network_security_group_security_rules

Creates, updates, deletes, gets or lists a network_security_group_security_rules resource.

Overview

Name	`network_security_group_security_rules`
Type	Resource
Id	`oci.network.network_security_group_security_rules`

Fields

The following fields are returned by SELECT queries:

list

A security rule is one of the items in a [NetworkSecurityGroup](#/en/iaas/latest/NetworkSecurityGroup/). It is a virtual firewall rule for the VNICs in the network security group. A rule can be for either inbound (direction= INGRESS) or outbound (direction= EGRESS) IP packets.

Name	Datatype	Description
`id`	`string`	An Oracle-assigned identifier for the security rule. You specify this ID when you want to update or delete the rule. Example: `04ABEC`
`description`	`string`	An optional description of your choice for the rule.
`destination`	`string`	Conceptually, this is the range of IP addresses that a packet originating from the instance can go to. Allowed values: * An IP address range in CIDR notation. For example: `192.168.1.0/24` or `2001:0db8:0123:45::/56` IPv6 addressing is supported for all commercial and government regions. See [IPv6 Addresses](/iaas/Content/Network/Concepts/ipv6.htm). * The `cidrBlock` value for a [Service](#/en/iaas/latest/Service/), if you're setting up a security rule for traffic destined for a particular `Service` through a service gateway. For example: `oci-phx-objectstorage`. * The [OCID](/iaas/Content/General/Concepts/identifiers.htm) of a [NetworkSecurityGroup](#/en/iaas/latest/NetworkSecurityGroup/) in the same VCN. The value can be the NSG that the rule belongs to if the rule's intent is to control traffic between VNICs in the same NSG.
`destinationType`	`string`	Type of destination for the rule. Required if `direction` = `EGRESS`. Allowed values: * `CIDR_BLOCK`: If the rule's `destination` is an IP address range in CIDR notation. * `SERVICE_CIDR_BLOCK`: If the rule's `destination` is the `cidrBlock` value for a [Service](#/en/iaas/latest/Service/) (the rule is for traffic destined for a particular `Service` through a service gateway). * `NETWORK_SECURITY_GROUP`: If the rule's `destination` is the [OCID](/iaas/Content/General/Concepts/identifiers.htm) of a [NetworkSecurityGroup](#/en/iaas/latest/NetworkSecurityGroup/). (CIDR_BLOCK, SERVICE_CIDR_BLOCK, NETWORK_SECURITY_GROUP)
`direction`	`string`	Direction of the security rule. Set to `EGRESS` for rules to allow outbound IP packets, or `INGRESS` for rules to allow inbound IP packets. (EGRESS, INGRESS)
`icmpOptions`	`object`	Optional and valid only for ICMP and ICMPv6. Use to specify a particular ICMP type and code as defined in: - [ICMP Parameters](http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml) - [ICMPv6 Parameters](https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml) If you specify ICMP or ICMPv6 as the protocol but omit this object, then all ICMP types and codes are allowed. If you do provide this object, the type is required and the code is optional. To enable MTU negotiation for ingress internet traffic via IPv4, make sure to allow type 3 ("Destination Unreachable") code 4 ("Fragmentation Needed and Don't Fragment was Set"). If you need to specify multiple codes for a single type, create a separate security list rule for each.
`isStateless`	`boolean`	A stateless rule allows traffic in one direction. Remember to add a corresponding stateless rule in the other direction if you need to support bidirectional traffic. For example, if egress traffic allows TCP destination port 80, there should be an ingress rule to allow TCP source port 80. Defaults to false, which means the rule is stateful and a corresponding rule is not necessary for bidirectional traffic.
`isValid`	`boolean`	Whether the rule is valid. The value is `True` when the rule is first created. If the rule's `source` or `destination` is a network security group, the value changes to `False` if that network security group is deleted.
`protocol`	`string`	The transport protocol. Specify either `all` or an IPv4 protocol number as defined in [Protocol Numbers](http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Options are supported only for ICMP ("1"), TCP ("6"), UDP ("17"), and ICMPv6 ("58").
`source`	`string`	Conceptually, this is the range of IP addresses that a packet coming into the instance can come from. Allowed values: * An IP address range in CIDR notation. For example: `192.168.1.0/24` or `2001:0db8:0123:45::/56` IPv6 addressing is supported for all commercial and government regions. See [IPv6 Addresses](/iaas/Content/Network/Concepts/ipv6.htm). * The `cidrBlock` value for a [Service](#/en/iaas/latest/Service/), if you're setting up a security rule for traffic coming from a particular `Service` through a service gateway. For example: `oci-phx-objectstorage`. * The [OCID](/iaas/Content/General/Concepts/identifiers.htm) of a [NetworkSecurityGroup](#/en/iaas/latest/NetworkSecurityGroup/) in the same VCN. The value can be the NSG that the rule belongs to if the rule's intent is to control traffic between VNICs in the same NSG.
`sourceType`	`string`	Type of source for the rule. Required if `direction` = `INGRESS`. * `CIDR_BLOCK`: If the rule's `source` is an IP address range in CIDR notation. * `SERVICE_CIDR_BLOCK`: If the rule's `source` is the `cidrBlock` value for a [Service](#/en/iaas/latest/Service/) (the rule is for traffic coming from a particular `Service` through a service gateway). * `NETWORK_SECURITY_GROUP`: If the rule's `source` is the [OCID](/iaas/Content/General/Concepts/identifiers.htm) of a [NetworkSecurityGroup](#/en/iaas/latest/NetworkSecurityGroup/). (CIDR_BLOCK, SERVICE_CIDR_BLOCK, NETWORK_SECURITY_GROUP)
`tcpOptions`	`object`	Optional and valid only for TCP. Use to specify particular destination ports for TCP rules. If you specify TCP as the protocol but omit this object, then all destination ports are allowed.
`timeCreated`	`string (date-time)`	The date and time the security rule was created. Format defined by [RFC3339](https://tools.ietf.org/html/rfc3339).
`udpOptions`	`object`	Optional and valid only for UDP. Use to specify particular destination ports for UDP rules. If you specify UDP as the protocol but omit this object, then all destination ports are allowed.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`list`	`select`	`networkSecurityGroupId`, `region`	`direction`, `limit`, `page`, `sortBy`, `sortOrder`	Lists the security rules in the specified network security group.<br />
`update`	`update`	`networkSecurityGroupId`, `region`		Updates one or more security rules in the specified network security group.<br />

