diff --git a/pkg/util/aws/utils.go b/pkg/util/aws/utils.go
index e415ea47ce..95657ef942 100644
--- a/pkg/util/aws/utils.go
+++ b/pkg/util/aws/utils.go
@@ -3,6 +3,10 @@ package aws
 import (
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"yunion.io/x/pkg/util/secrules"
+	"net"
+	"fmt"
+	"yunion.io/x/log"
+	"strings"
 )
 
 func AppendFilter(filters []*ec2.Filter, name string, values []string) ([]*ec2.Filter) {
@@ -44,15 +48,73 @@ func ConvertedPointList(list []*string) ([]string) {
 	return result
 }
 
-// Security Rule Transform
-func AwsIpPermissionToYunion(permission ec2.IpPermission) secrules.SecurityRule {
-	return secrules.SecurityRule{}
+func isAwsPermissionAllPorts(p ec2.IpPermission) bool {
+	//  全部端口范围： TCP/UDP （0，65535）    其他：（-1，-1）
+	if (*p.IpProtocol == "tcp" || *p.IpProtocol == "udp") && *p.FromPort == 0 && *p.ToPort == 65535 {
+		return true
+	} else if *p.FromPort == -1 && *p.ToPort == -1 {
+		return true
+	} else {
+		return false
+	}
 }
 
-func YunionIpPermissionToAws(rule secrules.SecurityRule) ec2.IpPermission {
+// Security Rule Transform
+func AwsIpPermissionToYunion(direction secrules.TSecurityRuleDirection,p ec2.IpPermission) ([]secrules.SecurityRule, error) {
+
+	if len(p.UserIdGroupPairs) > 0 {
+		return nil, fmt.Errorf("AwsIpPermissionToYunion not supported aws rule: UserIdGroupPairs specified")
+	}
+
+	if len(p.PrefixListIds) > 0 {
+		return nil, fmt.Errorf("AwsIpPermissionToYunion not supported aws rule: PrefixListIds specified")
+	}
+
+	if len(p.Ipv6Ranges) > 0 {
+		log.Debugf("AwsIpPermissionToYunion ignored IPV6 rule: %s", p.Ipv6Ranges)
+	}
+
+	rules := []secrules.SecurityRule{}
+	isAllPorts := isAwsPermissionAllPorts(p)
+	for _, ip := range p.IpRanges {
+		ipNet := strings.Split(*ip.CidrIp, "/")
+		if len(ipNet) != 2 {
+			log.Debugf("AwsIpPermissionToYunion ignored IPV4 rule: %s", *ip.CidrIp)
+			continue
+		}
+
+		var rule secrules.SecurityRule
+		if isAllPorts {
+			rule = secrules.SecurityRule{
+				Action:      secrules.SecurityRuleAllow,
+				IPNet:       &net.IPNet{net.IP(ipNet[0]), net.IPMask(ipNet[1])},
+				Protocol:    *p.IpProtocol,
+				Direction:   direction,
+				Description: "",
+			}
+		} else {
+			rule = secrules.SecurityRule{
+				Action:      secrules.SecurityRuleAllow,
+				IPNet:       &net.IPNet{net.IP(ipNet[0]), net.IPMask(ipNet[1])},
+				Protocol:    *p.IpProtocol,
+				Direction:   direction,
+				PortStart:   int(*p.FromPort),
+				PortEnd:     int(*p.ToPort),
+				Description: "",
+			}
+		}
+
+		rules = append(rules, rule)
+
+	}
+
+	return rules, nil
+}
+
+func YunionSecRuleToAws(rule secrules.SecurityRule) ec2.IpPermission {
 	return ec2.IpPermission{}
 }
 
 func DiffIpPermission(permission ec2.IpPermission, rule secrules.SecurityRule) {
-	
+
 }
\ No newline at end of file