Security group rules
A rule allows one kind of traffic for every instance in its group, at once. Instances in a group with no matching rule get no inbound traffic.
Allow your own instances by group (remote_group_id), not by address: a rule on the database group that allows 5432 from the app group lets in only the app’s instances, wherever their addresses change. Keep 0.0.0.0/0 (the whole internet) for public services.
Add a rule
POST /v1/security_groups/rules/createThe body is one rule inside security_group_rule:
| Field | Type | Required | Description |
|---|---|---|---|
| security_group_id | string | yes | The group the rule goes in |
| direction | string | yes | ingress (traffic coming in) or egress (traffic going out) |
| protocol | string | no | tcp, udp, icmp, icmpv6 or any (the default: every protocol) |
| port_range_min | number | no | First port, 1 to 65535. Needs tcp or udp and port_range_max |
| port_range_max | number | no | Last port, not below port_range_min. The same number for one port |
| remote_ip_prefix | string | no | The other side as an address range (203.0.113.0/24) or one address. Left out with no remote_group_id: anywhere |
| remote_group_id | string | no | The other side as another of your security groups. Not together with remote_ip_prefix |
| ethertype | string | no | IPv4 or IPv6. Taken from the address range when left out |
| description | string | no | A note on the rule, up to 255 characters |
cURL
curl -X POST https://api.redu.cloud/v1/security_groups/rules/create \
-H "x-api-key: YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"security_group_rule": {
"security_group_id": "6f1d2c3b-4a5e-4f60-8b71-9c0d1e2f3a4b",
"direction": "ingress",
"protocol": "tcp",
"port_range_min": 5432,
"port_range_max": 5432,
"remote_group_id": "1c62ad45-128d-45d9-b164-6cefdf5e8739",
"description": "Postgres from the app"
}
}'201 Created answers once the rule exists, with the rule as stored (the rule fields of the list).
List rules
GET /v1/security_groups/rules/listEvery rule in your account, as an array of rules. List security groups returns the same rules grouped by security group.
Delete a rule
DELETE /v1/security_groups/rules/delete/{id}Answers once the rule is gone: { "deleted": true, "id": "..." }. Instances in the group lose the rule at once.
When an instance gets a public URL, redu opens that port to any address in every group the instance has at that moment, and closes it when the URL is removed. Deleting that rule yourself takes the URL offline.
Errors
Errors use the API’s standard shape, { "error": { "code", "message", "hint"? } }.
| Status | Code | When |
|---|---|---|
| 400 | validation_error | A field is malformed; details names it (a port range without tcp or udp, an address range that is not one, both remote_ip_prefix and remote_group_id, an IPv6 range with IPv4) |
| 400 | invalid_request | The rule was refused as written |
| 404 | not_found | No such security group or rule in your account |
| 409 | rule_exists | That rule is already in the group: nothing was added |
| 409 | quota_exceeded | Your account is at its limit of security group rules |