johnypony3/terraform-aws-security-group

Terraform module which creates EC2-VPC security groups on AWS

AWS EC2-VPC Security Group Terraform module

Terraform module which creates EC2 security group within VPC on AWS.

These types of resources are supported:

• EC2-VPC Security Group
• EC2-VPC Security Group Rule

Features

This module aims to implement ALL combinations of arguments supported by AWS and latest stable version of Terraform:

• IPv4/IPv6 CIDR blocks
• VPC endpoint prefix lists (use data source aws_prefix_list)
• Access from source security groups
• Access from self
• Named rules (see the rules here)
• Named groups of rules with ingress (inbound) and egress (outbound) ports open for common scenarios (eg, ssh, http-80, mysql, see the whole list here).

Ingress and egress rules can be configured in a variety of ways as listed on the registry documentation.

If there is a missing feature or a bug - open an issue.

Usage

There are two ways to create security groups using this module:

1. Security group with custom rules

module "vote_service_sg" {
  source = "terraform-aws-modules/security-group/aws"

  name        = "user-service"
  description = "Security group for user-service with custom ports open within VPC, and PostgreSQL publicly open"
  vpc_id      = "vpc-12345678"

  ingress_cidr_blocks      = ["10.10.0.0/16"]
  ingress_rules            = ["https-443-tcp"]
  ingress_with_cidr_blocks = [
    {
      from_port   = 8080
      to_port     = 8090
      protocol    = "tcp"
      description = "User-service ports"
      cidr_blocks = "10.10.0.0/16"
    },
    {
      rule        = "postgresql-tcp"
      cidr_blocks = "0.0.0.0/0"
    },
  ]
}

2. Security group with pre-defined rules (NOTE: This is not working with any available version of Terraform, but should be possible in 0.11)

module "web_server_sg" {
  source = "terraform-aws-modules/security-group/aws//modules/http"

  name        = "web-server"
  description = "Security group for web-server with HTTP ports open within VPC"
  vpc_id      = "vpc-12345678"

  ingress_cidr_blocks = ["10.10.0.0/16"]
}

Examples

• Complete Security Group example shows all available parameters to configure security group.
• HTTP Security Group example shows more applicable security groups for common web-servers.

How to add/update rules/groups?

Rules and groups are defined in rules.tf. Run update_groups.sh when content of that file has changed to recreate content of all automatic modules.

Authors

Module managed by Anton Babenko.

License

Apache 2 Licensed. See LICENSE for full details.