Skip to content

Commit 25d893b

Browse files
13archit13archit
committed
feat: Update module to be dynamic
1 parent 21bcb00 commit 25d893b

File tree

5 files changed

+414
-86
lines changed

5 files changed

+414
-86
lines changed

‎_example/new_security_group/example.tf‎

Lines changed: 16 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,8 @@ provider "aws" {
1010
####----------------------------------------------------------------------------------
1111

1212
module "vpc" {
13-
source = "clouddrove/vpc/aws"
14-
version = "2.0.0"
15-
13+
source = "clouddrove/vpc/aws"
14+
version = "2.0.0"
1615
name = "vpc"
1716
environment = "test"
1817
label_order = ["name", "environment"]
@@ -25,29 +24,20 @@ module "security_group" {
2524

2625
name = "security-group"
2726
environment = "test"
28-
label_order = ["name", "environment"]
29-
30-
## new_enable_security_group #######
31-
vpc_id = module.vpc.vpc_id
32-
new_enable_security_group = true
33-
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
34-
allowed_ports = [22, 27017]
35-
security_groups = []
36-
37-
#-------------------------------------------------------------------------------
38-
### prefix_list
39-
#-------------------------------------------------------------------------------
40-
max_entries = 5
41-
prefix_list_enabled = true
42-
prefix_list_id = []
43-
entry = [
44-
{
45-
cidr = "10.0.0.0/16"
46-
description = "VPC CIDR"
27+
vpc_id = module.vpc.vpc_id
28+
# allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
29+
# allowed_ports = [22, 27017]
30+
# security_groups = []
31+
new_sg_ingress_rules_with_cidr_blocks = [{
32+
from_port = 22
33+
protocol = "-1"
34+
to_port = 22
35+
cidr_blocks = [module.vpc.vpc_cidr_block, "172.16.0.0/16"]
4736
},
4837
{
49-
cidr = "10.10.0.0/24"
50-
description = "VPC CIDR"
51-
}
52-
]
38+
from_port = 27017
39+
protocol = "tcp"
40+
to_port = 27017
41+
cidr_blocks = ["172.16.0.0/16"]
42+
}]
5343
}

‎_example/new_security_group/outputs.tf‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,18 @@
1-
output "tags" {
2-
value = module.security_group.tags
3-
description = "A mapping of tags to assign to the resource."
4-
}
1+
# output "tags" {
2+
# value = module.security_group.tags
3+
# description = "A mapping of tags to assign to the resource."
4+
# }
55

6-
output "security_group_ids" {
7-
value = module.security_group.security_group_ids
8-
description = "A mapping of security group ids."
9-
}
10-
output "vpc_cidr_block" {
11-
value = module.vpc.vpc_cidr_block
12-
description = "VPC IPV4 CIDR Block."
13-
}
6+
# output "security_group_ids" {
7+
# value = module.security_group.security_group_ids
8+
# description = "A mapping of security group ids."
9+
# }
10+
# output "vpc_cidr_block" {
11+
# value = module.vpc.vpc_cidr_block
12+
# description = "VPC IPV4 CIDR Block."
13+
# }
1414

15-
output "vpc_cidr_block_ipv6" {
16-
value = module.vpc.ipv6_cidr_block
17-
description = "VPC IPV4 CIDR Block."
18-
}
15+
# output "vpc_cidr_block_ipv6" {
16+
# value = module.vpc.ipv6_cidr_block
17+
# description = "VPC IPV4 CIDR Block."
18+
# }

‎main.tf‎

Lines changed: 241 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1,41 +1,251 @@
1-
#-------------------------------------------------------------------------------
2-
### prefix_list
3-
#-------------------------------------------------------------------------------
4-
module "prefix_list" {
5-
source = "./modules/prefix_list"
1+
# Managed By : CloudDrove
2+
# Copyright @ CloudDrove. All Right Reserved.
63

4+
5+
##-----------------------------------------------------------------------------
6+
## Labels module callled that will be used for naming and tags.
7+
##-----------------------------------------------------------------------------
8+
module "labels" {
9+
source = "clouddrove/labels/aws"
10+
version = "1.3.0"
711
name = var.name
812
environment = var.environment
13+
managedby = var.managedby
914
label_order = var.label_order
15+
repository = var.repository
16+
}
1017

