published on Friday, Feb 20, 2026 by stackitcloud
published on Friday, Feb 20, 2026 by stackitcloud
Security group rule resource schema. Must have a region specified in the provider configuration.
Example Usage
resource "stackit_security_group_rule" "example" {
project_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
security_group_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
direction = "ingress"
icmp_parameters = {
code = 0
type = 8
}
protocol = {
name = "icmp"
}
}
# Only use the import statement, if you want to import an existing security group rule
# Note: There will be a conflict which needs to be resolved manually.
# Attribute "protocol.number" cannot be specified when "protocol.name" is specified.
import {
to = stackit_security_group_rule.import-example
id = "${var.project_id},${var.security_group_id},${var.security_group_rule_id}"
}
Create SecurityGroupRule Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new SecurityGroupRule(name: string, args: SecurityGroupRuleArgs, opts?: CustomResourceOptions);@overload
def SecurityGroupRule(resource_name: str,
args: SecurityGroupRuleArgs,
opts: Optional[ResourceOptions] = None)
@overload
def SecurityGroupRule(resource_name: str,
opts: Optional[ResourceOptions] = None,
direction: Optional[str] = None,
project_id: Optional[str] = None,
security_group_id: Optional[str] = None,
description: Optional[str] = None,
ether_type: Optional[str] = None,
icmp_parameters: Optional[SecurityGroupRuleIcmpParametersArgs] = None,
ip_range: Optional[str] = None,
port_range: Optional[SecurityGroupRulePortRangeArgs] = None,
protocol: Optional[SecurityGroupRuleProtocolArgs] = None,
region: Optional[str] = None,
remote_security_group_id: Optional[str] = None)func NewSecurityGroupRule(ctx *Context, name string, args SecurityGroupRuleArgs, opts ...ResourceOption) (*SecurityGroupRule, error)public SecurityGroupRule(string name, SecurityGroupRuleArgs args, CustomResourceOptions? opts = null)
public SecurityGroupRule(String name, SecurityGroupRuleArgs args)
public SecurityGroupRule(String name, SecurityGroupRuleArgs args, CustomResourceOptions options)
type: stackit:SecurityGroupRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args SecurityGroupRuleArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args SecurityGroupRuleArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args SecurityGroupRuleArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args SecurityGroupRuleArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args SecurityGroupRuleArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var securityGroupRuleResource = new Stackit.SecurityGroupRule("securityGroupRuleResource", new()
{
Direction = "string",
ProjectId = "string",
SecurityGroupId = "string",
Description = "string",
EtherType = "string",
IcmpParameters = new Stackit.Inputs.SecurityGroupRuleIcmpParametersArgs
{
Code = 0,
Type = 0,
},
IpRange = "string",
PortRange = new Stackit.Inputs.SecurityGroupRulePortRangeArgs
{
Max = 0,
Min = 0,
},
Protocol = new Stackit.Inputs.SecurityGroupRuleProtocolArgs
{
Name = "string",
Number = 0,
},
Region = "string",
RemoteSecurityGroupId = "string",
});
example, err := stackit.NewSecurityGroupRule(ctx, "securityGroupRuleResource", &stackit.SecurityGroupRuleArgs{
Direction: pulumi.String("string"),
ProjectId: pulumi.String("string"),
SecurityGroupId: pulumi.String("string"),
Description: pulumi.String("string"),
EtherType: pulumi.String("string"),
IcmpParameters: &stackit.SecurityGroupRuleIcmpParametersArgs{
Code: pulumi.Int(0),
Type: pulumi.Int(0),
},
IpRange: pulumi.String("string"),
PortRange: &stackit.SecurityGroupRulePortRangeArgs{
Max: pulumi.Int(0),
Min: pulumi.Int(0),
},
Protocol: &stackit.SecurityGroupRuleProtocolArgs{
Name: pulumi.String("string"),
Number: pulumi.Int(0),
},
Region: pulumi.String("string"),
RemoteSecurityGroupId: pulumi.String("string"),
})
var securityGroupRuleResource = new SecurityGroupRule("securityGroupRuleResource", SecurityGroupRuleArgs.builder()
.direction("string")
.projectId("string")
.securityGroupId("string")
.description("string")
