# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import warnings
import pulumi
import pulumi.runtime
from typing import Any, Dict, List, Mapping, Optional, Tuple, Union
from .. import _utilities, _tables

__all__ = ['SecurityGroupRule']


class SecurityGroupRule(pulumi.CustomResource):
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 cidr_blocks: Optional[pulumi.Input[List[pulumi.Input[str]]]] = None,
                 description: Optional[pulumi.Input[str]] = None,
                 from_port: Optional[pulumi.Input[float]] = None,
                 ipv6_cidr_blocks: Optional[pulumi.Input[List[pulumi.Input[str]]]] = None,
                 prefix_list_ids: Optional[pulumi.Input[List[pulumi.Input[str]]]] = None,
                 protocol: Optional[pulumi.Input[str]] = None,
                 security_group_id: Optional[pulumi.Input[str]] = None,
                 self: Optional[pulumi.Input[bool]] = None,
                 source_security_group_id: Optional[pulumi.Input[str]] = None,
                 to_port: Optional[pulumi.Input[float]] = None,
                 type: Optional[pulumi.Input[str]] = None,
                 __props__=None,
                 __name__=None,
                 __opts__=None):
        """
        Provides a security group rule resource. Represents a single `ingress` or
        `egress` group rule, which can be added to external Security Groups.

        > **NOTE on Security Groups and Security Group Rules:** This provider currently
        provides both a standalone Security Group Rule resource (a single `ingress` or
        `egress` rule), and a Security Group resource with `ingress` and `egress` rules
        defined in-line. At this time you cannot use a Security Group with in-line rules
        in conjunction with any Security Group Rule resources. Doing so will cause
        a conflict of rule settings and will overwrite rules.

        > **NOTE:** Setting `protocol = "all"` or `protocol = -1` with `from_port` and `to_port` will result in the EC2 API creating a security group rule with all ports open. This API behavior cannot be controlled by this provider and may generate warnings in the future.

        > **NOTE:** Referencing Security Groups across VPC peering has certain restrictions. More information is available in the [VPC Peering User Guide](https://docs.aws.amazon.com/vpc/latest/peering/vpc-peering-security-groups.html).

        ## Example Usage

        Basic usage

        ```python
        import pulumi
        import pulumi_aws as aws

        example = aws.ec2.SecurityGroupRule("example",
            type="ingress",
            from_port=0,
            to_port=65535,
            protocol="tcp",
            cidr_blocks=[aws_vpc["example"]["cidr_block"]],
            security_group_id="sg-123456")
        ```
        ## Usage with prefix list IDs

        Prefix list IDs are manged by AWS internally. Prefix list IDs
        are associated with a prefix list name, or service name, that is linked to a specific region.
        Prefix list IDs are exported on VPC Endpoints, so you can use this format:

        ```python
        import pulumi
        import pulumi_aws as aws

        # ...
        my_endpoint = aws.ec2.VpcEndpoint("myEndpoint")
        # ...
        allow_all = aws.ec2.SecurityGroupRule("allowAll",
            type="egress",
            to_port=0,
            protocol="-1",
            prefix_list_ids=[my_endpoint.prefix_list_id],
            from_port=0,
            security_group_id="sg-123456")
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[List[pulumi.Input[str]]] cidr_blocks: List of CIDR blocks. Cannot be specified with `source_security_group_id`.
        :param pulumi.Input[str] description: Description of the rule.
        :param pulumi.Input[float] from_port: The start port (or ICMP type number if protocol is "icmp" or "icmpv6").
        :param pulumi.Input[List[pulumi.Input[str]]] ipv6_cidr_blocks: List of IPv6 CIDR blocks.
        :param pulumi.Input[List[pulumi.Input[str]]] prefix_list_ids: List of prefix list IDs (for allowing access to VPC endpoints).
               Only valid with `egress`.
        :param pulumi.Input[str] protocol: The protocol. If not icmp, icmpv6, tcp, udp, or all use the [protocol number](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
        :param pulumi.Input[str] security_group_id: The security group to apply this rule to.
        :param pulumi.Input[bool] self: If true, the security group itself will be added as
               a source to this ingress rule. Cannot be specified with `source_security_group_id`.
        :param pulumi.Input[str] source_security_group_id: The security group id to allow access to/from,
               depending on the `type`. Cannot be specified with `cidr_blocks` and `self`.
        :param pulumi.Input[float] to_port: The end port (or ICMP code if protocol is "icmp").
        :param pulumi.Input[str] type: The type of rule being created. Valid options are `ingress` (inbound)
               or `egress` (outbound).
        """
        if __name__ is not None:
            warnings.warn("explicit use of __name__ is deprecated", DeprecationWarning)
            resource_name = __name__
        if __opts__ is not None:
            warnings.warn("explicit use of __opts__ is deprecated, use 'opts' instead", DeprecationWarning)
            opts = __opts__
        if opts is None:
            opts = pulumi.ResourceOptions()
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.version is None:
            opts.version = _utilities.get_version()
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = dict()