11-
max_entries = var.max_entries
12-
prefix_list_enabled = var.prefix_list_enabled
13-
entry = var.entry
18+
##-----------------------------------------------------------------------------
19+
## Below resource will deploy new security group in aws.
20+
##-----------------------------------------------------------------------------
21+
resource "aws_security_group" "default" {
22+
count = var.enable && var.new_sg ? 1 : 0
23+
name = module.labels.id
24+
vpc_id = var.vpc_id
25+
description = var.sg_description
26+
tags = module.labels.tags
27+
lifecycle {
28+
create_before_destroy = true
29+
}
1430
}
1531

16-
##----------------------------------------------------------------------------------
17-
## Below module will create SECURITY-GROUP and its components.
18-
##----------------------------------------------------------------------------------
19-
module "security_group" {
20-
source = "./modules/security_group"
32+
##-----------------------------------------------------------------------------
33+
## Below data resource is to get details of existing security group in your aws environment.
34+
## Will be called when you provide existing security group id in 'existing_sg_id' variable.
35+
##-----------------------------------------------------------------------------
36+
data "aws_security_group" "existing" {
37+
count = var.enable && var.existing_sg_id != null ? 1 : 0
38+
id = var.existing_sg_id
39+
vpc_id = var.vpc_id
40+
}
2141