.etherType("string")
.icmpParameters(SecurityGroupRuleIcmpParametersArgs.builder()
.code(0)
.type(0)
.build())
.ipRange("string")
.portRange(SecurityGroupRulePortRangeArgs.builder()
.max(0)
.min(0)
.build())
.protocol(SecurityGroupRuleProtocolArgs.builder()
.name("string")
.number(0)
.build())
.region("string")
.remoteSecurityGroupId("string")
.build());
security_group_rule_resource = stackit.SecurityGroupRule("securityGroupRuleResource",
direction="string",
project_id="string",
security_group_id="string",
description="string",
ether_type="string",
icmp_parameters={
"code": 0,
"type": 0,
},
ip_range="string",
port_range={
"max": 0,
"min": 0,
},
protocol={
"name": "string",
"number": 0,
},
region="string",
remote_security_group_id="string")
const securityGroupRuleResource = new stackit.SecurityGroupRule("securityGroupRuleResource", {
direction: "string",
projectId: "string",
securityGroupId: "string",
description: "string",
etherType: "string",
icmpParameters: {
code: 0,
type: 0,
},
ipRange: "string",
portRange: {
max: 0,
min: 0,
},
protocol: {
name: "string",
number: 0,
},
region: "string",
remoteSecurityGroupId: "string",
});
type: stackit:SecurityGroupRule
properties:
description: string
direction: string
etherType: string
icmpParameters:
code: 0
type: 0
ipRange: string
portRange:
max: 0
min: 0
projectId: string
protocol:
name: string
number: 0
region: string
remoteSecurityGroupId: string
securityGroupId: string
SecurityGroupRule Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The SecurityGroupRule resource accepts the following input properties:
- Direction string
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - Project
Id string - STACKIT project ID to which the security group rule is associated.
- Security
Group stringId - The security group ID.
- Description string
- The rule description.
- Ether
Type string - The ethertype which the rule should match.
- Icmp
Parameters SecurityGroup Rule Icmp Parameters - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- Ip
Range string - The remote IP range which the rule should match.
- Port
Range SecurityGroup Rule Port Range - The range of ports. This should only be provided if the protocol is not ICMP.
- Protocol
Security
Group Rule Protocol - The internet protocol which the rule should match.
- Region string
- The resource region. If not defined, the provider region is used.
- Remote
Security stringGroup Id - The remote security group which the rule should match.
- Direction string
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - Project
Id string - STACKIT project ID to which the security group rule is associated.
- Security
Group stringId - The security group ID.
- Description string
- The rule description.
- Ether
Type string - The ethertype which the rule should match.
- Icmp
Parameters SecurityGroup Rule Icmp Parameters Args - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- Ip
Range string - The remote IP range which the rule should match.
- Port
Range SecurityGroup Rule Port Range Args - The range of ports. This should only be provided if the protocol is not ICMP.
- Protocol
Security
Group Rule Protocol Args - The internet protocol which the rule should match.
- Region string
- The resource region. If not defined, the provider region is used.
- Remote
Security stringGroup Id - The remote security group which the rule should match.
- direction String
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - project
Id String - STACKIT project ID to which the security group rule is associated.
- security
Group StringId - The security group ID.
- description String
- The rule description.
- ether
Type String - The ethertype which the rule should match.
- icmp
Parameters SecurityGroup Rule Icmp Parameters - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- ip
Range String - The remote IP range which the rule should match.
- port
Range SecurityGroup Rule Port Range - The range of ports. This should only be provided if the protocol is not ICMP.
- protocol
Security
Group Rule Protocol - The internet protocol which the rule should match.
