Skip to content
Kyku

SecurityGroup

A SecurityGroup defines network access rules for Vm and LoadBalancer resources. It contains ingress and egress rules with protocol, port ranges, and source/destination CIDRs or references to other security groups. On AWS this is an EC2 Security Group, on GCP a set of Firewall Rules, on Hetzner a Firewall, and on DigitalOcean a Cloud Firewall.

Config

Section titled “Config”
Property Type Required Description
name string yes Unique resource name
id string no Explicit ID (auto-generated UUID if omitted)
provider string no Provider label for multi-provider configs
tags Record<string, string> no Arbitrary key-value metadata
ingress SecurityGroupRule[] yes List of inbound rules
egress SecurityGroupRule[] no List of outbound rules
vpc Vpc | string no Vpc this security group belongs to

SecurityGroupRule

Section titled “SecurityGroupRule”
Property Type Required Description
protocol 'tcp' | 'udp' | 'icmp' | 'all' yes IP protocol
fromPort number yes Start of port range
toPort number yes End of port range
sources (string | SecurityGroup)[] yes CIDR blocks or SecurityGroup references
description string no Human-readable description

Example

Section titled “Example”
import { Vpc, SecurityGroup } from '@kykucloud/types'


const myVpc = new Vpc({ name: 'my-vpc', cidr: '10.0.0.0/16', region: 'eu-central' })


const webSg = new SecurityGroup({
  name: 'web-sg',
  vpc: myVpc,
  ingress: [
    { protocol: 'tcp', fromPort: 80, toPort: 80, sources: ['0.0.0.0/0'] },
    { protocol: 'tcp', fromPort: 443, toPort: 443, sources: ['0.0.0.0/0'] },
  ],
  egress: [
    { protocol: 'all', fromPort: 0, toPort: 0, sources: ['0.0.0.0/0'] },
  ],
})

Provider Support

Section titled “Provider Support”
Provider Supported Backend
AWS ✅ EC2 Security Group (IpPermissions/IpPermissionsEgress)
GCP ✅ Firewall Rules (one rule per ingress/egress entry)
Hetzner ✅ Firewall
DigitalOcean ✅ Cloud Firewall

Notes

Section titled “Notes”
  • GCP creates one firewall rule per ingress/egress entry, named ${sg.name}-ingress-0, ${sg.name}-egress-0, etc. Destroy cleans up by name prefix.
  • DigitalOcean firewall rules use ports as a string ("22", "80-443", "all"). ICMP rules omit the ports field. Firewall attachment uses tags: droplets tagged with kyku-sg:<id> are matched by sources.tags.
  • Hetzner firewall destroy may fail with “still in use” if label selectors are active. PUT { applied_to: [] } before DELETE to clear selectors.
  • AWS security group names are immutable — the SG cannot be renamed after creation. Referencing other security groups as sources creates cross-SG rules.
  • Rule ordering: Rules are evaluated in order within each provider but the exact behavior varies. Best practice is to define permissive egress and restrictive ingress.