Network ACL rules, security group rules, route table routes and DNS upstream servers are replaced as a whole set. There is no command to add or remove one rule, and no way to say “leave this part as it is”. Each update writes the complete new state, so each command makes you state that state in full and refuses to run if you leave part of it out.
What each command needs
| Command | State it in full with |
|---|---|
update-acl-rules | --rule … (repeatable) or --no-rules |
update-security-group-rules | --ingress-rule … or --no-ingress-rules, and --egress-rule … or --no-egress-rules |
create-dns-policy, update-dns-policy | --upstream-server … or --no-upstream-servers, and --relay-enabled true or false |
update-route-table-routes | --route … (repeatable), including the local routes |
create-subnet, update-subnet-auto-assign-public-ip | --auto-assign-public-ip true or false |
To change one rule, read the current set with the matching get- command, then send the whole set with your change.
The empty set is stated by name
An empty set is a legitimate state. An ACL with no rules denies everything, a security group with no egress rules lets nothing out, and a DNS policy that doesn’t relay needs no upstream servers. You ask for it with its flag, never by leaving an argument out:
update-acl-rules --acl-urn <acl-urn>on its own is refused. Add--no-rulesif you mean an ACL with no rules.update-security-group-rulesreplaces both lists on every call. Giving only--ingress-ruleis refused, because it would also replace the egress rules. Repeat--egress-rulefor the rules you keep, or give--no-egress-rules.
Booleans are explicit
--relay-enabled and --auto-assign-public-ip take true or false rather than being on when present. Leaving one off an update can’t turn a setting off by accident. A create command takes the same flags as its update command.
Contradictions are refused
Giving both forms of the same list, such as --rule … together with --no-rules, is an error. --relay-enabled true with --no-upstream-servers is refused too, because a relaying policy needs at least one server.