- region String
- The resource region. If not defined, the provider region is used.
- remote
Security StringGroup Id - The remote security group which the rule should match.
- direction string
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - project
Id string - STACKIT project ID to which the security group rule is associated.
- security
Group stringId - The security group ID.
- description string
- The rule description.
- ether
Type string - The ethertype which the rule should match.
- icmp
Parameters SecurityGroup Rule Icmp Parameters - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- ip
Range string - The remote IP range which the rule should match.
- port
Range SecurityGroup Rule Port Range - The range of ports. This should only be provided if the protocol is not ICMP.
- protocol
Security
Group Rule Protocol - The internet protocol which the rule should match.
- region string
- The resource region. If not defined, the provider region is used.
- remote
Security stringGroup Id - The remote security group which the rule should match.
- direction str
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - project_
id str - STACKIT project ID to which the security group rule is associated.
- security_
group_ strid - The security group ID.
- description str
- The rule description.
- ether_
type str - The ethertype which the rule should match.
- icmp_
parameters SecurityGroup Rule Icmp Parameters Args - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- ip_
range str - The remote IP range which the rule should match.
- port_
range SecurityGroup Rule Port Range Args - The range of ports. This should only be provided if the protocol is not ICMP.
- protocol
Security
Group Rule Protocol Args - The internet protocol which the rule should match.
- region str
- The resource region. If not defined, the provider region is used.
- remote_
security_ strgroup_ id - The remote security group which the rule should match.
- direction String
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - project
Id String - STACKIT project ID to which the security group rule is associated.
- security
Group StringId - The security group ID.
- description String
- The rule description.
- ether
Type String - The ethertype which the rule should match.
- icmp
Parameters Property Map - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- ip
Range String - The remote IP range which the rule should match.
- port
Range Property Map - The range of ports. This should only be provided if the protocol is not ICMP.
- protocol Property Map
- The internet protocol which the rule should match.
- region String
- The resource region. If not defined, the provider region is used.
- remote
Security StringGroup Id - The remote security group which the rule should match.
Outputs
All input properties are implicitly available as output properties. Additionally, the SecurityGroupRule resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Security
Group stringRule Id - The security group rule ID.
- Id string
- The provider-assigned unique ID for this managed resource.
- Security
Group stringRule Id - The security group rule ID.
- id String
- The provider-assigned unique ID for this managed resource.
- security
Group StringRule Id - The security group rule ID.
- id string
- The provider-assigned unique ID for this managed resource.
- security
Group stringRule Id - The security group rule ID.
- id str
- The provider-assigned unique ID for this managed resource.
- security_
group_ strrule_ id - The security group rule ID.
- id String
- The provider-assigned unique ID for this managed resource.
- security
Group StringRule Id - The security group rule ID.
Look up Existing SecurityGroupRule Resource
Get an existing SecurityGroupRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: SecurityGroupRuleState, opts?: CustomResourceOptions): SecurityGroupRule@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
description: Optional[str] = None,
direction: Optional[str] = None,
ether_type: Optional[str] = None,
icmp_parameters: Optional[SecurityGroupRuleIcmpParametersArgs] = None,
ip_range: Optional[str] = None,
port_range: Optional[SecurityGroupRulePortRangeArgs] = None,
project_id: Optional[str] = None,
protocol: Optional[SecurityGroupRuleProtocolArgs] = None,
region: Optional[str] = None,
remote_security_group_id: Optional[str] = None,
security_group_id: Optional[str] = None,
security_group_rule_id: Optional[str] = None) -> SecurityGroupRulefunc GetSecurityGroupRule(ctx *Context, name string, id IDInput, state *SecurityGroupRuleState, opts ...ResourceOption) (*SecurityGroupRule, error)public static SecurityGroupRule Get(string name, Input<string> id, SecurityGroupRuleState? state, CustomResourceOptions? opts = null)public static SecurityGroupRule get(String name, Output<String> id, SecurityGroupRuleState state, CustomResourceOptions options)resources: _: type: stackit:SecurityGroupRule get: id: ${id}- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Description string
- The rule description.