            __props__['cidr_blocks'] = cidr_blocks
            __props__['description'] = description
            if from_port is None:
                raise TypeError("Missing required property 'from_port'")
            __props__['from_port'] = from_port
            __props__['ipv6_cidr_blocks'] = ipv6_cidr_blocks
            __props__['prefix_list_ids'] = prefix_list_ids
            if protocol is None:
                raise TypeError("Missing required property 'protocol'")
            __props__['protocol'] = protocol
            if security_group_id is None:
                raise TypeError("Missing required property 'security_group_id'")
            __props__['security_group_id'] = security_group_id
            __props__['self'] = self
            __props__['source_security_group_id'] = source_security_group_id
            if to_port is None:
                raise TypeError("Missing required property 'to_port'")
            __props__['to_port'] = to_port
            if type is None:
                raise TypeError("Missing required property 'type'")
            __props__['type'] = type
        super(SecurityGroupRule, __self__).__init__(
            'aws:ec2/securityGroupRule:SecurityGroupRule',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            cidr_blocks: Optional[pulumi.Input[List[pulumi.Input[str]]]] = None,
            description: Optional[pulumi.Input[str]] = None,
            from_port: Optional[pulumi.Input[float]] = None,
            ipv6_cidr_blocks: Optional[pulumi.Input[List[pulumi.Input[str]]]] = None,
            prefix_list_ids: Optional[pulumi.Input[List[pulumi.Input[str]]]] = None,
            protocol: Optional[pulumi.Input[str]] = None,
            security_group_id: Optional[pulumi.Input[str]] = None,
            self: Optional[pulumi.Input[bool]] = None,
            source_security_group_id: Optional[pulumi.Input[str]] = None,
            to_port: Optional[pulumi.Input[float]] = None,
            type: Optional[pulumi.Input[str]] = None) -> 'SecurityGroupRule':
        """
        Get an existing SecurityGroupRule resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[List[pulumi.Input[str]]] cidr_blocks: List of CIDR blocks. Cannot be specified with `source_security_group_id`.
        :param pulumi.Input[str] description: Description of the rule.
        :param pulumi.Input[float] from_port: The start port (or ICMP type number if protocol is "icmp" or "icmpv6").
        :param pulumi.Input[List[pulumi.Input[str]]] ipv6_cidr_blocks: List of IPv6 CIDR blocks.
        :param pulumi.Input[List[pulumi.Input[str]]] prefix_list_ids: List of prefix list IDs (for allowing access to VPC endpoints).
               Only valid with `egress`.
        :param pulumi.Input[str] protocol: The protocol. If not icmp, icmpv6, tcp, udp, or all use the [protocol number](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
        :param pulumi.Input[str] security_group_id: The security group to apply this rule to.
        :param pulumi.Input[bool] self: If true, the security group itself will be added as
               a source to this ingress rule. Cannot be specified with `source_security_group_id`.
        :param pulumi.Input[str] source_security_group_id: The security group id to allow access to/from,
               depending on the `type`. Cannot be specified with `cidr_blocks` and `self`.
        :param pulumi.Input[float] to_port: The end port (or ICMP code if protocol is "icmp").
        :param pulumi.Input[str] type: The type of rule being created. Valid options are `ingress` (inbound)
               or `egress` (outbound).
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = dict()

