Skip to content

Commit 9322d3e

Browse files
techiescamptechiescamp
authored
Merge pull request #24 from Aswin-Vijayan/TEC-56
[TEC-56][Change] - made changes in security groups
2 parents 9ebbc72 + 47fabdd commit 9322d3e

File tree

5 files changed

+235
-125
lines changed

5 files changed

+235
-125
lines changed

‎environments/dev/alb-asg/main.tf‎

Lines changed: 62 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,37 @@ module "alb-sg" {
1414
source = "../../../modules/security-group"
1515
region = var.region
1616
tags = var.tags
17+
name = "${var.environment}-${var.application}"
1718
environment = var.environment
1819
owner = var.owner
1920
cost_center = var.cost_center
2021
application = var.application
22+
sg_name = var.alb_sg_name
2123
vpc_id = var.vpc_id
22-
ingress_from_port = var.alb_ingress_from_port
23-
ingress_to_port = var.alb_ingress_to_port
24-
ingress_protocol = var.alb_ingress_protocol
24+
25+
ingress_cidr_from_port = var.alb_ingress_cidr_from_port
26+
ingress_cidr_to_port = var.alb_ingress_cidr_to_port
27+
ingress_cidr_protocol = var.ingress_cidr_protocol
2528
ingress_cidr_block = var.alb_ingress_cidr_block
26-
egress_from_port = var.alb_egress_from_port
27-
egress_to_port = var.alb_egress_to_port
28-
egress_protocol = var.alb_egress_protocol
29+
create_ingress_cidr = var.alb_create_ingress_cidr
30+
31+
ingress_sg_from_port = var.alb_ingress_sg_from_port
32+
ingress_sg_to_port = var.alb_ingress_sg_to_port
33+
ingress_sg_protocol = var.alb_ingress_sg_protocol
34+
ingress_security_group_ids = var.security_group_id
35+
create_ingress_sg = var.alb_create_ingress_sg
36+
37+
egress_cidr_from_port = var.alb_egress_cidr_from_port
38+
egress_cidr_to_port = var.alb_egress_cidr_to_port
39+
egress_cidr_protocol = var.alb_egress_cidr_protocol
2940
egress_cidr_block = var.alb_egress_cidr_block
41+
create_egress_cidr = var.alb_create_egress_cidr
42+
43+
egress_sg_from_port = var.alb_egress_sg_from_port
44+
egress_sg_to_port = var.alb_egress_sg_to_port
45+
egress_sg_protocol = var.alb_egress_sg_protocol
46+
egress_security_group_ids = var.security_group_id
47+
create_egress_sg = var.alb_create_egress_sg
3048
}
3149

3250
module "alb" {
@@ -57,17 +75,46 @@ module "alb" {
5775
security_group_ids = module.alb-sg.security_group_ids
5876
}
5977

78+
module "instance-sg" {
79+
source = "../../../modules/security-group"
80+
region = var.region
81+
tags = var.tags
82+
name = "${var.environment}-${var.application}"
83+
environment = var.environment
84+
owner = var.owner
85+
cost_center = var.cost_center
86+
application = var.application
87+
sg_name = var.sg_name
88+
vpc_id = var.vpc_id
89+
90+
ingress_cidr_from_port = var.ingress_cidr_from_port
91+
ingress_cidr_to_port = var.ingress_cidr_to_port
92+
ingress_cidr_protocol = var.ingress_cidr_protocol
93+
ingress_cidr_block = var.ingress_cidr_block
94+
create_ingress_cidr = var.create_ingress_cidr
95+
96+
ingress_sg_from_port = var.ingress_sg_from_port
97+
ingress_sg_to_port = var.ingress_sg_to_port
98+
ingress_sg_protocol = var.ingress_sg_protocol
99+
ingress_security_group_ids = module.alb-sg.security_group_ids
100+
create_ingress_sg = var.create_ingress_sg
101+
102+
egress_cidr_from_port = var.egress_cidr_from_port
103+
egress_cidr_to_port = var.egress_cidr_to_port
104+
egress_cidr_protocol = var.egress_cidr_protocol
105+
egress_cidr_block = var.egress_cidr_block
106+
create_egress_cidr = var.create_egress_cidr
107+
108+
egress_sg_from_port = var.egress_sg_from_port
109+
egress_sg_to_port = var.egress_sg_to_port
110+
egress_sg_protocol = var.egress_sg_protocol
111+
egress_security_group_ids = module.alb-sg.security_group_ids
112+
create_egress_sg = var.create_egress_sg
113+
}
114+
60115
module "asg" {
61116
source = "../../../modules/asg"
62117
ami_id = var.ami_id
63-
ingress_from_port = var.ingress_from_port
64-
ingress_to_port = var.ingress_to_port
65-
ingress_protocol = var.ingress_protocol
66-
ingress_cidr_block = var.ingress_cidr_block
67-
egress_from_port = var.egress_from_port
68-
egress_to_port = var.egress_to_port
69-
egress_protocol = var.egress_protocol
70-
egress_cidr_block = var.egress_cidr_block
71118
instance_type = var.instance_type
72119
key_name = var.key_name
73120
vpc_id = var.vpc_id
@@ -84,7 +131,7 @@ module "asg" {
84131
application = var.application
85132
alb_target_group_arn = module.alb.alb_target_group_arn
86133
iam_role = module.iam-policy.iam_role
87-
security_group_ids = module.alb-sg.security_group_ids
134+
security_group_ids = module.instance-sg.security_group_ids
88135
tags = {
89136
Owner = "${var.owner}"
90137
Environment = "${var.environment}"

