セキュリティグループの状態をテキストで取得するには、下記のように取得するのが一番良さそうです。
require_once("../../aws/php/sdk.class.php");
define("AWS_KEY" , "AAAAAAAAAAAAAAAAAAAA");
define("AWS_SECRET_KEY", "SSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSSS");
$ec2 = new AmazonEC2();
$ec2->set_region(AmazonEC2::REGION_APAC_NE1);
$response = $ec2->describe_security_groups();
print($response->body->securityGroupInfo->to_yaml());
exit(0);
結果は下記のように、YAML形式となります。
item:
-
ownerId: '000000000000'
groupId: sg-00000000
groupName: default
groupDescription: 'default group'
ipPermissions:
item:
- { ipProtocol: tcp, fromPort: '0', toPort: '65535', groups: { item: { userId: '000000000000', groupId: sg-00000000, groupName: default } }, ipRanges: { } }
- { ipProtocol: udp, fromPort: '0', toPort: '65535', groups: { item: { userId: '000000000000', groupId: sg-00000000, groupName: default } }, ipRanges: { } }
- { ipProtocol: icmp, fromPort: '-1', toPort: '-1', groups: { item: { userId: '000000000000', groupId: sg-00000000, groupName: default } }, ipRanges: { } }
- { ipProtocol: tcp, fromPort: '80', toPort: '80', groups: { }, ipRanges: { item: { cidrIp: 0.0.0.0/0 } } }
- { ipProtocol: tcp, fromPort: '22', toPort: '22', groups: { }, ipRanges: { item: [{ cidrIp: xxx.xxx.xxx.xxx/32 }, { cidrIp: xxx.xxx.xxx.xxx/32 }] } }
- { ipProtocol: tcp, fromPort: '3389', toPort: '3389', groups: { }, ipRanges: { item: { cidrIp: xxx.xxx.xxx.xxx/32 } } }
ipPermissionsEgress: { }
-
ownerId: '000000000000'
groupId: sg-00000000
groupName: xxx-default
groupDescription: xxx-default
ipPermissions:
item:
ipProtocol: tcp
fromPort: '22'
toPort: '22'
groups: { }
ipRanges: { item: { cidrIp: xxx.xxx.xxx.xxx/32 } }
ipPermissionsEgress: { }
-
ownerId: '000000000000'
groupId: sg-00000000
groupName: xxx-web
groupDescription: xxx-web
ipPermissions:
item:
ipProtocol: tcp
fromPort: '80'
toPort: '80'
groups: { }
ipRanges: { item: { cidrIp: 0.0.0.0/0 } }
ipPermissionsEgress: { }
-
ownerId: '000000000000'
groupId: sg-00000000
groupName: default
groupDescription: 'default VPC security group'
vpcId: vpc-00000000
ipPermissions:
item:
- { ipProtocol: '-1', groups: { }, ipRanges: { item: { cidrIp: xxx.xxx.xxx.xxx/24 } } }
- { ipProtocol: tcp, fromPort: '22', toPort: '22', groups: { }, ipRanges: { item: { cidrIp: xxx.xxx.xxx.xxx/32 } } }
- { ipProtocol: '-1', groups: { item: { userId: '000000000000', groupId: sg-00000000 } }, ipRanges: { } }
ipPermissionsEgress:
item:
ipProtocol: '-1'
groups: { }
ipRanges: { item: { cidrIp: 0.0.0.0/0 } }
そして、これを毎日出力してSVNなどにコミットしておくことで、変更を追いかけることができると思います。