- Direction string
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - Ether
Type string - The ethertype which the rule should match.
- Icmp
Parameters SecurityGroup Rule Icmp Parameters - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- Ip
Range string - The remote IP range which the rule should match.
- Port
Range SecurityGroup Rule Port Range - The range of ports. This should only be provided if the protocol is not ICMP.
- Project
Id string - STACKIT project ID to which the security group rule is associated.
- Protocol
Security
Group Rule Protocol - The internet protocol which the rule should match.
- Region string
- The resource region. If not defined, the provider region is used.
- Remote
Security stringGroup Id - The remote security group which the rule should match.
- Security
Group stringId - The security group ID.
- Security
Group stringRule Id - The security group rule ID.
- Description string
- The rule description.
- Direction string
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - Ether
Type string - The ethertype which the rule should match.
- Icmp
Parameters SecurityGroup Rule Icmp Parameters Args - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- Ip
Range string - The remote IP range which the rule should match.
- Port
Range SecurityGroup Rule Port Range Args - The range of ports. This should only be provided if the protocol is not ICMP.
- Project
Id string - STACKIT project ID to which the security group rule is associated.
- Protocol
Security
Group Rule Protocol Args - The internet protocol which the rule should match.
- Region string
- The resource region. If not defined, the provider region is used.
- Remote
Security stringGroup Id - The remote security group which the rule should match.
- Security
Group stringId - The security group ID.
- Security
Group stringRule Id - The security group rule ID.
- description String
- The rule description.
- direction String
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - ether
Type String - The ethertype which the rule should match.
- icmp
Parameters SecurityGroup Rule Icmp Parameters - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- ip
Range String - The remote IP range which the rule should match.
- port
Range SecurityGroup Rule Port Range - The range of ports. This should only be provided if the protocol is not ICMP.
- project
Id String - STACKIT project ID to which the security group rule is associated.
- protocol
Security
Group Rule Protocol - The internet protocol which the rule should match.
- region String
- The resource region. If not defined, the provider region is used.
- remote
Security StringGroup Id - The remote security group which the rule should match.
- security
Group StringId - The security group ID.
- security
Group StringRule Id - The security group rule ID.
- description string
- The rule description.
- direction string
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - ether
Type string - The ethertype which the rule should match.
- icmp
Parameters SecurityGroup Rule Icmp Parameters - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- ip
Range string - The remote IP range which the rule should match.
- port
Range SecurityGroup Rule Port Range - The range of ports. This should only be provided if the protocol is not ICMP.
- project
Id string - STACKIT project ID to which the security group rule is associated.
- protocol
Security
Group Rule Protocol - The internet protocol which the rule should match.
- region string
- The resource region. If not defined, the provider region is used.
- remote
Security stringGroup Id - The remote security group which the rule should match.
- security
Group stringId - The security group ID.
- security
Group stringRule Id - The security group rule ID.
- description str
- The rule description.
- direction str
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - ether_
type str - The ethertype which the rule should match.
- icmp_
parameters SecurityGroup Rule Icmp Parameters Args - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- ip_
range str - The remote IP range which the rule should match.
- port_
range SecurityGroup Rule Port Range Args - The range of ports. This should only be provided if the protocol is not ICMP.
- project_
id str - STACKIT project ID to which the security group rule is associated.
- protocol
Security
Group Rule Protocol Args - The internet protocol which the rule should match.
- region str
- The resource region. If not defined, the provider region is used.
- remote_
security_ strgroup_ id - The remote security group which the rule should match.
- security_
group_ strid - The security group ID.
- security_
group_ strrule_ id - The security group rule ID.
- description String
- The rule description.
