AWS_SG_Module.tf/main.tf at main · jhermesn/AWS_SG_Module.tf · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# AWS Security Group Module
resource "aws_security_group" "this" {
  name        = var.name
  description = var.description == "" ? "Security group for ${var.name}" : var.description
  vpc_id      = var.vpc_id
  tags        = merge(var.tags, { Name = var.name }) # Ensure Name tag exists

  # Ingress Rules
  dynamic "ingress" {
    for_each = var.ingress_rules
    content {
      description      = lookup(ingress.value, "description", null)
      from_port        = lookup(ingress.value, "from_port", null)
      to_port          = lookup(ingress.value, "to_port", null)
      protocol         = lookup(ingress.value, "protocol", null)
      cidr_blocks      = lookup(ingress.value, "cidr_blocks", null)
      ipv6_cidr_blocks = lookup(ingress.value, "ipv6_cidr_blocks", null)
      prefix_list_ids  = lookup(ingress.value, "prefix_list_ids", null)
      security_groups  = lookup(ingress.value, "security_groups", null)
      self             = lookup(ingress.value, "self", null)
    }
  }

  # Ingress Rules with CIDR blocks specified as strings
  dynamic "ingress" {
    for_each = var.ingress_with_cidr_blocks
    content {
      description = lookup(ingress.value, "description", null)
      from_port   = lookup(ingress.value, "from_port", null)
      to_port     = lookup(ingress.value, "to_port", null)
      protocol    = lookup(ingress.value, "protocol", null)
      cidr_blocks = [ingress.value.cidr_blocks] # Wrap string in a list
    }
  }

  # Ingress Rules with Source Security Group ID specified as string
  dynamic "ingress" {
    for_each = var.ingress_with_source_security_group_id
    content {
      description     = lookup(ingress.value, "description", null)
      from_port       = lookup(ingress.value, "from_port", null)
      to_port         = lookup(ingress.value, "to_port", null)
      protocol        = lookup(ingress.value, "protocol", null)
      security_groups = [ingress.value.source_security_group_id] # Wrap string in a list
    }
  }

  # Egress Rules
  dynamic "egress" {
    for_each = var.egress_rules
    content {
      description      = lookup(egress.value, "description", null)
      from_port        = lookup(egress.value, "from_port", null)
      to_port          = lookup(egress.value, "to_port", null)
      protocol         = lookup(egress.value, "protocol", null)
      cidr_blocks      = lookup(egress.value, "cidr_blocks", null)
      ipv6_cidr_blocks = lookup(egress.value, "ipv6_cidr_blocks", null)
      prefix_list_ids  = lookup(egress.value, "prefix_list_ids", null)
      security_groups  = lookup(egress.value, "security_groups", null)
      self             = lookup(egress.value, "self", null)
    }
  }

  # Egress Rules with CIDR blocks specified as strings
  dynamic "egress" {
    for_each = var.egress_with_cidr_blocks
    content {
      description = lookup(egress.value, "description", null)
      from_port   = lookup(egress.value, "from_port", null)
      to_port     = lookup(egress.value, "to_port", null)
      protocol    = lookup(egress.value, "protocol", null)
      cidr_blocks = [egress.value.cidr_blocks] # Wrap string in a list
    }
  }

  # Egress Rules with Destination Security Group ID specified as string
  # Note: AWS Security Group egress rules use 'security_groups' for destination SGs
  dynamic "egress" {
    for_each = var.egress_with_destination_security_group_id
    content {
      description     = lookup(egress.value, "description", null)
      from_port       = lookup(egress.value, "from_port", null)
      to_port         = lookup(egress.value, "to_port", null)
      protocol        = lookup(egress.value, "protocol", null)
      security_groups = [egress.value.destination_security_group_id] # Wrap string in a list
    }
  }

  # Default Egress Rule (Allow all outbound if no specific egress rules are defined)
  # This block is conditional based on the length of all egress rule inputs
  dynamic "egress" {
    for_each = length(var.egress_rules) == 0 && length(var.egress_with_cidr_blocks) == 0 && length(var.egress_with_destination_security_group_id) == 0 && var.create_default_egress_rule ? [1] : []
    content {
      description = "Allow all outbound traffic by default"
      from_port   = 0
      to_port     = 0
      protocol    = "-1" # Represents all protocols
      cidr_blocks = ["0.0.0.0/0"]
      ipv6_cidr_blocks = ["::/0"]
    }
  }

  lifecycle {
    create_before_destroy = true
  }
}