如何使用boto3为单个安全组添加多个IP地址？

一、用boto3（原生AWS SDK）实现 #

你提到的IpPermissions模式完全可以用来批量添加安全组规则，不管是单个端口开放给多个IP，还是同时配置多个端口的规则都支持。

示例1：给443端口添加多个IP #

import boto3

# 初始化EC2客户端
ec2_client = boto3.client('ec2')

# 定义批量规则：443端口开放给多个指定IP
ip_permissions = [
    {
        'IpProtocol': 'tcp',
        'FromPort': 443,
        'ToPort': 443,
        'IpRanges': [
            {'CidrIp': '192.168.1.1/32', 'Description': 'IP1 access 443'},
            {'CidrIp': '10.0.0.1/32', 'Description': 'IP2 access 443'},
            {'CidrIp': '172.16.0.1/32', 'Description': 'IP3 access 443'}
        ]
    }
]

# 调用API添加规则，替换为你的安全组ID
ec2_client.authorize_security_group_ingress(
    GroupId='sg-xxxxxxxxxxxxxxxxx',
    IpPermissions=ip_permissions
)

示例2：同时添加多端口规则（每个端口对应不同IP范围） #

ip_permissions = [
    {
        'IpProtocol': 'tcp',
        'FromPort': 80,
        'ToPort': 80,
        'IpRanges': [
            {'CidrIp': '192.168.1.0/24', 'Description': 'Office subnet access 80'},
            {'CidrIp': '10.0.0.0/24', 'Description': 'VPC subnet access 80'}
        ]
    },
    {
        'IpProtocol': 'tcp',
        'FromPort': 22,
        'ToPort': 22,
        'IpRanges': [
            {'CidrIp': '192.168.1.10/32', 'Description': 'Admin IP access 22'}
        ]
    },
    {
        'IpProtocol': 'tcp',
        'FromPort': 443,
        'ToPort': 443,
        'IpRanges': [{'CidrIp': '0.0.0.0/0', 'Description': 'Public access 443'}]
    }
]

ec2_client.authorize_security_group_ingress(
    GroupId='sg-xxxxxxxxxxxxxxxxx',
    IpPermissions=ip_permissions
)

二、用AWS CDK（你当前代码的环境）实现 #

你当前的代码是AWS CDK的写法（通过ec2.SecurityGroupIngress资源添加规则），批量添加规则有两种简洁的实现方式：

方式1：循环创建多个SecurityGroupIngress资源 #

from aws_cdk import aws_ec2 as ec2
from aws_cdk import Stack, Ref
from constructs import Construct

class YourStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        
        # 假设已定义目标安全组
        self.public_alb_sg = ec2.SecurityGroup(self, "PublicALBSG", 
                                               vpc=your_vpc,
                                               allow_all_outbound=True)
        
        # 要添加的IP列表（CIDR + 描述）
        allowed_ips = [
            ("192.168.1.1/32", "IP1 access 443"),
            ("10.0.0.1/32", "IP2 access 443"),
            ("172.16.0.1/32", "IP3 access 443")
        ]
        
        # 循环生成Ingress规则
        for idx, (cidr, desc) in enumerate(allowed_ips):
            ec2.SecurityGroupIngress(
                self, f"443Access-{idx}",
                group_id=Ref(self.public_alb_sg),
                cidr_ip=cidr,
                description=desc,
                ip_protocol="tcp",
                from_port=443,
                to_port=443
            )

方式2：使用安全组内置的add_ingress_rule方法批量添加 #

这种方式无需手动创建SecurityGroupIngress资源，更符合CDK的最佳实践：

from aws_cdk import aws_ec2 as ec2
from constructs import Construct

class YourStack(Stack):
    def __init__(self, scope: Construct, construct_id: str, **kwargs) -> None:
        super().__init__(scope, construct_id, **kwargs)
        
        # 创建或引用目标安全组
        self.public_alb_sg = ec2.SecurityGroup(self, "PublicALBSG", 
                                               vpc=your_vpc,
                                               allow_all_outbound=True)
        
        # 批量添加443端口的IP规则
        allowed_ips = [
            ec2.Peer.ipv4("192.168.1.1/32"),
            ec2.Peer.ipv4("10.0.0.1/32"),
            ec2.Peer.ipv4("172.16.0.1/32")
        ]
        
        for peer in allowed_ips:
            self.public_alb_sg.add_ingress_rule(
                peer=peer,
                connection=ec2.Port.tcp(443),
                description="443 access"
            )
        
        # 额外添加其他端口规则
        self.public_alb_sg.add_ingress_rule(
            peer=ec2.Peer.ipv4("192.168.1.0/24"),
            connection=ec2.Port.tcp(80),
            description="Office subnet access 80"
        )

内容的提问来源于stack exchange，提问作者Isuru Rupasinghe