Skip to content

Commit 5afaea1

Browse files
yadavprakashyadavprakash
authored
Merge pull request #32 from clouddrove/issue-451
Update Readme with latest example and added resource description
2 parents 61803d6 + 10a3adb commit 5afaea1

File tree

10 files changed

+129
-79
lines changed

10 files changed

+129
-79
lines changed

‎README.yaml‎

Lines changed: 50 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -40,20 +40,61 @@ include:
4040
# How to use this project
4141
# yamllint disable rule:line-length
4242
usage: |-
43-
### Simple Example
43+
### NEW_SECURITY_GROUP
4444
Here is an example of how you can use this module in your inventory structure:
4545
```hcl
4646
# use this
4747
module "security_group" {
4848
source = "clouddrove/security-group/aws"
4949
version = "1.3.0"
50-
name = "security-group"
51-
environment = "test"
52-
protocol = "tcp"
53-
label_order = ["name", "environment"]
54-
vpc_id = "vpc-xxxxxxxxx"
55-
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
56-
allowed_ipv6 = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
57-
allowed_ports = [22, 27017]
50+
name = "security-group"
51+
environment = "test"
52+
label_order = ["name", "environment"]
53+
54+
vpc_id = module.vpc.vpc_id
55+
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
56+
allowed_ports = [22, 27017]
57+
security_groups = ["sg-xxxxxxxxxxxx"]
58+
prefix_list_ids = ["pl-xxxxxxxxxxxx"]
5859
}
5960
```
61+
### NEW_SECURITY_GROUP_WITH_EGRESS
62+
module "security_group" {
63+
source = "clouddrove/security-group/aws"
64+
version = "1.3.0"
65+
name = "security-group"
66+
environment = "test"
67+
label_order = ["name", "environment"]
68+
69+
vpc_id = module.vpc.vpc_id
70+
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
71+
allowed_ipv6 = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
72+
allowed_ports = [22, 27017]
73+
security_groups = ["sg-xxxxxxxxx"]
74+
prefix_list_ids = ["pl-6da54004"]
75+
76+
egress_rule = true
77+
egress_allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
78+
egress_allowed_ports = [22, 27017]
79+
egress_protocol = "tcp"
80+
egress_prefix_list_ids = ["pl-xxxxxxxxx"]
81+
egress_security_groups = ["sg-xxxxxxxxx"]
82+
83+
}
84+
```
85+
### UPDATED_EXISTING
86+
module "security_group" {
87+
source = "clouddrove/security-group/aws"
88+
version = "1.3.0"
89+
name = "security-group"
90+
environment = "test"
91+
label_order = ["name", "environment"]
92+
93+
is_external = true
94+
existing_sg_id = "sg-xxxxxxxxxxxx"
95+
vpc_id = module.vpc.vpc_id
96+
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
97+
allowed_ports = [22, 27017]
98+
security_groups = ["sg-xxxxxxxxxxxxx"]
99+
}
100+
```

‎_example/new_security_group/example.tf‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
1+
####----------------------------------------------------------------------------------
2+
## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS.
3+
####----------------------------------------------------------------------------------
14
provider "aws" {
25
region = "eu-west-1"
36
}
47

8+
####----------------------------------------------------------------------------------
9+
## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center.
10+
####----------------------------------------------------------------------------------
511
module "vpc" {
612
source = "clouddrove/vpc/aws"
713
version = "1.3.1"
@@ -11,20 +17,19 @@ module "vpc" {
1117
cidr_block = "10.0.0.0/16"
1218
}
1319

20+
##----------------------------------------------------------------------------------
21+
## Below module will create SECURITY-GROUP and its components.
22+
##----------------------------------------------------------------------------------
1423
module "security_group" {
1524
source = "../../"
1625

1726
name = "security-group"
1827
environment = "test"
1928
label_order = ["name", "environment"]
2029

21-
enable_security_group = true
22-
vpc_id = module.vpc.vpc_id
23-
protocol = "tcp"
24-
description = "Instance default security group (only egress access is allowed)."
25-
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
26-
allowed_ipv6 = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
27-
allowed_ports = [22, 27017]
28-
security_groups = ["sg-xxxxxxxxxxxx"]
29-
prefix_list_ids = ["pl-xxxxxxxxxxxx"]
30+
vpc_id = module.vpc.vpc_id
31+
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
32+
allowed_ports = [22, 27017]
33+
security_groups = ["sg-xxxxxxxxxxxx"]
34+
prefix_list_ids = ["pl-xxxxxxxxxxxx"]
3035
}

