$ ansible-doc -t module cisco.sccfm.create_access_rule
> MODULE cisco.sccfm.create_access_rule (sccfm-ansible/plugins/modules/create_access_rule.py)
Create an ASA access rule in your SCC Firewall Manager tenant.
Supports specifying source and destination network objects by name.
Network object names are resolved to UIDs automatically.
Non-idempotent. This module creates a new access rule each time it
runs.
OPTIONS (= indicates it is required):
= access_group_uid UID of the access group.
type: str
- active Whether the rule is active.
default: null
type: bool
- api_token API token for SCCFM.
set_via:
env:
- name: SCCFM_API_TOKEN
default: null
no_log: true
type: str
- destination_network Destination network object name.
default: null
type: str
- destination_port Destination port or port range.
default: null
type: str
= entity_uid UID of the device or manager.
type: str
= index Position of the rule in the ordered list.
type: int
- log_interval Log interval in seconds.
default: null
type: int
- log_level Log level.
default: null
type: str
- protocol Protocol (e.g. tcp, udp, ip).
default: null
type: str
- region SCCFM region (int, us, eu, apj, au, uae, in, or ci).
set_via:
env:
- name: SCCFM_REGION
default: null
type: str
- remark Human-readable description of the rule.
default: null
type: str
- rule_action Rule action — PERMIT or DENY.
choices: [PERMIT, DENY]
default: PERMIT
type: str
- source_network Source network object name.
default: null
type: str
- source_port Source port or port range.
default: null
type: str
AUTHOR: Cisco SCCFM Team
EXAMPLES:
# Example 1: Create a permit rule with explicit credentials
- name: Create a permit rule for web traffic
cisco.sccfm.create_access_rule:
access_group_uid: "{{ access_group_uid }}"
entity_uid: "{{ device_uid }}"
index: 1
rule_action: PERMIT
source_network: web-servers
destination_network: db-servers
protocol: tcp
destination_port: "443"
remark: "Allow web to database"
region: "{{ sccfm_region }}"
api_token: "{{ sccfm_api_token }}"
# Example 2: Create a deny rule using module_defaults
- name: Create access rules
hosts: localhost
gather_facts: false
module_defaults:
group/cisco.sccfm.all:
region: "{{ sccfm_region }}"
api_token: "{{ lookup('env', 'SCCFM_API_TOKEN') }}"
tasks:
- name: Create a deny rule for a source subnet
cisco.sccfm.create_access_rule:
access_group_uid: "{{ access_group_uid }}"
entity_uid: "{{ device_uid }}"
index: 10
rule_action: DENY
source_network: blocked-subnet
destination_network: db-servers
protocol: tcp
destination_port: "1433"
remark: "Block blocked-subnet to SQL"
# Example 3: Using environment variables (SCCFM_REGION and SCCFM_API_TOKEN)
- name: Create an inactive permit rule
cisco.sccfm.create_access_rule:
access_group_uid: "{{ access_group_uid }}"
entity_uid: "{{ device_uid }}"
index: 20
source_network: web-servers
destination_network: db-servers
protocol: tcp
destination_port: "443"
active: false
remark: "Prepared but not yet enabled"
RETURN VALUES:
- access_rule The created access rule.
returned: success
type: dict
contains:
- access_group_uid UID of the associated access group.
type: str
- destination_network Destination network details.
type: dict
- entity_uid UID of the device or manager.
type: str
- index Position in the rule list.
type: int
- remark Rule description.
type: str
- rule_action PERMIT or DENY.
type: str
- source_network Source network details.
type: dict
- uid Unique identifier of the access rule.
type: str