22-
name = var.name
23-
environment = var.environment
24-
label_order = var.label_order
42+
##-----------------------------------------------------------------------------
43+
## Below resource will deploy prefix list resource in aws.
44+
##-----------------------------------------------------------------------------
45+
resource "aws_ec2_managed_prefix_list" "prefix_list" {
46+
count = var.enable && var.prefix_list_enabled && length(var.prefix_list_ids) < 1 ? 1 : 0
47+
address_family = var.prefix_list_address_family
48+
max_entries = var.max_entries
49+
name = format("%s-prefix-list", module.labels.id)
50+
dynamic "entry" {
51+
for_each = var.entry
52+
content {
53+
cidr = lookup(entry.value, "cidr", null)
54+
description = lookup(entry.value, "description", null)
55+
56+
}
57+
}
58+
}
59+
60+
61+
##-----------------------------------------------------------------------------
62+
## Below resource will deploy ingress security group rules for new security group created from this module.
63+
##-----------------------------------------------------------------------------
64+
resource "aws_security_group_rule" "new_sg_ingress_with_cidr_blocks" {
65+
for_each = var.enable ? { for rule in var.new_sg_ingress_rules_with_cidr_blocks : rule.from_port => rule } : {}
66+
type = "ingress"
67+
from_port = each.value.from_port
68+
protocol = each.value.protocol
69+
to_port = each.value.to_port
70+
cidr_blocks = each.value.cidr_blocks
71+
security_group_id = aws_security_group.default[0].id
72+
ipv6_cidr_blocks = lookup(each.value, "ipv6_cidr_blocks", null)
73+
description = lookup(each.value, "description", null)
74+
}
75+
76+
resource "aws_security_group_rule" "new_sg_ingress_with_self" {
77+
for_each = var.enable ? { for rule in var.new_sg_ingress_rules_with_self : rule.from_port => rule } : {}
78+
type = "ingress"
79+
from_port = each.value.from_port
80+
protocol = each.value.protocol
81+
to_port = each.value.to_port
82+
security_group_id = aws_security_group.default[0].id
83+
self = lookup(each.value, "self", true)
84+
description = lookup(each.value, "description", null)
85+
}
86+
87+
resource "aws_security_group_rule" "new_sg_ingress_with_source_sg_id" {
88+
for_each = var.enable ? { for rule in var.new_sg_ingress_rules_with_source_sg_id : rule.from_port => rule } : {}
89+
type = "ingress"
90+
from_port = each.value.from_port
91+
protocol = each.value.protocol
92+
to_port = each.value.to_port
93+
source_security_group_id = each.value.source_security_group_id
94+
security_group_id = aws_security_group.default[0].id
95+
description = lookup(each.value, "description", null)
96+
}
97+
98+
resource "aws_security_group_rule" "new_sg_ingress_with_prefix_list" {
99+
for_each = var.enable ? { for rule in var.new_sg_ingress_rules_with_prefix_list : rule.from_port => rule } : {}
100+
type = "ingress"
101+
from_port = each.value.from_port
102+
protocol = each.value.protocol
103+
to_port = each.value.to_port
104+
security_group_id = aws_security_group.default[0].id
105+
prefix_list_ids = length(var.prefix_list_ids) == 0 ? tolist(aws_ec2_managed_prefix_list.prefix_list[0].id) : var.prefix_list_ids
106+
description = lookup(each.value, "description", null)
107+
}
108+
109+
##-----------------------------------------------------------------------------
110+
## Below resource will deploy ingress security group rules for existing security group.
111+
##-----------------------------------------------------------------------------
112+
resource "aws_security_group_rule" "existing_sg_ingress_cidr_blocks" {
113+
for_each = var.enable ? { for rule in var.existing_sg_ingress_rules_with_cidr_blocks : rule.from_port => rule } : {}
114+
type = "ingress"
115+
from_port = each.value.from_port
116+
protocol = each.value.protocol
117+
to_port = each.value.to_port
118+
security_group_id = data.aws_security_group.existing[0].id
119+
cidr_blocks = lookup(each.value, "cidr_blocks", null)
120+
ipv6_cidr_blocks = lookup(each.value, "ipv6_cidr_blocks", null)
121+
description = lookup(each.value, "description", null)
122+
}
123+
124+
resource "aws_security_group_rule" "existing_sg_ingress_with_self" {
125+
for_each = var.enable ? { for rule in var.existing_sg_ingress_rules_with_self : rule.from_port => rule } : {}
126+
type = "ingress"
127+
from_port = each.value.from_port
128+
protocol = each.value.protocol
129+
to_port = each.value.to_port
130+
security_group_id = data.aws_security_group.existing[0].id
131+
self = lookup(each.value, "self", true)
132+
description = lookup(each.value, "description", null)
133+
}
134+
135+
resource "aws_security_group_rule" "existing_sg_ingress_with_source_sg_id" {
136+
for_each = var.enable ? { for rule in var.existing_sg_ingress_rules_with_source_sg_id : rule.from_port => rule } : {}
137+
type = "ingress"
138+
from_port = each.value.from_port
139+
protocol = each.value.protocol
140+
to_port = each.value.to_port
141+
source_security_group_id = each.value.source_security_group_id
142+
security_group_id = data.aws_security_group.existing[0].id
143+
description = lookup(each.value, "description", null)
144+
}
145+
146+
resource "aws_security_group_rule" "existing_sg_ingress_with_prefix_list" {
147+
for_each = var.enable ? { for rule in var.existing_sg_ingress_rules_with_prefix_list : rule.from_port => rule } : {}
148+
type = "ingress"
149+
from_port = each.value.from_port
150+
protocol = each.value.protocol
151+
to_port = each.value.to_port
152+
security_group_id = data.aws_security_group.existing[0].id
153+
prefix_list_ids = length(var.prefix_list_ids) == 0 ? tolist(aws_ec2_managed_prefix_list.prefix_list[0].id) : var.prefix_list_ids
154+
description = lookup(each.value, "description", null)
155+
}
156+
157+
##-----------------------------------------------------------------------------
158+
## Below resource will deploy egress security group rules for new security group created from this module.
159+
##-----------------------------------------------------------------------------
160+
resource "aws_security_group_rule" "new_sg_egress_with_cidr_blocks" {
161+
for_each = var.enable ? { for rule in var.new_sg_egress_rules_with_cidr_blocks : rule.from_port => rule } : {}
162+
type = "egress"
163+
from_port = each.value.from_port
164+
protocol = each.value.protocol
165+
to_port = each.value.to_port
166+
security_group_id = aws_security_group.default[0].id
167+
cidr_blocks = lookup(each.value, "cidr_blocks", null)
168+
ipv6_cidr_blocks = lookup(each.value, "ipv6_cidr_blocks", null)
169+
description = lookup(each.value, "description", null)
170+
}
171+
172+
resource "aws_security_group_rule" "new_sg_egress_with_self" {
173+
for_each = var.enable ? { for rule in var.new_sg_egress_rules_with_self : rule.from_port => rule } : {}
174+
type = "egress"
175+
from_port = each.value.from_port
176+
protocol = each.value.protocol
177+
to_port = each.value.to_port
178+
security_group_id = aws_security_group.default[0].id
179+
self = lookup(each.value, "self", true)
180+
description = lookup(each.value, "description", null)
181+
}
182+
183+
resource "aws_security_group_rule" "new_sg_egress_with_source_sg_id" {
184+
for_each = var.enable ? { for rule in var.new_sg_egress_rules_with_source_sg_id : rule.from_port => rule } : {}
185+
type = "egress"
186+
from_port = each.value.from_port
187+
protocol = each.value.protocol
188+
to_port = each.value.to_port
189+
source_security_group_id = each.value.source_security_group_id
190+
security_group_id = aws_security_group.default[0].id
191+
description = lookup(each.value, "description", null)
192+
}
193+
194+
resource "aws_security_group_rule" "new_sg_egress_with_prefix_list" {
195+
for_each = var.enable ? { for rule in var.new_sg_egress_rules_with_prefix_list : rule.from_port => rule } : {}
196+
type = "egress"
197+
from_port = each.value.from_port
198+
protocol = each.value.protocol
199+
to_port = each.value.to_port
200+
security_group_id = aws_security_group.default[0].id
201+
prefix_list_ids = length(var.prefix_list_ids) == 0 ? tolist(aws_ec2_managed_prefix_list.prefix_list[0].id) : var.prefix_list_ids
202+
description = lookup(each.value, "description", null)
203+
}
204+
205+
##-----------------------------------------------------------------------------
206+
## Below resource will deploy egress security group rules for existing security group.
207+
##-----------------------------------------------------------------------------
208+
resource "aws_security_group_rule" "existing_sg_egress_with_cidr_blocks" {
209+
for_each = var.enable ? { for rule in var.existing_sg_egress_rules_with_cidr_blocks : rule.from_port => rule } : {}
210+
type = "egress"
211+
from_port = each.value.from_port
212+
protocol = each.value.protocol
213+
to_port = each.value.to_port
214+
security_group_id = data.aws_security_group.existing[0].id
215+
cidr_blocks = lookup(each.value, "cidr_blocks", null)
216+
ipv6_cidr_blocks = lookup(each.value, "ipv6_cidr_blocks", null)
217+
description = lookup(each.value, "description", null)
218+
}
219+
220+
resource "aws_security_group_rule" "existing_sg_egress_with_self" {
221+
for_each = var.enable ? { for rule in var.existing_sg_egress_rules_with_self : rule.from_port => rule } : {}
222+
type = "egress"
223+
from_port = each.value.from_port
224+
protocol = each.value.protocol
225+
to_port = each.value.to_port
226+
security_group_id = data.aws_security_group.existing[0].id
227+
self = lookup(each.value, "self", true)
228+
description = lookup(each.value, "description", null)
229+
}
230+
231+
resource "aws_security_group_rule" "existing_sg_egress_with_source_sg_id" {
232+
for_each = var.enable ? { for rule in var.existing_sg_egress_rules_with_source_sg_id : rule.from_port => rule } : {}
233+
type = "egress"
234+
from_port = each.value.from_port
235+
protocol = each.value.protocol
236+
to_port = each.value.to_port
237+
source_security_group_id = each.value.source_security_group_id
238+
security_group_id = data.aws_security_group.existing[0].id
239+
description = lookup(each.value, "source_address_prefix", null)
240+
}
25241