‎_example/new_security_group_with_egress/example.tf‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
1+
####----------------------------------------------------------------------------------
2+
## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS.
3+
####----------------------------------------------------------------------------------
14
provider "aws" {
25
region = "eu-west-1"
36
}
47

8+
####----------------------------------------------------------------------------------
9+
## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center.
10+
####----------------------------------------------------------------------------------
511
module "vpc" {
612
source = "clouddrove/vpc/aws"
713
version = "1.3.1"
@@ -11,28 +17,27 @@ module "vpc" {
1117
cidr_block = "10.0.0.0/16"
1218
}
1319

20+
##----------------------------------------------------------------------------------
21+
## Below module will create SECURITY-GROUP and its components.
22+
##----------------------------------------------------------------------------------
1423
module "security_group" {
1524
source = "../../"
1625

1726
name = "security-group"
1827
environment = "test"
1928
label_order = ["name", "environment"]
2029

21-
enable_security_group = true
22-
vpc_id = module.vpc.vpc_id
23-
protocol = "tcp"
24-
description = "Instance default security group (only egress access is allowed)."
25-
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
26-
allowed_ipv6 = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
27-
allowed_ports = [22, 27017]
28-
security_groups = ["sg-xxxxxxxxx"]
29-
prefix_list_ids = ["pl-6da54004"]
30+
vpc_id = module.vpc.vpc_id
31+
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
32+
allowed_ipv6 = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
33+
allowed_ports = [22, 27017]
34+
security_groups = ["sg-xxxxxxxxx"]
35+
prefix_list_ids = ["pl-6da54004"]
3036

3137
egress_rule = true
3238
egress_allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
3339
egress_allowed_ports = [22, 27017]
3440
egress_protocol = "tcp"
35-
egress_allowed_ipv6 = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
3641
egress_prefix_list_ids = ["pl-xxxxxxxxx"]
3742
egress_security_groups = ["sg-xxxxxxxxx"]
3843

‎_example/new_security_group_with_egress/versions.tf‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎_example/updated_existing/example.tf‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,13 @@
1+
####----------------------------------------------------------------------------------
2+
## Provider block added, Use the Amazon Web Services (AWS) provider to interact with the many resources supported by AWS.
3+
####----------------------------------------------------------------------------------
14
provider "aws" {
25
region = "eu-west-1"
36
}
47

8+
####----------------------------------------------------------------------------------
9+
## A VPC is a virtual network that closely resembles a traditional network that you'd operate in your own data center.
10+
####----------------------------------------------------------------------------------
511
module "vpc" {
612
source = "clouddrove/vpc/aws"
713
version = "1.3.1"
@@ -11,6 +17,9 @@ module "vpc" {
1117
cidr_block = "10.0.0.0/16"
1218
}
1319

20+
##----------------------------------------------------------------------------------
21+
## Below module will create SECURITY-GROUP and its components.
22+
##----------------------------------------------------------------------------------
1423
module "security_group" {
1524
source = "../../"
1625

@@ -21,10 +30,7 @@ module "security_group" {
2130
is_external = true
2231
existing_sg_id = "sg-xxxxxxxxxxxx"
2332
vpc_id = module.vpc.vpc_id
24-
protocol = "tcp"
25-
description = "Instance default security group (only egress access is allowed)."
2633
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
27-
allowed_ipv6 = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
2834
allowed_ports = [22, 27017]
2935
security_groups = ["sg-xxxxxxxxxxxxx"]
3036
}

‎_example/updated_existing/versions.tf‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎main.tf‎

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,7 @@
1-
# Managed By : CloudDrove
2-
# Description : This Script is used to create Security Group.
3-
# Copyright @ CloudDrove. All Right Reserved.
4-
5-
#Module : Label
6-
#Description : This terraform module is designed to generate consistent label names and tags
7-
# for resources. You can use terraform-labels to implement a strict naming
8-
# convention.
9-
1+
##----------------------------------------------------------------------------------
2+
## This terraform module is designed to generate consistent label names and
3+
## tags for resources. You can use terraform-labels to implement a strict naming convention.
4+
##----------------------------------------------------------------------------------
105
module "labels" {
116
source = "clouddrove/labels/aws"
127
version = "1.3.0"
@@ -48,9 +43,9 @@ locals {
4843

4944
}
5045

51-
#Module : SECURITY GROUP
52-
#Description : Here are an example of how you can use this module in your inventory
53-
# structure:
46+
##----------------------------------------------------------------------------------
47+
## Here are an example of how you can use this resource in your inventory structure.
48+
##----------------------------------------------------------------------------------
5449
resource "aws_security_group" "default" {
5550
count = local.security_group_count
5651