- direction String
- The direction of the traffic which the rule should match. Some of the possible values are: Possible values are:
ingress,egress. - ether
Type String - The ethertype which the rule should match.
- icmp
Parameters Property Map - ICMP Parameters. These parameters should only be provided if the protocol is ICMP.
- ip
Range String - The remote IP range which the rule should match.
- port
Range Property Map - The range of ports. This should only be provided if the protocol is not ICMP.
- project
Id String - STACKIT project ID to which the security group rule is associated.
- protocol Property Map
- The internet protocol which the rule should match.
- region String
- The resource region. If not defined, the provider region is used.
- remote
Security StringGroup Id - The remote security group which the rule should match.
- security
Group StringId - The security group ID.
- security
Group StringRule Id - The security group rule ID.
Supporting Types
SecurityGroupRuleIcmpParameters, SecurityGroupRuleIcmpParametersArgs
SecurityGroupRulePortRange, SecurityGroupRulePortRangeArgs
SecurityGroupRuleProtocol, SecurityGroupRuleProtocolArgs
- Name string
- The protocol name which the rule should match. Either
nameornumbermust be provided. Possible values are:ah,dccp,egp,esp,gre,icmp,igmp,ipip,ipv6-encap,ipv6-frag,ipv6-icmp,ipv6-nonxt,ipv6-opts,ipv6-route,ospf,pgm,rsvp,sctp,tcp,udp,udplite,vrrp. - Number int
- The protocol number which the rule should match. Either
nameornumbermust be provided.
- Name string
- The protocol name which the rule should match. Either
nameornumbermust be provided. Possible values are:ah,dccp,egp,esp,gre,icmp,igmp,ipip,ipv6-encap,ipv6-frag,ipv6-icmp,ipv6-nonxt,ipv6-opts,ipv6-route,ospf,pgm,rsvp,sctp,tcp,udp,udplite,vrrp. - Number int
- The protocol number which the rule should match. Either
nameornumbermust be provided.
- name String
- The protocol name which the rule should match. Either
nameornumbermust be provided. Possible values are:ah,dccp,egp,esp,gre,icmp,igmp,ipip,ipv6-encap,ipv6-frag,ipv6-icmp,ipv6-nonxt,ipv6-opts,ipv6-route,ospf,pgm,rsvp,sctp,tcp,udp,udplite,vrrp. - number Integer
- The protocol number which the rule should match. Either
nameornumbermust be provided.
- name string
- The protocol name which the rule should match. Either
nameornumbermust be provided. Possible values are:ah,dccp,egp,esp,gre,icmp,igmp,ipip,ipv6-encap,ipv6-frag,ipv6-icmp,ipv6-nonxt,ipv6-opts,ipv6-route,ospf,pgm,rsvp,sctp,tcp,udp,udplite,vrrp. - number number
- The protocol number which the rule should match. Either
nameornumbermust be provided.
- name str
- The protocol name which the rule should match. Either
nameornumbermust be provided. Possible values are:ah,dccp,egp,esp,gre,icmp,igmp,ipip,ipv6-encap,ipv6-frag,ipv6-icmp,ipv6-nonxt,ipv6-opts,ipv6-route,ospf,pgm,rsvp,sctp,tcp,udp,udplite,vrrp. - number int
- The protocol number which the rule should match. Either
nameornumbermust be provided.
- name String
- The protocol name which the rule should match. Either
nameornumbermust be provided. Possible values are:ah,dccp,egp,esp,gre,icmp,igmp,ipip,ipv6-encap,ipv6-frag,ipv6-icmp,ipv6-nonxt,ipv6-opts,ipv6-route,ospf,pgm,rsvp,sctp,tcp,udp,udplite,vrrp. - number Number
- The protocol number which the rule should match. Either
nameornumbermust be provided.
Package Details
- Repository
- stackit stackitcloud/pulumi-stackit
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
stackitTerraform Provider.
published on Friday, Feb 20, 2026 by stackitcloud
