How to Validate AWS Security Group Ingress Rules in Python

from dataclasses import dataclass
from typing import List, Optional

@dataclass
class SecurityGroupRule:
    protocol: str
    port_range: tuple
    cidr: str
    description: str = ""

def validate_ingress_rule(rule: SecurityGroupRule) -> List[str]:
    """Validate a security group ingress rule against common AWS patterns."""
    errors = []
    
    # Validate protocol
    valid_protocols = {"tcp", "udp", "icmp", "-1"}
    if rule.protocol not in valid_protocols:
        errors.append(f"Invalid protocol: {rule.protocol}")
    
    # Validate port range (0-65535)
    if not (-1 <= rule.port_range[0] <= 65535 and -1 <= rule.port_range[1] <= 65535):
        errors.append(f"Invalid port range: {rule.port_range}")
    elif rule.port_range[0] > rule.port_range[1]:
        errors.append(f"Port range start > end: {rule.port_range}")
    
    # Validate CIDR format
    import re
    if not re.match(r"^(\d{1,3}\.){3}\d{1,3}/\d{1,2}$", rule.cidr):
        errors.append(f"Invalid CIDR: {rule.cidr}")
    elif rule.cidr == "0.0.0.0/0":
        errors.append("Open to all IPs — security risk unless intentional")
    
    # Description length check
    if len(rule.description) > 255:
        errors.append("Description exceeds 255 chars")
    
    return errors if errors else ["OK"]

if __name__ == "__main__":
    # Mock rules to validate
    test_rules = [
        SecurityGroupRule("tcp", (22, 22), "0.0.0.0/0", "SSH access"),
        SecurityGroupRule("udp", (53, 53), "192.168.1.0/24", "DNS"),
        SecurityGroupRule("h2", (8080, 8080), "10.0.0.5/32", "Web"),
        SecurityGroupRule("tcp", (10000, 200), "invalid-cidr", "Broken rule"),
        SecurityGroupRule("-1", (-1, -1), "10.0.0.0/8", "All traffic"),
    ]
    
    for rule in test_rules:
        result = validate_ingress_rule(rule)
        print(f"Rule ({rule.protocol}, {rule.port_range}, {rule.cidr}) → {result}")