> For the complete documentation index, see [llms.txt](https://docs.rumi.systems/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.rumi.systems/rumi-cli/commands/cloud/aws/whitelist-ssh.md).

# whitelist-ssh

Open TCP 22 (SSH) on a bastion's security group for the given source CIDRs.

## Syntax

```bash
rumi cloud aws whitelist-ssh \
  --profile <profile> \
  --network <network> \
  --cidr <cidrs> \
  [options]
```

## Options

| Option      | Short | Description                                                                          | Default     |
| ----------- | ----- | ------------------------------------------------------------------------------------ | ----------- |
| `--profile` | `-p`  | AWS profile to use                                                                   | Required    |
| `--region`  | `-r`  | AWS region                                                                           | `us-east-1` |
| `--network` | `-n`  | Name of the network                                                                  | Required    |
| `--name`    | `-b`  | The bastion name whose SSH to open; omit for the single (unnamed) bastion            | none        |
| `--cidr`    | `-c`  | The source CIDR(s) to allow SSH from, comma-separated (`my-ip` = your own public IP) | Required    |

## Example

```bash
rumi cloud aws whitelist-ssh \
  --profile my-aws-profile \
  --network my-network \
  --name ops \
  --cidr my-ip
```

## Notes

Opens TCP 22 on the bastion's security group for the given IPs. This applies to the `ssh` access method only and is rejected under `ssm-bastion` and `ssm-all`, where SSH is closed in favor of SSM.

## See Also

* [unwhitelist-ssh](/rumi-cli/commands/cloud/aws/unwhitelist-ssh.md)
* [whitelist](/rumi-cli/commands/cloud/aws/whitelist.md)