Merge pull request #2 from tedivm/optional_security_groups

Ability to specify additional security groups

Author: tedivm

README.md

@@ -17,9 +17,10 @@ module "vpn" {
   source  = "tedivm/dev-vpn/aws"
   version = "~> 1.0"
 
-  identifier = "${local.identifier}-vpn"
-  subnet_ids = module.vpc.subnets.public[*].id
-  tags       = local.common_tags
+  identifier         = "${local.identifier}-vpn"
+  subnet_ids         = module.vpc.subnets.public[*].id
+  security_group_ids = [aws_security_group.optional.id]
+  tags               = local.common_tags
 }
 
 resource "local_file" "client_config" {

network.tf

@@ -4,7 +4,7 @@ resource "aws_ec2_client_vpn_network_association" "vpn_subnets" {
 
   client_vpn_endpoint_id = aws_ec2_client_vpn_endpoint.vpn.id
   subnet_id              = var.subnet_ids[count.index]
-  security_groups        = [aws_security_group.vpn_access.id]
+  security_groups        = concat([aws_security_group.vpn_access.id], var.security_group_ids)
 
   lifecycle {
     # This is a bug workaround- https://github.com/hashicorp/terraform-provider-aws/issues/14717

variables.tf

@@ -9,6 +9,11 @@ variable "subnet_ids" {
   type        = list(string)
 }
 
+variable "security_group_ids" {
+  description = "Additional Security Groups to add to the VPN endpoint."
+  default     = []
+}
+
 variable "tags" {
   default = {}
 }