ingress rules for a security group for EC2-Classic. These rules grant access to a specific IP address for SSH (port 22) and RDC (port 3389). The syntax used by this example requires PowerShell version 3 or higher.**
+    
+    
+    $ip1 = @{ IpProtocol="tcp"; FromPort="22"; ToPort="22"; IpRanges="203.0.113.25/32" }
+    $ip2 = @{ IpProtocol="tcp"; FromPort="3389"; ToPort="3389"; IpRanges="203.0.113.25/32" }
+    
+    Grant-EC2SecurityGroupIngress -GroupName "my-security-group" -IpPermission @( $ip1, $ip2 )
+    
+
+**Example 4: With PowerShell version 2, you must use New-Object to create the IpPermission objects.**
+    
+    
+    $ip1 = New-Object Amazon.EC2.Model.IpPermission
+    $ip1.IpProtocol = "tcp"
+    $ip1.FromPort = 22
+    $ip1.ToPort = 22
+    $ip1.IpRanges.Add("203.0.113.25/32")
+    
+    $ip2 = new-object Amazon.EC2.Model.IpPermission
+    $ip2.IpProtocol = "tcp"
+    $ip2.FromPort = 3389
+    $ip2.ToPort = 3389
+    $ip2.IpRanges.Add("203.0.113.25/32")
+    
+    Grant-EC2SecurityGroupIngress -GroupName "my-security-group" -IpPermission @( $ip1, $ip2 )
+    
+
+**Example 5: This example grants TCP port 8081 access from the specified source security group (sg-1a2b3c4d) to the specified security group (sg-12345678).**
+    
+    
+    $ug = New-Object Amazon.EC2.Model.UserIdGroupPair
+    $ug.GroupId = "sg-1a2b3c4d"
+    $ug.UserId = "123456789012"
+    
+    Grant-EC2SecurityGroupIngress -GroupId sg-12345678 -IpPermission @( @{ IpProtocol="tcp"; FromPort="8081"; ToPort="8081"; UserIdGroupPairs=$ug } )
+    
+
+**Example 6: This example adds the CIDR 5.5.5.5/32 to the Ingress rules of security Group sg-1234abcd for TCP port 22 traffic with a description.**
+    
+    
+    $IpRange = New-Object -TypeName Amazon.EC2.Model.IpRange
+    $IpRange.CidrIp = "5.5.5.5/32"
+    $IpRange.Description = "SSH from Office"
+    $IpPermission = New-Object Amazon.EC2.Model.IpPermission
+    $IpPermission.IpProtocol = "tcp"
+    $IpPermission.ToPort = 22
+    $IpPermission.FromPort = 22
+    $IpPermission.Ipv4Ranges = $IpRange
+    Grant-EC2SecurityGroupIngress -GroupId sg-1234abcd -IpPermission $IpPermission
+    
+
+  * For API details, see [AuthorizeSecurityGroupIngress](https://docs.aws.amazon.com/powershell/v5/reference) in _AWS Tools for PowerShell Cmdlet Reference (V5)_. 
+
+
+
+