What output format does this generate?

It generates a plain JSON object with `SecurityGroupIngress` and/or `SecurityGroupEgress` arrays, in the same shape CloudFormation's `AWS::EC2::SecurityGroup` resource expects for those properties (IpProtocol, FromPort, ToPort, CidrIp per rule).

How do I specify a port range instead of a single port?

Enter it as `fromPort-toPort`, for example `8000-9000`. A single value like `443` is treated as both FromPort and ToPort for that one port.

What do the quick-add preset buttons do?

Each preset (SSH, HTTP, HTTPS, PostgreSQL, MySQL) adds a pre-filled ingress rule row with that service's standard protocol and port, for example SSH adds a tcp/22 ingress rule, so you don't have to remember or type the standard port numbers.

Should ingress rules really use 0.0.0.0/0?

For SSH, database ports, and most administrative access, no, 0.0.0.0/0 (any IPv4 address) exposes the port to the entire internet. It's appropriate for HTTP/HTTPS on a public web server, but SSH and database ports should generally be scoped to a specific office IP, VPN range, or bastion host CIDR instead.

AWS Security Group Generator - Ingress & Egress Rules JSON

Overview

Introduction

Security group rules are simple individually, protocol, port, source, direction, but a real instance usually needs several at once, and typing the same CIDR notation and CloudFormation property names repeatedly invites typos.

This tool lets you build up a list of ingress and egress rules with quick presets for the most common ports, then exports them as ready-to-use CloudFormation-shaped JSON.

What Is AWS Security Group Generator?

A generator for EC2 security group rules: each row specifies a direction (ingress or egress), a protocol (tcp/udp/icmp), a port or port range, and a source/destination CIDR block.

Preset buttons quick-add common ingress rules: SSH (tcp/22), HTTP (tcp/80), HTTPS (tcp/443), PostgreSQL (tcp/5432), and MySQL (tcp/3306), each with 0.0.0.0/0 as a starting CIDR you can then narrow.

How AWS Security Group Generator Works

Each rule row is validated for a well-formed CIDR block and a valid port or port range, then mapped to the CloudFormation property shape: `IpProtocol`, `FromPort`, `ToPort`, `CidrIp`.

Rules are split into `SecurityGroupIngress` and `SecurityGroupEgress` arrays based on each row's direction, and only the arrays that have at least one rule are included in the output.

When To Use AWS Security Group Generator

Use it when defining a new security group's rules for a CloudFormation template, and you want the JSON shape guaranteed correct without hand-typing FromPort/ToPort for a range.

It's also useful as a quick reference for standard port numbers when setting up ingress rules through the console or CLI.

Often used alongside EC2 User Data Generator and CloudFormation Template Generator.

Features

Advantages

One-click presets for the five most commonly opened ports save you from looking up or mistyping standard port numbers.
Validates CIDR notation and port ranges before generating output, catching malformed entries early.
Separates ingress and egress cleanly, matching how CloudFormation's SecurityGroup resource expects them.

Limitations

Only supports CIDR-based sources/destinations, not security-group-to-security-group references (`SourceSecurityGroupId`), which many real-world setups also use.
ICMP rules are simplified: an empty or `*` port is treated as "all ICMP types" (FromPort/ToPort of -1), rather than letting you pick a specific ICMP type/code pair.

Examples

SSH restricted to an office CIDR plus public HTTPS

Input

Rule 1: ingress, tcp, 22, 203.0.113.0/24. Rule 2: ingress, tcp, 443, 0.0.0.0/0

Output

{
  "SecurityGroupIngress": [
    {
      "IpProtocol": "tcp",
      "FromPort": 22,
      "ToPort": 22,
      "CidrIp": "203.0.113.0/24"
    },
    {
      "IpProtocol": "tcp",
      "FromPort": 443,
      "ToPort": 443,
      "CidrIp": "0.0.0.0/0"
    }
  ]
}

SSH is scoped to a specific office range while HTTPS remains open to the internet, a common pattern for a public web server with restricted admin access.

Best Practices & Notes

Best Practices

Scope SSH and database ports to a specific CIDR (office, VPN, bastion) rather than 0.0.0.0/0.
Prefer security-group references over broad CIDRs for internal service-to-service traffic when your infrastructure tooling supports it.
Keep egress rules as tight as ingress rules where possible; the default "allow all egress" is convenient but not least-privilege.

Developer Notes

Ports are parsed with two regexes: a single-number form and a `from-to` range form, both bounded to 0-65535 with `fromPort <= toPort` enforced for ranges. ICMP is special-cased so an empty or `*` port produces `FromPort`/`ToPort` of `-1` (AWS's convention for "all ICMP types"), since ICMP doesn't use port numbers the way TCP/UDP do. CIDR blocks are checked with a simple IPv4 `a.b.c.d/n` shape check, not a full validity/range check on each octet.

AWS Security Group Generator Use Cases

Defining a new EC2 instance or Auto Scaling group's security group rules for a CloudFormation template
Quickly drafting a database security group allowing PostgreSQL or MySQL only from an application tier's CIDR
Reviewing/documenting an existing security group's rules in a structured JSON format

Common Mistakes

Opening a database port (5432, 3306) to 0.0.0.0/0 when it should only be reachable from the application tier's private subnet CIDR.
Mixing up FromPort/ToPort order in a range, entering `9000-8000` instead of `8000-9000`, which this tool rejects rather than silently accepting.

Tips

Follow up with the CloudFormation Generator to embed the generated rules directly into a full `AWS::EC2::SecurityGroup` resource block.

AWS Security Group Generator