こんにちは。AWS CLIが好きな福島です。
今回は、AWS CLIを使ってネットワーク関連のリソース一覧を取得するコマンドをご紹介いたします。
- 実行環境
- VPC一覧取得
- VPCのCIDR情報取得
- サブネット一覧
- ルートテーブル一覧
- インターネットゲートウェイ一覧
- VGW一覧
- NATゲートウェイ一覧
- TGW一覧
- ENI一覧
- ENIに紐づいているSG一覧
- NACLS一覧
- SG一覧
- VPCエンドポイント一覧
- Nameタグを知りたい場合
- おわりに
実行環境
今回、コマンドを実行した環境は、以下の通りとなります。
（本記事でご紹介しているコマンドの中には、Linuxのコマンドを利用している箇所があります。）
# uname -a Linux LAPTOP-CNM26HN6 4.4.0-18362-Microsoft #1049-Microsoft Thu Aug 14 12:01:00 PST 2020 x86_64 x86_64 x86_64 GNU/Linux #
VPC一覧取得
コマンド ヘッダー無し
aws ec2 describe-vpcs --output text --query "Vpcs[].[Tags[?Key=='Name'] | [0].Value,VpcId,CidrBlock,DhcpOptionsId,State,OwnerId,InstanceTenancy]" | sort
- 実行結果
eks-work-VPC vpc-0acb84b18976ad7a7 192.168.0.0/16 dopt-fe6b4e99 available xxxxxxxxxxxxx default fk-terraform-vpc vpc-0a30013e7b91ab5c6 10.0.0.0/16 dopt-fe6b4e99 available xxxxxxxxxxxxx default fk-test-vpc vpc-0fee138d3e0deef81 10.88.0.0/16 dopt-0b45aee59222d146a available xxxxxxxxxxxxx default
コマンド ヘッダー有り
echo "NameTag VPCID CIDR DHCP State OwnerId InstanceTenancy" > /tmp/awscli.tmp;\ aws ec2 describe-vpcs --output text --query "Vpcs[].[Tags[?Key=='Name'] | [0].Value,VpcId,CidrBlock,DhcpOptionsId,State,OwnerId,InstanceTenancy]" | sort >> /tmp/awscli.tmp;\ column -t /tmp/awscli.tmp ;\ rm /tmp/awscli.tmp
- 実行結果
NameTag VPCID CIDR DHCP State OwnerId InstanceTenancy fk-test-vpc vpc-xxxxxxxxxxxxxxxxx 10.88.0.0/16 dopt-xxxxxxxxx available xxxxxxxxxxxx default None vpc-xxxxxxxxxxxxxxxxx 10.1.0.0/16 dopt-xxxxxxxxx available xxxxxxxxxxxx default
VPCのCIDR情報取得
コマンド ヘッダー無し
aws ec2 describe-vpcs --query "Vpcs[].[Tags[?Key=='Name'] | [0].Value,VpcId,CidrBlockAssociationSet[0].CidrBlock,CidrBlockAssociationSet[1].CidrBlock,CidrBlockAssociationSet[2].CidrBlock]" --output text
- 実行結果
eks-work-VPC vpc-0acb84b18976ad7a7 192.168.0.0/16 None None fk-terraform-vpc vpc-0a30013e7b91ab5c6 10.0.0.0/16 None None fk-test-vpc vpc-0fee138d3e0deef81 10.88.0.0/16 10.0.0.0/16 None
コマンド ヘッダー有り
echo "VPCID NameTag CIDR[1] CIDR[2] CIDR[3]" > /tmp/awscli.tmp;\ aws ec2 describe-vpcs --query "Vpcs[].[Tags[?Key=='Name'] | [0].Value,VpcId,CidrBlockAssociationSet[0].CidrBlock,CidrBlockAssociationSet[1].CidrBlock,CidrBlockAssociationSet[2].CidrBlock]" --output text >> /tmp/awscli.tmp;\ column -t /tmp/awscli.tmp;\ rm /tmp/awscli.tmp
- 実行結果
VPCID NameTag CIDR[1] CIDR[2] CIDR[3] eks-work-VPC vpc-0acb84b18976ad7a7 192.168.0.0/16 None None fk-test-vpc vpc-0fee138d3e0deef81 10.88.0.0/16 10.0.0.0/16 None fk-terraform-vpc vpc-0a30013e7b91ab5c6 10.0.0.0/16 None None
サブネット一覧
コマンド ヘッダー無し
aws ec2 describe-subnets --query "Subnets[].[Tags[?Key=='Name'] | [0].Value,VpcId,CidrBlock,AvailableIpAddressCount,SubnetId,AvailabilityZone,MapPublicIpOnLaunch,State,OwnerId]" --output text | sort
- 実行結果