‎environments/dev/alb-asg/variables.tf‎

Lines changed: 128 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -120,11 +120,6 @@ variable "asg_subnets" {
120120
type = list(string)
121121
}
122122

123-
variable "security_group_ids" {
124-
type = list(string)
125-
description = "Security group id of the ec2 instance"
126-
}
127-
128123
variable "public_access" {
129124
description = "Whether the instance is public or not"
130125
type = bool
@@ -175,83 +170,198 @@ variable "application" {
175170
description = "Name of the application"
176171
}
177172

173+
variable "security_group_id" {
174+
description = "List of security group IDs to attach"
175+
type = list(string)
176+
}
178177

179178
variable "ingress_cidr_block" {
180179
type = list(string)
181180
description = "CIDR blocks for EC2 security group ingress rules"
182181
}
183182

184-
variable "ingress_from_port" {
183+
variable "ingress_cidr_from_port" {
185184
description = "The starting port for ingress rules"
186185
type = list(number)
187186
}
188187

189-
variable "ingress_to_port" {
188+
variable "ingress_cidr_to_port" {
190189
description = "The ending port for ingress rules"
191190
type = list(number)
192191
}
193192

194-
variable "ingress_protocol" {
193+
variable "ingress_cidr_protocol" {
195194
description = "The protocol for ingress rules"
196195
type = list(any)
197196
}
198197

198+
variable "create_ingress_cidr" {
199+
description = "Whether to create the ingress cidr or not"
200+
type = bool
201+
}
202+
203+
variable "ingress_sg_from_port" {
204+
type = list(number)
205+
description = "List of starting ports for sg ingress rules"
206+
}
207+
208+
variable "ingress_sg_to_port" {
209+
type = list(number)
210+
description = "List of ending ports for sg ingress rules"
211+
}
212+
213+
variable "ingress_sg_protocol" {
214+
type = list(any)
215+
description = "List of protocols for sg ingress rules"
216+
}
217+
218+
variable "create_ingress_sg" {
219+
type = bool
220+
description = "Enable or disable Security Groups ingress rules."
221+
}
222+
199223
variable "egress_cidr_block" {
200224
type = list(string)
201-
description = "CIDR blocks for EC2 security group egress rules"
225+
description = "CIDR blocks for group egress rules"
226+
}
227+
228+
variable "egress_cidr_from_port" {
229+
description = "The starting port for egress rules"
230+
type = list(number)
231+
}
232+
233+
variable "egress_cidr_to_port" {
234+
description = "The ending port for egress rules"
235+
type = list(number)
236+
}
237+
238+
variable "egress_cidr_protocol" {
239+
description = "The protocol for egress rules"
240+
type = list(any)
241+
}
242+
243+
variable "create_egress_cidr" {
244+
type = bool
245+
description = "Enable or disable CIDR block egress rules."
202246
}
203247

204-
variable "egress_from_port" {
248+
variable "egress_sg_from_port" {
205249
description = "The starting port for egress rules"
206250
type = list(number)
207251
}
208252

209-
variable "egress_to_port" {
253+
variable "egress_sg_to_port" {
210254
description = "The ending port for egress rules"
211255
type = list(number)
212256
}
213257

214-
variable "egress_protocol" {
258+
variable "egress_sg_protocol" {
215259
description = "The protocol for egress rules"
216260
type = list(any)
217261
}
218262

263+
variable "create_egress_sg" {
264+
type = bool
265+
description = "Enable or disable CIDR block egress rules."
266+
}
267+
268+
219269
variable "alb_ingress_cidr_block" {
220270
type = list(string)
221271
description = "CIDR blocks for EC2 security group ingress rules"
222272
}
223273

224-
variable "alb_ingress_from_port" {
274+
variable "alb_ingress_cidr_from_port" {
225275
description = "The starting port for ingress rules"
226276
type = list(number)
227277
}
228278

