aws ec2 authorize-security-group-ingress --group-id
aws ec2 authorize-security-group-ingress --group-id <sg> --protocol tcp --port <port> (--cidr <cidr> | --source-group <sg>)
Risk: Careful
What it does
Adds an allow rule to a security group: who may come in, on which port.
When to use it
To open one door, as narrow as you can. Never 22 or 3389 to 0.0.0.0/0.
Example
$ aws ec2 authorize-security-group-ingress --group-id sg-1234567890abcdef0 --protocol tcp --port 22 --cidr 203.0.113.0/24SSH only from one office range.
$ aws ec2 authorize-security-group-ingress --group-id sg-1234567890abcdef0 --protocol tcp --port 80 --source-group sg-1a2b3c4dPort 80 only from servers in another group.
$ aws ec2 create-security-group --group-name MySecurityGroup --description "My security group" --vpc-id vpc-1a2b3c4dMake a new group first. It lets nothing in.
Learn it in: Security groups and NACLs · Official docs