$permission = $group->authorize_incoming(%args)

Add a rule for incoming firewall traffic. Arguments are as follows:

 -protocol        The protocol, either a string (tcp,udp,icmp) or
                   the corresponding protocol number (6, 17, 1).
                   Use -1 to indicate all protocols. (required)
 -port, -ports    The port or port range. When referring to a single
                   port, you may use either the port number or the
                   service name (e.g. "ssh"). For this to work the
                   service name must be located in /etc/services.
                   When specifying a port range, use "start..end" as
                   in "8000..9000". Note that this is a string that
                   contains two dots, and not two numbers separated
                   by the perl range operator. For the icmp protocol,
                   this argument corresponds to the ICMP type number.
                   (required).
 -group, -groups   Security groups to authorize. Instances that belong
                    to the named security groups will be allowed
                    access. You may specify either a single group or
                    a list of groups as an arrayref. The following
                    syntaxes are recognized:
                    "sg-12345"       authorize group with this groupId
                    "12345/my group" authorize group named "my group" 
                                      owned by user 12345
                     "my group"      authorize group named "my group"
                                      owned by yourself
 -source, -source_ip Authorize incoming traffic from an IP address, IP
                      address range, or set of such ranges. IP
                      addresses use the CIDR notation of a.b.c.d/mask,
                      as described in 
                      http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing.
                      Pass an arrayref to simultaneously authorize
                      multiple CIDR ranges.

The result of this call is a VM::EC2::SecurityGroup::IpPermission object corresponding to the rule you defined. Note that the rule is not written to Amazon until you call update().

Here are some examples:

 $sg->authorize_incoming(-protocol  => 'tcp',
                         -port      => 80,
                         -source_ip => ['192.168.2.0/24','192.168.2.1/24'});
 # TCP on ports 22 and 23 from anyone
 $sg->authorize_incoming(-protocol  => 'tcp',
                         -port      => '22..23',
                         -source_ip => '0.0.0.0/0');
 # ICMP on echo (ping) port from anyone
 $sg->authorize_incoming(-protocol  => 'icmp',
                         -port      => -1,
                         -source_ip => '0.0.0.0/0');
 # TCP to port 25 (mail) from instances belonging to
 # the "Mail relay" group belonging to user 12345678.
 $sg->authorize_incoming(-protocol  => 'tcp',
                         -port      => 25,
                         -group     => '12345678/Mail relay');

$permission = $group->authorize_outgoing(%args)

This is identical to authorize_incoming() except that the rule applies to outbound traffic. Only VPC security groups can define outgoing firewall rules.

$permission = $group->revoke_incoming($rule)

$permission = $group->revoke_incoming(%args)

This method revokes an incoming firewall rule. You can call it with a single argument consisting of a VM::EC2::SecurityGroup::IpPermission object in order to revoke that rule. Alternatively, when called with the named arguments listed for authorize_incoming(), it will attempt to match an existing rule to the provided arguments and queue it for deletion.

Here is an example of revoking all rules that allow ssh (port 22) access:

 @ssh_rules = grep {$_->fromPort == 22} $group->ipPermissions;
 $group->revoke_incoming($_) foreach @ssh_rules;
 $group->update();

$boolean = $group->update()

This method will write all queued rule authorizations and revocations to Amazon, and return a true value if successful. The method will return false if any of the rule updates failed. You can examine the VM::EC2 object's error_str() method to determine what went wrong, and check the group object's ipPermissions() method to see what firewall rules are currently defined.

$boolean = $group->write()

An alias for update()

$group->refresh()

This method refreshes the group information from Amazon. It is called automatically by update().