provider "null" {}

resource "null_resource" "add_bastion_firewall_rule" {
  provisioner "local-exec" {
    command = <<EOT
      aliyun bastionhost CreateUserGroupAuthorizeRule \
        --RegionId {REGION} \
        --UserGroupId {USERGROUPID} \
        --HostGroupId {HOSTGROUPID} \
        --InstanceId {INSTANCEID} \
        --AuthorizeType "WHITE" \
        --Protocol "SSH" \
        --SourceIp "100.100.100.100/32" \
        --TargetPort "22"
    EOT
  }
}

aliyun bastionhost ListHostGroups --InstanceId {INSTANCEID}