vpc-xxxxxxxxxxxxxxxxx 10.0.10.0/24 249 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.11.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1c False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.12.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1d False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.20.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.21.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1c False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.22.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1d False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 172.25.42.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 172.25.43.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1c False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 172.25.44.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 172.25.45.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1c False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.1.0.0/24 250 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx
コマンド ヘッダー有り
echo "VpcId CidrBlock AvailableIpAddressCount SubnetId AvailabilityZone MapPublicIpOnLaunch State OwnerId" > /tmp/awscli.tmp; aws ec2 describe-subnets --query "Subnets[].[VpcId,CidrBlock,AvailableIpAddressCount,SubnetId,AvailabilityZone,MapPublicIpOnLaunch,State,OwnerId]" --output text | sort >> /tmp/awscli.tmp ; column -t /tmp/awscli.tmp;rm /tmp/awscli.tmp
- 実行結果
VpcId CidrBlock AvailableIpAddressCount SubnetId AvailabilityZone MapPublicIpOnLaunch State OwnerId vpc-xxxxxxxxxxxxxxxxx 10.0.10.0/24 249 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.11.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1c False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.12.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1d False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.20.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.21.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1c False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.0.22.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1d False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 172.25.42.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 172.25.43.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1c False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 172.25.44.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 172.25.45.0/24 251 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1c False available xxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 10.1.0.0/24 250 subnet-xxxxxxxxxxxxxxxxx ap-northeast-1a False available xxxxxxxxxxxx
ルートテーブル一覧
コマンド ヘッダー無し
aws ec2 describe-route-tables --query "RouteTables[].Associations[].[SubnetId,RouteTableId,Main]" --output text | sort | column -t
- 実行結果
None rtb-xxxxxxxxxxxxxxxxx True None rtb-xxxxxxxxxxxxxxxxx True None rtb-xxxxxxxxxxxxxxxxx True None rtb-xxxxxxxxxxxxxxxxx True None rtb-xxxxxxxxxxxxxxxxx True subnet-xxxxxxxxxxxxxxxxx rtb-xxxxxxxxxxxxxxxxx False subnet-xxxxxxxxxxxxxxxxx rtb-xxxxxxxxxxxxxxxxx False subnet-xxxxxxxxxxxxxxxxx rtb-xxxxxxxxxxxxxxxxx False
コマンド ヘッダー有り
echo "SubnetId RouteTableId Main" > /tmp/awscli.tmp;aws ec2 describe-route-tables --query "RouteTables[].Associations[].[SubnetId,RouteTableId,Main]" --output text | sort >> /tmp/awscli.tmp ;column -t /tmp/awscli.tmp;rm /tmp/awscli.tmp
- 実行結果