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`networkSecurityGroupId`	`string`	The [OCID](/iaas/Content/General/Concepts/identifiers.htm) of the network security group.
`region`	`string`	OCI region identifier (e.g. us-ashburn-1, ap-sydney-1); resolves from OCI_REGION when not supplied in the query. (default: us-ashburn-1, x-stackQL-envVar: OCI_REGION)
`direction`	`string`	Direction of the security rule. Set to `EGRESS` for rules that allow outbound IP packets, or `INGRESS` for rules that allow inbound IP packets.
`limit`	`integer`	For list pagination. The maximum number of results per page, or items to return in a paginated "List" call. For important details about how pagination works, see [List Pagination](/iaas/Content/API/Concepts/usingapi.htm#nine). Example: `50`
`page`	`string`	For list pagination. The value of the `opc-next-page` response header from the previous "List" call. For important details about how pagination works, see [List Pagination](/iaas/Content/API/Concepts/usingapi.htm#nine).
`sortBy`	`string`	The field to sort by.
`sortOrder`	`string`	The sort order to use, either ascending (`ASC`) or descending (`DESC`). The DISPLAYNAME sort order is case sensitive.

`SELECT` examples

list

Lists the security rules in the specified network security group.

SELECT
id,
description,
destination,
destinationType,
direction,
icmpOptions,
isStateless,
isValid,
protocol,
source,
sourceType,
tcpOptions,
timeCreated,
udpOptions
FROM oci.network.network_security_group_security_rules
WHERE networkSecurityGroupId = '{{ networkSecurityGroupId }}' -- required
AND region = '{{ region }}' -- required
AND direction = '{{ direction }}'
AND limit = '{{ limit }}'
AND page = '{{ page }}'
AND sortBy = '{{ sortBy }}'
AND sortOrder = '{{ sortOrder }}'
;

`UPDATE` examples

update

Updates one or more security rules in the specified network security group.

UPDATE oci.network.network_security_group_security_rules
SET 
securityRules = '{{ securityRules }}'
WHERE 
networkSecurityGroupId = '{{ networkSecurityGroupId }}' --required
AND region = '{{ region }}' --required
RETURNING
securityRules;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

UPDATE examples​