26-
enable_security_group = var.new_enable_security_group
27-
vpc_id = var.vpc_id
28-
allowed_ip = var.allowed_ip
29-
allowed_ports = var.allowed_ports
30-
security_groups = var.security_groups
31-
allowed_ipv6 = var.allowed_ipv6
32-
egress_rule = var.egress_rule
33-
egress_allowed_ip = var.egress_allowed_ip
34-
egress_allowed_ports = var.egress_allowed_ports
35-
egress_protocol = var.egress_protocol
36-
egress_prefix_list_ids = var.egress_prefix_list_ids
37-
egress_security_groups = var.egress_security_groups
38-
is_external = var.is_external
39-
existing_sg_id = var.existing_sg_id
40-
prefix_list_ids = length(var.prefix_list_id) < 1 ? module.prefix_list.prefix_id : var.prefix_list_id
242+
resource "aws_security_group_rule" "existing_sg_egress_with_prefix_list" {
243+
for_each = var.enable ? { for rule in var.existing_sg_egress_rules_with_prefix_list : rule.from_port => rule } : {}
244+
type = "egress"
245+
from_port = each.value.from_port
246+
protocol = each.value.protocol
247+
to_port = each.value.to_port
248+
security_group_id = data.aws_security_group.existing[0].id
249+
prefix_list_ids = length(var.prefix_list_ids) == 0 ? tolist(aws_ec2_managed_prefix_list.prefix_list[0].id) : var.prefix_list_ids
250+
description = lookup(each.value, "source_address_prefix", null)
41251
}

0 commit comments

Comments
 (0)