-
Notifications
You must be signed in to change notification settings - Fork 17
/
ACS-VPC-BulkyDeleteForwardEntry.yml
127 lines (127 loc) · 3.54 KB
/
ACS-VPC-BulkyDeleteForwardEntry.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
FormatVersion: OOS-2019-06-01
Description:
en: Del the specified risk ports mapped on dnat table
zh-cn: 删除NAT网关上DNAT映射的指定风险端口
name-en: ACS-VPC-BulkyDeleteForwardEntry
name-zh-cn: 删除NAT网关上DNAT映射的指定风险端口
categories:
- security
Parameters:
regionId:
Label:
en: RegionId
zh-cn: 地域ID
Type: String
AssociationProperty: RegionId
Default: '{{ ACS::RegionId }}'
instanceId:
Label:
en: The id of natgateway instance.
zh-cn: NAT网关实例ID
Type: String
port:
Label:
en: The risk port
zh-cn: 风险端口(后端端口)
Type: List
rateControl:
Label:
en: RateControl
zh-cn: 任务执行的并发比率
Type: Json
AssociationProperty: RateControl
Default:
Mode: Concurrency
MaxErrors: 0
Concurrency: 10
OOSAssumeRole:
Label:
en: OOSAssumeRole
zh-cn: OOS扮演的RAM角色
Type: String
Default: ''
RamRole: '{{ OOSAssumeRole }}'
Tasks:
- Name: describeNatGateways
Action: ACS::ExecuteAPI
Description:
en: Query dnat table id of the natgateway instance
zh-cn: 查询NAT网关实例的DNAT表ID
Properties:
Service: VPC
API: DescribeNatGateways
Parameters:
RegionId: '{{ regionId }}'
NatGatewayId: '{{ instanceId }}'
Outputs:
ForwardTableIds:
Type: String
ValueSelector: .NatGateways.NatGateway[].ForwardTableIds.ForwardTableId[]
- Name: describeForwardTableEntries
Action: ACS::ExecuteAPI
Description:
en: Query the dnat entry id which matches the risk ports
zh-cn: 查询命中风险端口的DNAT条目的ID
Properties:
Service: VPC
API: DescribeForwardTableEntries
Parameters:
RegionId: '{{ regionId }}'
ForwardTableId: '{{ describeNatGateways.ForwardTableIds }}'
InternalPort: '{{ ACS::TaskLoopItem }}'
Loop:
RateControl: '{{ rateControl }}'
Items: '{{ port }}'
Outputs:
ForwardEntryId-all:
AggregateType: Fn::ListJoin
AggregateField: ForwardEntryId
Outputs:
ForwardEntryId:
Type: Json
ValueSelector: .ForwardTableEntries.ForwardTableEntry[].ForwardEntryId
- Name: deleteForwardEntry
Action: ACS::ExecuteAPI
Description:
en: Del the specified risk ports mapped on dnat table
zh-cn: 删除NAT网关上DNAT映射的指定风险端口
Properties:
Service: VPC
API: DeleteForwardEntry
Parameters:
RegionId: '{{ regionId }}'
ForwardEntryId: '{{ ACS::TaskLoopItem }}'
ForwardTableId: '{{ describeNatGateways.ForwardTableIds }}'
Loop:
Items:
'Fn::Jq':
- All
- 'foreach .[] as $item ([[],[]]; if $item == null then [[],.[0]] else [(.[0] + [$item]),[]] end; if $item == null then .[1] else empty end) | .[]'
- '{{ describeForwardTableEntries.ForwardEntryId-all }}'
RateControl:
Mode: Concurrency
MaxErrors: 0
Concurrency: 1
Metadata:
ALIYUN::OOS::Interface:
ParameterGroups:
- Parameters:
- port
Label:
default:
zh-cn: 设置参数
en: Configure Parameters
- Parameters:
- regionId
- instanceId
Label:
default:
zh-cn: 选择实例
en: Select Instances
- Parameters:
- rateControl
- OOSAssumeRole
Label:
default:
zh-cn: 高级选项
en: Control Options