229-
variable "alb_ingress_to_port" {
279+
variable "alb_ingress_cidr_to_port" {
230280
description = "The ending port for ingress rules"
231281
type = list(number)
232282
}
233283

234-
variable "alb_ingress_protocol" {
284+
variable "alb_ingress_cidr_protocol" {
235285
description = "The protocol for ingress rules"
236286
type = list(any)
237287
}
238288

289+
variable "alb_create_ingress_cidr" {
290+
description = "Whether to create the ingress cidr or not"
291+
type = bool
292+
}
293+
294+
variable "alb_ingress_sg_from_port" {
295+
type = list(number)
296+
description = "List of starting ports for sg ingress rules of the EC2 security group."
297+
}
298+
299+
variable "alb_ingress_sg_to_port" {
300+
type = list(number)
301+
description = "List of ending ports for sg ingress rules of the EC2 security group."
302+
}
303+
304+
variable "alb_ingress_sg_protocol" {
305+
type = list(any)
306+
description = "List of protocols for sg ingress rules of the EC2 security group."
307+
}
308+
309+
variable "alb_create_ingress_sg" {
310+
type = bool
311+
description = "Enable or disable Security Groups ingress rules."
312+
}
313+
239314
variable "alb_egress_cidr_block" {
240315
type = list(string)
241316
description = "CIDR blocks for EC2 security group egress rules"
242317
}
243318

244-
variable "alb_egress_from_port" {
319+
variable "alb_egress_cidr_from_port" {
245320
description = "The starting port for egress rules"
246321
type = list(number)
247322
}
248323

249-
variable "alb_egress_to_port" {
324+
variable "alb_egress_cidr_to_port" {
250325
description = "The ending port for egress rules"
251326
type = list(number)
252327
}
253328

254-
variable "alb_egress_protocol" {
329+
variable "alb_egress_cidr_protocol" {
255330
description = "The protocol for egress rules"
256331
type = list(any)
332+
}
333+
334+
variable "alb_create_egress_cidr" {
335+
type = bool
336+
description = "Enable or disable CIDR block egress rules."
337+
}
338+
339+
variable "alb_egress_sg_from_port" {
340+
description = "The starting port for egress rules"
341+
type = list(number)
342+
}
343+
344+
variable "alb_egress_sg_to_port" {
345+
description = "The ending port for egress rules"
346+
type = list(number)
347+
}
348+
349+
variable "alb_egress_sg_protocol" {
350+
description = "The protocol for egress rules"
351+
type = list(any)
352+
}
353+
354+
variable "alb_create_egress_sg" {
355+
type = bool
356+
description = "Enable or disable CIDR block egress rules."
357+
}
358+
359+
variable "sg_name" {
360+
type = string
361+
description = "Name of the security group for the instance."
362+
}
363+
364+
variable "alb_sg_name" {
365+
type = string
366+
description = "Name of the security group for the instance."
257367
}

‎modules/asg/main.tf‎

Lines changed: 1 addition & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -5,44 +5,6 @@ locals {
55
)
66
}
77

8-
resource "aws_security_group" "instance_sg" {
9-
name = "${var.environment}-${var.application}-instance-sg"
10-
description = "Security Group for Instance"
11-
vpc_id = var.vpc_id
12-
13-
dynamic "ingress" {
14-
for_each = toset(range(length(var.ingress_from_port)))
15-
content {
16-
from_port = var.ingress_from_port[ingress.key]
17-
to_port = var.ingress_to_port[ingress.key]
18-
protocol = var.ingress_protocol[ingress.key]
19-
security_groups = var.security_group_ids
20-
}
21-
}
22-
23-
dynamic "egress" {
24-
for_each = toset(range(length(var.egress_from_port)))
25-
content {
26-
from_port = var.egress_from_port[egress.key]
27-
to_port = var.egress_to_port[egress.key]
28-
protocol = var.egress_protocol[egress.key]
29-
cidr_blocks = var.egress_cidr_block
30-
}
31-
}
32-
33-
tags = merge(
34-
{
35-
"Name" = "${var.environment}-${var.application}-sg"
36-
"Environment" = var.environment
37-
"Owner" = var.owner
38-
"CostCenter" = var.cost_center
39-
"Application" = var.application
40-
},
41-
var.tags
42-
)
43-
44-
}
45-
468
resource "aws_iam_instance_profile" "instance_profile" {
479
name = "${var.environment}-${var.application}-instance_profile"
4810

@@ -61,7 +23,7 @@ resource "aws_launch_template" "application_lt" {
6123

6224
network_interfaces {
6325
associate_public_ip_address = var.public_access
64-
security_groups = [aws_security_group.instance_sg.id]
26+
security_groups = var.security_group_ids
6527
}
6628

6729
user_data = base64encode(var.user_data)

0 commit comments

Comments
 (0)