SubnetId RouteTableId Main None rtb-xxxxxxxxxxxxxxxxx True None rtb-xxxxxxxxxxxxxxxxx True None rtb-xxxxxxxxxxxxxxxxx True None rtb-xxxxxxxxxxxxxxxxx True None rtb-xxxxxxxxxxxxxxxxx True subnet-xxxxxxxxxxxxxxxxx rtb-xxxxxxxxxxxxxxxxx False subnet-xxxxxxxxxxxxxxxxx rtb-xxxxxxxxxxxxxxxxx False subnet-xxxxxxxxxxxxxxxxx rtb-xxxxxxxxxxxxxxxxx False
インターネットゲートウェイ一覧
コマンド
aws ec2 describe-internet-gateways --query "InternetGateways[].{InternetGatewayId:InternetGatewayId,VpcId:Attachments[0].VpcId}" --output table
- 実行結果
---------------------------------------------------- | DescribeInternetGateways | +------------------------+-------------------------+ | InternetGatewayId | VpcId | +------------------------+-------------------------+ | igw-xxxxxxxxxxxxxxxxx | vpc-xxxxxxxxxxxxxxxxx | | igw-xxxxxxxxxxxxxxxxx | vpc-xxxxxxxxxxxxxxxxx | | igw-xxxxxxxxxxxxxxxxx | vpc-xxxxxxxxxxxxxxxxx | | igw-xxxxxxxxxxxxxxxxx | vpc-xxxxxxxxxxxxxxxxx | +------------------------+-------------------------+
VGW一覧
コマンド
aws ec2 describe-vpn-gateways --query "VpnGateways[].{VpnGatewayId:VpnGatewayId,VpcId:VpcAttachments[0].VpcId}" --output table
- 実行結果
---------------------------------------------------- | DescribeVpnGateways | +------------------------+-------------------------+ | VpcId | VpnGatewayId | +------------------------+-------------------------+ | vpc-xxxxxxxxxxxxxxxxx | vgw-xxxxxxxxxxxxxxxxx | +------------------------+-------------------------+
NATゲートウェイ一覧
コマンド
aws ec2 describe-nat-gateways --query "NatGateways[].{NatGatewayId:NatGatewayId,VpcId:VpcId,SubnetId:SubnetId,NetworkInterfaceId:NatGatewayAddresses[0].NetworkInterfaceId}" --output table
- 実行結果
--------------------------------------------------------------------------------------------------------- | DescribeNatGateways | +-----------------------+------------------------+----------------------------+-------------------------+ | NatGatewayId | NetworkInterfaceId | SubnetId | VpcId | +-----------------------+------------------------+----------------------------+-------------------------+ | nat-xxxxxxxxxxxxxxxxx| eni-xxxxxxxxxxxxxxxxx | subnet-xxxxxxxxxxxxxxxxx | vpc-xxxxxxxxxxxxxxxxx | +-----------------------+------------------------+----------------------------+-------------------------+
TGW一覧
コマンド
aws ec2 describe-transit-gateways --query "TransitGateways[].[TransitGatewayId,Options]" --output yaml
- 実行結果
- - tgw-xxxxxxxxxxxxxxxxx
- AmazonSideAsn: 64512
AssociationDefaultRouteTableId: tgw-rtb-xxxxxxxxxxxxxxxxx
AutoAcceptSharedAttachments: disable
DefaultRouteTableAssociation: enable
DefaultRouteTablePropagation: enable
DnsSupport: enable
PropagationDefaultRouteTableId: tgw-rtb-xxxxxxxxxxxxxxxxx
VpnEcmpSupport: enable
ENI一覧
コマンド
aws ec2 describe-network-interfaces --query "NetworkInterfaces[].[InterfaceType,NetworkInterfaceId,PrivateIpAddress,Description]" --output text
- 実行結果
