Open a TCP port on the primary security group of a host identified through the local hosts mapping.
aws_open_port.py <instance|hostname> <port> <ip-or-host> [--region REGION] [--flush]
Resolves the target instance id from getent hosts output, so it depends on the local hosts file being current.
Accepts a CIDR directly, a host name that is resolved to /32, or any for 0.0.0.0/0.
With --flush, removes existing ingress rules for that TCP port before adding the new rule. Duplicate-rule errors are treated as harmless.
The script's DEFAULT_REGION is us-east-1, which is wrong for every current host: gravlax is EC2 eu-north-1, kelp is EC2 eu-central-1 (see uucp/setup-status Topology). Without --region explicitly matching the target host, describe_instances fails with InvalidInstanceID.NotFound even though the instance ID (resolved correctly from getent hosts) is right — the error is misleading because it looks like a hosts-file/instance-ID problem, not a region problem. Always pass --region eu-north-1 for gravlax and --region eu-central-1 for kelp.
--flush removes every existing ingress rule for that TCP port, not just a stale one for the specific peer you're fixing. Used to replace kelp's stale IP in gravlax's security group for port 10540, it also silently deleted pomelo's own long-standing legitimate rule for the same port — pomelo's UUCP polling then started failing with a connection timeout until that rule was manually re-added (without --flush) straight after. If a port has more than one legitimate peer, either add the new rule without --flush first (duplicate/stale rules are harmless per Behavior above) or be ready to immediately re-add every other peer's rule afterward.