  def CreateIsolationSecurityGroup(
      self,
      vpc: str,
      ingress_subnets: Optional[List[str]] = None
    ) -> str:
    """Creates an isolation security group.

    Args:
      vpc (str): VPC ID for the security group.
      ingress_subnets (List[str]): Optional. Subnets to allow ingress from.

    Returns:
      str: The ID of the newly created security group.

    Raises:
      ipaddress.AddressValueError: If an invalid subnet is provided.
      errors.ResourceCreationError: If an invalid VPC ID is provided.
    """
    client = self.aws_account.ClientApi(common.EC2_SERVICE)
    description = 'Quarantine Security Group'
    name = 'quarantine-{0:d}'.format(random.randint(10**(9),(10**10)-1))

    # Test the subnets are well formed
    if ingress_subnets:
      for subnet in ingress_subnets:
        ipaddress.IPv4Network(subnet, False)

    # Create the SG
    try:
      sg_info = client.create_security_group(
        Description=description,
        GroupName=name,
        VpcId=vpc)
    except client.exceptions.ClientError as exception:
      raise errors.ResourceCreationError(
        'Could not create security group: {0!s}'.format(
           exception), __name__) from exception

    # SG's automatically include an everything outbound rule - remove it
    sg_rules = client.describe_security_group_rules(
      MaxResults=5,
      Filters=[{
          'Name': 'group-id',
          'Values': [sg_info['GroupId']]
        }]
      )
    for sg_rule in sg_rules['SecurityGroupRules']:
      client.revoke_security_group_egress(
        GroupId=sg_info['GroupId'],
        SecurityGroupRuleIds=[sg_rule['SecurityGroupRuleId']]
      )

    # Add the permitted ingress rules, if any
    if ingress_subnets:
      ranges = [{'CidrIp':subnet} for subnet in ingress_subnets]
      client.authorize_security_group_ingress(
        GroupId=sg_info['GroupId'],
        IpPermissions=[{
          'IpProtocol': '-1',
          'FromPort': 0,
          'ToPort': 65535,
          'IpRanges': ranges
        }]
      )
      client.authorize_security_group_egress(
        GroupId=sg_info['GroupId'],
        IpPermissions=[{
          'IpProtocol': '-1',
          'FromPort': 0,
          'ToPort': 65535,
          'IpRanges': ranges
        }]
      )

    return str(sg_info['GroupId'])
Creates an isolation security group.

Args:
vpc (str): VPC ID for the security group.
ingress_subnets (List[str]): Optional. Subnets to allow ingress from.

Returns:
str: The ID of the newly created security group.

Raises:
ipaddress.AddressValueError: If an invalid subnet is provided.
errors.ResourceCreationError: If an invalid VPC ID is provided.
libcloudforensics/providers/aws/internal/ec2.py