SecurityGroup | Praxis resources

Resource definition

What this resource looks like

This is the CUE shape a Praxis template uses to declare a SecurityGroup. The resource key is local to the template; metadata.name supplies its stable Praxis identity.

resources: web: {
  apiVersion: "praxis.io/alpha"
  kind: "SecurityGroup"
  metadata: {name: "web", labels: {}}
  spec: {
    groupName: "web"
    description: "HTTPS ingress"
    vpcId: "${resources.network.outputs.vpcId}"
    ingressRules: [{
      protocol: "tcp"
      fromPort: 443
      toPort: 443
      cidrBlock: "0.0.0.0/0"
    }]
    tags: environment: "prod"
  }
}

Complete examples in the repository

ec2 bastion host ec2 web fleet stacks data source vpc stacks ec2 web stack stacks end to end stacks network locked app stacks saas platform stacks three tier app

Desired state

Configuration

The spec block accepts 6 fields. 4 are required by the schema; fields with defaults can be omitted.

groupNameRequired

Group Name.

string

String

descriptionRequired

Description.

string

String

vpcIdRequired

Vpc ID.

string

String

ingressRulesOptional

Ingress Rules.

[...#Rule] | *[]

ListDefault []

egressRulesOptional

Egress Rules.

[...#Rule] | *[{protocol: "-1", fromPort: 0, toPort: 0, cidrBlock: "0.0.0.0/0"}]

Object listDefault [{protocol: "-1", fromPort: 0, toPort: 0, cidrBlock…

tagsRequired

Tags.

[string]: string

Map

Observed values

Outputs

Praxis records these values after observation. A dependent resource can read one with ${resources.<name>.outputs.<field>}.

groupIdString

groupArnString

vpcIdString

Read without ownership

Data-source lookup

A data block reads an existing SecurityGroup and exposes its outputs without storing lifecycle state. The generic filter surface accepts id, name, and tag; supported combinations depend on the AWS identity used by this resource.

data: existing: {
  kind: "SecurityGroup"
  filter: {
    name: "replace-with-provider-name"
  }
}

Documented selectorsidnametag

Understand data sources and filters →

Adopt existing infrastructure

Import

Import persists Praxis state for an existing AWS resource. For this kind, supply: Security group ID, for example sg-0123456789abcdef0. The example starts in observed mode so Praxis reports drift without correcting it.

praxis import SecurityGroup \
  --id <provider-identifier> \
  --account production \
  --observe

Choose managed or observed ownership →

Canonical contract

Complete CUE schema

The field guide above is derived from this definition. The schema remains the source of truth for accepted values, defaults, validation constraints, and outputs in the current alpha revision.

Show the complete schema

package ec2

#SecurityGroup: {
	apiVersion: "praxis.io/alpha"
	kind:       "SecurityGroup"

	metadata: {
		name: string & =~"^[a-zA-Z0-9 _\\-]{1,255}$"
		labels: [string]: string
	}

	spec: {
		groupName:   string
		description: string
		vpcId:       string
		ingressRules: [...#Rule] | *[]
		egressRules: [...#Rule] | *[{protocol: "-1", fromPort: 0, toPort: 0, cidrBlock: "0.0.0.0/0"}]
		tags: [string]: string
	}

	// Outputs are populated by the driver after provisioning.
	// Optional at template time — the driver fills them after Provision.
	outputs?: {
		groupId:  string
		groupArn: string
		vpcId:    string
	}
}

#Rule: {
	protocol:  "tcp" | "udp" | "icmp" | "-1"
	fromPort:  int & >=0 & <=65535
	toPort:    int & >=fromPort & <=65535
	cidrBlock: string & =~"^([0-9]{1,3}\\.){3}[0-9]{1,3}/[0-9]{1,2}$"
}

View this schema on GitHub →