        __props__["cidr_blocks"] = cidr_blocks
        __props__["description"] = description
        __props__["from_port"] = from_port
        __props__["ipv6_cidr_blocks"] = ipv6_cidr_blocks
        __props__["prefix_list_ids"] = prefix_list_ids
        __props__["protocol"] = protocol
        __props__["security_group_id"] = security_group_id
        __props__["self"] = self
        __props__["source_security_group_id"] = source_security_group_id
        __props__["to_port"] = to_port
        __props__["type"] = type
        return SecurityGroupRule(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter(name="cidrBlocks")
    def cidr_blocks(self) -> pulumi.Output[Optional[List[str]]]:
        """
        List of CIDR blocks. Cannot be specified with `source_security_group_id`.
        """
        return pulumi.get(self, "cidr_blocks")

    @property
    @pulumi.getter
    def description(self) -> pulumi.Output[Optional[str]]:
        """
        Description of the rule.
        """
        return pulumi.get(self, "description")

    @property
    @pulumi.getter(name="fromPort")
    def from_port(self) -> pulumi.Output[float]:
        """
        The start port (or ICMP type number if protocol is "icmp" or "icmpv6").
        """
        return pulumi.get(self, "from_port")

    @property
    @pulumi.getter(name="ipv6CidrBlocks")
    def ipv6_cidr_blocks(self) -> pulumi.Output[Optional[List[str]]]:
        """
        List of IPv6 CIDR blocks.
        """
        return pulumi.get(self, "ipv6_cidr_blocks")

    @property
    @pulumi.getter(name="prefixListIds")
    def prefix_list_ids(self) -> pulumi.Output[Optional[List[str]]]:
        """
        List of prefix list IDs (for allowing access to VPC endpoints).
        Only valid with `egress`.
        """
        return pulumi.get(self, "prefix_list_ids")

    @property
    @pulumi.getter
    def protocol(self) -> pulumi.Output[str]:
        """
        The protocol. If not icmp, icmpv6, tcp, udp, or all use the [protocol number](https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml)
        """
        return pulumi.get(self, "protocol")

    @property
    @pulumi.getter(name="securityGroupId")
    def security_group_id(self) -> pulumi.Output[str]:
        """
        The security group to apply this rule to.
        """
        return pulumi.get(self, "security_group_id")

    @property
    @pulumi.getter
    def self(self) -> pulumi.Output[Optional[bool]]:
        """
        If true, the security group itself will be added as
        a source to this ingress rule. Cannot be specified with `source_security_group_id`.
        """
        return pulumi.get(self, "self")

    @property
    @pulumi.getter(name="sourceSecurityGroupId")
    def source_security_group_id(self) -> pulumi.Output[str]:
        """
        The security group id to allow access to/from,
        depending on the `type`. Cannot be specified with `cidr_blocks` and `self`.
        """
        return pulumi.get(self, "source_security_group_id")

    @property
    @pulumi.getter(name="toPort")
    def to_port(self) -> pulumi.Output[float]:
        """
        The end port (or ICMP code if protocol is "icmp").
        """
        return pulumi.get(self, "to_port")

    @property
    @pulumi.getter
    def type(self) -> pulumi.Output[str]:
        """
        The type of rule being created. Valid options are `ingress` (inbound)
        or `egress` (outbound).
        """
        return pulumi.get(self, "type")

    def translate_output_property(self, prop):
        return _tables.CAMEL_TO_SNAKE_CASE_TABLE.get(prop) or prop

    def translate_input_property(self, prop):
        return _tables.SNAKE_TO_CAMEL_CASE_TABLE.get(prop) or prop

