1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

terraform {
  required_version = ">= 1.15.0, < 2.0.0"
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = ">= 6.0, < 7.0"
    }
  }
}

provider "aws" {
  region = "ap-south-1"
}

module "sg" {
  source = "../../modules/security-groups"

  vpc_id      = "vpc-0a2e1bc9f29f31215"
  name_prefix = "sandbox-sg-test"

  security_groups = {

    web = {
      name_suffix = "web-sg"
      description = "Web tier - exercises multi-CIDR, IPv6, self"

      ingress_rules = [
        {
          description      = "HTTPS from internet"
          protocol         = "tcp"
          from_port        = 443
          to_port          = 443
          ipv4_cidr_blocks = ["0.0.0.0/0"]
        },
        {
          description      = "SSH from office + VPN"
          protocol         = "tcp"
          from_port        = 22
          to_port          = 22
          ipv4_cidr_blocks = ["10.0.0.0/16", "192.168.50.0/24"]
        },
        {
          description      = "HTTPS from internet (IPv6)"
          protocol         = "tcp"
          from_port        = 443
          to_port          = 443
          ipv6_cidr_blocks = ["::/0"]
        },
        {
          description = "Health check between web instances"
          protocol    = "tcp"
          from_port   = 8080
          to_port     = 8080
          self        = true
        },
      ]

      egress_rules = [
        {
          description   = "To db tier"
          protocol      = "tcp"
          from_port     = 5432
          to_port       = 5432
          source_sg_key = "db"
        },
        {
          description  = "To pre-existing default SG"
          protocol     = "tcp"
          from_port    = 9100
          to_port      = 9100
          source_sg_id = "sg-0a1f705f08895b7f9"
        },
      ]
    }

    db = {
      name_suffix = "db-sg"
      description = "DB tier - exercises source_sg_key"

      ingress_rules = [
        {
          description   = "Postgres from web tier"
          protocol      = "tcp"
          from_port     = 5432
          to_port       = 5432
          source_sg_key = "web"
        },
      ]

      egress_rules = []
    }
  }

  tags = {}
}

output "sg_ids" {
  value = module.sg.ids
}

output "sg_names" {
  value = module.sg.names
}

output "ingress_rule_ids" {
  value = module.sg.ingress_rule_ids
}

output "egress_rule_ids" {
  value = module.sg.egress_rule_ids
}

output "rule_counts" {
  value = module.sg.rule_counts
}