interface eni-xxxxxxxxxxxxxxxxx 10.88.0.198 Primary network interface interface eni-xxxxxxxxxxxxxxxxx 10.88.1.249 Primary network interface interface eni-xxxxxxxxxxxxxxxxx 10.88.0.148 Primary network interface interface eni-xxxxxxxxxxxxxxxxx 10.88.11.5 EFS mount target for fs-xxxxxxxx (fsmt-xxxxxxxx) interface eni-xxxxxxxxxxxxxxxxx 10.88.0.220 test interface eni-xxxxxxxxxxxxxxxxx 10.0.10.60 Primary network interface interface eni-xxxxxxxxxxxxxxxxx 10.88.10.160 EFS mount target for fs-xxxxxxxx (fsmt-xxxxxxxx) interface eni-xxxxxxxxxxxxxxxxx 10.1.0.14 RedshiftNetworkInterface interface eni-xxxxxxxxxxxxxxxxx 10.88.0.59 Primary network interface interface eni-xxxxxxxxxxxxxxxxx 10.88.10.47 QuickSightfk-test nat_gateway eni-xxxxxxxxxxxxxxxxx 10.88.0.13 Interface for NAT Gateway nat-xxxxxxxxxxxxxxxxx vpc_endpoint eni-xxxxxxxxxxxxxxxxx 10.88.11.137 VPC Endpoint Interface vpce-xxxxxxxxxxxxxxxxx vpc_endpoint eni-xxxxxxxxxxxxxxxxx 10.88.10.77 VPC Endpoint Interface vpce-xxxxxxxxxxxxxxxxx
ENIに紐づいているSG一覧
コマンド
aws ec2 describe-network-interfaces --query "NetworkInterfaces[].[NetworkInterfaceId,Groups[].GroupId]" --output text | tr "\n" " " | sed 's/eni-/\neni-/g'
- 実行結果
eni-xxxxxxxxxxxxxxxxx sg-xxxxxxxxxxxxxxxxx eni-xxxxxxxxxxxxxxxxx sg-xxxxxxxxxxxxxxxxx eni-xxxxxxxxxxxxxxxxx eni-xxxxxxxxxxxxxxxxx sg-xxxxxxxxxxxxxxxxx eni-xxxxxxxxxxxxxxxxx sg-xxxxxxxxxxxxxxxxx eni-xxxxxxxxxxxxxxxxx sg-xxxxxxxxxxxxxxxxx sg-xxxxxxxxxxxxxxxxx sg-xxxxxxxxxxxxxxxxx eni-xxxxxxxxxxxxxxxxx sg-xxxxxxxxxxxxxxxxx
NACLS一覧
コマンド
aws ec2 describe-network-acls --query "NetworkAcls[].Associations[].{NetworkAclId:NetworkAclId,SubnetId:SubnetId}" --output table
- 実行結果
------------------------------------------------------- | DescribeNetworkAcls | +------------------------+----------------------------+ | NetworkAclId | SubnetId | +------------------------+----------------------------+ | acl-xxxxxxxxxxxxxxxxx | subnet-xxxxxxxxxxxxxxxxx | | acl-xxxxxxxxxxxxxxxxx | subnet-xxxxxxxxxxxxxxxxx | | acl-xxxxxxxxxxxxxxxxx | subnet-xxxxxxxxxxxxxxxxx | +------------------------+----------------------------+
SG一覧
コマンド(SG名順) ヘッダー無し
aws ec2 describe-security-groups --query "SecurityGroups[].[GroupName,GroupId,VpcId,Description]" --output table | awk -F\| '{print $2,$3,$4,$5}' | grep sg- | sort
- 実行結果
default sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx default VPC security group default sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx default VPC security group default sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx default VPC security group default sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx default VPC security group fk-jira-private-sg sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 2020-05-07T05:59:49.481Z fk-test-ad-sg sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx fk-test-ad-sg fk-test-db-sg sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx Created by RDS management console
コマンド(SG名順) ヘッダー有り
echo "| GroupName | GroupId | VpcId | Description" > /tmp/awscli.tmp; aws ec2 describe-security-groups --query "SecurityGroups[].[GroupName,GroupId,VpcId,Description]" --output table | grep sg-xxxxxxxxxxxxxxxxxwscli.tmp ; column -s \| -t /tmp/awscli.tmp;rm /tmp/awscli.tmp
- 実行結果