@@ -69,9 +64,10 @@ data "aws_security_group" "existing" {
6964
vpc_id = var.vpc_id
7065
}
7166

72-
#Module : SECURITY GROUP RULE FOR EGRESS
73-
#Description : Provides a security group rule resource. Represents a single egress
74-
# group rule, which can be added to external Security Groups.
67+
##----------------------------------------------------------------------------------
68+
## Provides a security group rule resource. Represents a single egress
69+
## group rule, which can be added to external Security Groups.
70+
##----------------------------------------------------------------------------------
7571
resource "aws_security_group_rule" "egress" {
7672
count = (var.enable_security_group == true && local.sg_existing == false && local.egress_rule == false) ? 1 : 0
7773

@@ -80,6 +76,7 @@ resource "aws_security_group_rule" "egress" {
8076
to_port = 65535
8177
protocol = "-1"
8278
cidr_blocks = ["0.0.0.0/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
79+
description = var.security_group_egress_rule_description
8380
security_group_id = local.id
8481
}
8582
resource "aws_security_group_rule" "egress_ipv6" {
@@ -91,11 +88,14 @@ resource "aws_security_group_rule" "egress_ipv6" {
9188
protocol = "-1"
9289
ipv6_cidr_blocks = ["::/0"] #tfsec:ignore:aws-vpc-no-public-egress-sgr
9390
security_group_id = local.id
91+
description = var.security_group_egress_ipv6_rule_description
9492
prefix_list_ids = var.prefix_list
9593
}
96-
#Module : SECURITY GROUP RULE FOR INGRESS
97-
#Description : Provides a security group rule resource. Represents a single ingress
98-
# group rule, which can be added to external Security Groups.
94+
95+
##----------------------------------------------------------------------------------
96+
## Provides a security group rule resource. Represents a single ingress
97+
## group rule, which can be added to external Security Groups.
98+
##----------------------------------------------------------------------------------
9999
resource "aws_security_group_rule" "ingress" {
100100
count = local.enable_cidr_rules == true ? length(compact(var.allowed_ports)) : 0
101101

@@ -139,8 +139,10 @@ resource "aws_security_group_rule" "ingress_prefix" {
139139
security_group_id = local.id
140140
}
141141

142-
#egress rules configuration
143142

143+
##----------------------------------------------------------------------------------
144+
## egress rules configuration.
145+
##----------------------------------------------------------------------------------
144146
resource "aws_security_group_rule" "egress_ipv4_rule" {
145147
count = local.egress_rule == true ? length(compact(var.allowed_ports)) : 0
146148

‎outputs.tf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
1-
#Module : SECURITY GROUP
2-
#Description : This terraform module creates set of Security Group and Security Group Rules
3-
# resources in various combinations.
1+
##----------------------------------------------------------------------------------
2+
## This terraform module creates set of Security Group and Security Group Rules
3+
## resources in various combinations..
4+
##----------------------------------------------------------------------------------
45
output "security_group_ids" {
56
value = try(local.id, null)
67
description = "IDs on the AWS Security Groups associated with the instance."

‎variables.tf‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,18 @@ variable "description" {
6363
description = "The security group description."
6464
}
6565

66+
variable "security_group_egress_rule_description" {
67+
type = string
68+
default = "Description of the egress rule."
69+
description = "Represents a single ingress or egress group rule, which can be added to external Security Groups."
70+
}
71+
72+
variable "security_group_egress_ipv6_rule_description" {
73+
type = string
74+
default = "Description of the egress rule."
75+
description = "Represents a single ingress or egress group egress-ipv6 rule, which can be added to external Security Groups."
76+
}
77+
6678
variable "allowed_ports" {
6779
type = list(any)
6880
default = []
@@ -89,7 +101,7 @@ variable "protocol" {
89101

90102
variable "allowed_ipv6" {
91103
type = list(any)
92-
default = []
104+
default = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
93105
description = "List of allowed ipv6."
94106
}
95107

@@ -152,7 +164,7 @@ variable "egress_security_groups" {
152164

153165
variable "egress_allowed_ipv6" {
154166
type = list(any)
155-
default = []
167+
default = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
156168
description = "List of allowed ipv6."
157169
}
158170

_example/new_security_group/versions.tf renamed to versions.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
# Terraform version
22
terraform {
3-
required_version = ">= 1.3.6"
3+
required_version = ">= 1.4.6"
44

55
required_providers {
66
aws = {
77
source = "hashicorp/aws"
8-
version = ">= 4.48.0"
8+
version = ">= 5.1.0"
99
}
1010
}
1111
}

0 commit comments

Comments
 (0)