GroupName GroupId VpcId Description default sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx default VPC security group default sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx default VPC security group default sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx default VPC security group default sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx default VPC security group fk-jira-private-sg sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx 2020-05-07T05:59:49.481Z fk-test-ad-sg sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx fk-test-ad-sg fk-test-db-sg sg-xxxxxxxxxxxxxxxxx vpc-xxxxxxxxxxxxxxxxx Created by RDS management console
コマンド(VPC名順) ヘッダー無し
aws ec2 describe-security-groups --query "SecurityGroups[].[VpcId,GroupName,GroupId,Description]" --output table | awk -F\| '{print $2,$3,$4,$5}' | grep sg- | sort
- 実行結果
vpc-xxxxxxxxxxxxxxxxx default sg-xxxxxxxxxxxxxxxxx default VPC security group vpc-xxxxxxxxxxxxxxxxx default sg-xxxxxxxxxxxxxxxxx default VPC security group vpc-xxxxxxxxxxxxxxxxx default sg-xxxxxxxxxxxxxxxxx default VPC security group
コマンド(VPC名順) ヘッダー有り
echo "| VpcId | GroupName | GroupId | Description" > /tmp/awscli.tmp; aws ec2 describe-security-groups --query "SecurityGroups[].[VpcId,GroupName,GroupId,Description]" --output table | grep sg-xxxxxxxxxxxxxxxxxwscli.tmp ; column -s \| -t /tmp/awscli.tmp;rm /tmp/awscli.tmp
- 実行結果
VpcId GroupName GroupId Description vpc-xxxxxxxxxxxxxxxxx default sg-xxxxxxxxxxxxxxxxx default VPC security group vpc-xxxxxxxxxxxxxxxxx default sg-xxxxxxxxxxxxxxxxx default VPC security group vpc-xxxxxxxxxxxxxxxxx default sg-xxxxxxxxxxxxxxxxx default VPC security gro
VPCエンドポイント一覧
コマンド
aws ec2 describe-vpc-endpoints --query "VpcEndpoints[].{ServiceName:ServiceName,VpcEndpointId:VpcEndpointId,VpcId:VpcId,VpcEndpointType:VpcEndpointType,PrivateDnsEnabled:PrivateDnsEnabled}" --output table
- 実行結果
--------------------------------------------------------------------------------------------------------------------------------- | DescribeVpcEndpoints | +-------------------+------------------------------------+-------------------------+------------------+-------------------------+ | PrivateDnsEnabled | ServiceName | VpcEndpointId | VpcEndpointType | VpcId | +-------------------+------------------------------------+-------------------------+------------------+-------------------------+ | True | com.amazonaws.ap-northeast-1.ec2 | vpce-xxxxxxxxxxxxxxxxx | Interface | vpc-xxxxxxxxxxxxxxxxx | | False | com.amazonaws.ap-northeast-1.s3 | vpce-xxxxxxxxxxxxxxxxx | Gateway | vpc-xxxxxxxxxxxxxxxxx | +-------------------+------------------------------------+-------------------------+------------------+-------------------------+
Nameタグを知りたい場合
今回、ご紹介したコマンドは全て、リソースIDが出力されておりますが、 タグの情報が表示されていないため、どのリソースか識別しづらいかと思います。
その場合は、以下のコマンドを実行してください。
コマンド(リソースID⇒Nameタグ)
RESOURCE_ID="xxxx" ★Nameタグを取得したいリソースIDを入力。
aws ec2 describe-tags --filters "Name=tag-key,Values=Name" "Name=resource-id,Values=${RESOURCE_ID}" --query "Tags[].Value" --output text
コマンド(Nameタグ⇒リソースID)
NAME_TAG="xxx" ★リソースIDを取得したいNameタグIDを入力。
aws ec2 describe-tags --filters "Name=tag-key,Values=Name" "Name=tag-value,Values=${NAME_TAG}" --query "Tags[].{ResourceId:ResourceId,ResourceType:ResourceType}" --output table
おわりに
今回は、ネットワーク関連のリソースを一覧取得するコマンドをご紹介いたしました。 次回は、EC2関連のリソースを一覧取得するコマンドをご紹介したいと思います。