Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
6495e0b
feat: Update aws_sg_rule.ingress_rules to aws_vpc_sg_rule
kirkchong Jul 9, 2025
d0e047c
feat: Update aws_sg_rule.computed_ingress_rules to aws_vpc_sg.compute…
kirkchong Jul 19, 2025
b2a3b07
feat: Update aws_sg_rule.ingress_with_sg_id to aws_vpc_ingress_rule
kirkchong Jul 19, 2025
955fd94
feat: Update aws_sg_rule.computed_ingress_with_sg to aws_vpc_sg_ingress
kirkchong Jul 29, 2025
be794e3
feat: Add new vpc_sg_ingress_rule to maintain allow ingress_prefix_li…
kirkchong Jul 29, 2025
cc82d26
feat: Update aws_sg_rule.ingress_with_cidr_blocks to aws_vpc_ingress_…
kirkchong Jul 29, 2025
54fb79d
feat: Update aws_sg_rule.computed_ingress_with_cidr_blocks to aws_vpc…
kirkchong Sep 7, 2025
7578b15
feat: Update ipv6 ingress sg rules to vpc_security_ingress_rule
kirkchong Sep 7, 2025
e7ddde7
feat: Update aws_sg_rule.ingress_with_prefix_list_ids to aws_vpc_ingr…
kirkchong Oct 4, 2025
63920ae
feat: Update egress rules and computed egress rules to vpc_sg_egress_…
kirkchong Oct 4, 2025
82dca02
feat: Update egress source_sg_rule to referenced_sg vpc_sg_egress_rule
kirkchong Oct 4, 2025
ecbda62
feat: Update egress cidr_blocks to cidr_ipv4 vpc_sg_egress_rule
kirkchong Oct 4, 2025
8e1bc1a
feat: Update egress cidr_ipv6 to vpc_sg_egress_rule
kirkchong Oct 4, 2025
0092e00
feat: Update egress_with_self to vpc_sg_egress_rule
kirkchong Oct 4, 2025
97fcae0
feat: Update egress_with_prefix_list_ids to vpc_sg_egress_rule
kirkchong Oct 4, 2025
0138091
feat: Update docs, modules, wrappers with new variable names
kirkchong Oct 4, 2025
a347a10
feat: pre-commit docs changes
kirkchong Oct 20, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
143 changes: 81 additions & 62 deletions README.md

Large diffs are not rendered by default.

287 changes: 139 additions & 148 deletions examples/complete/main.tf

Large diffs are not rendered by default.

10 changes: 5 additions & 5 deletions examples/computed/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -24,9 +24,9 @@ module "http_sg" {
description = "Security group with HTTP port open for everyone, and HTTPS open just for the default security group"
vpc_id = data.aws_vpc.default.id

ingress_cidr_blocks = ["0.0.0.0/0"]
ingress_cidr_ipv4 = ["0.0.0.0/0"]

ingress_with_source_security_group_id = [
ingress_with_referenced_security_group_id = [
{
rule = "https-443-tcp"
source_security_group_id = data.aws_security_group.default.id
Expand All @@ -41,14 +41,14 @@ module "mysql_sg" {
description = "Security group with MySQL/Aurora port open for HTTP security group created above (computed)"
vpc_id = data.aws_vpc.default.id

ingress_cidr_blocks = ["0.0.0.0/0"]
ingress_cidr_ipv4 = ["0.0.0.0/0"]

computed_ingress_with_source_security_group_id = [
computed_ingress_with_referenced_security_group_id = [
{
rule = "mysql-tcp"
source_security_group_id = module.http_sg.security_group_id
},
]

number_of_computed_ingress_with_source_security_group_id = 1
number_of_computed_ingress_with_referenced_security_group_id = 1
}
4 changes: 2 additions & 2 deletions examples/disabled/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ module "complete_sg_disabled" {
description = "Security group with all available arguments set (this is just an example)"
vpc_id = data.aws_vpc.default.id

ingress_cidr_blocks = ["0.0.0.0/0"]
ingress_cidr_ipv4 = ["0.0.0.0/0"]
}

module "http_sg_disabled" {
Expand All @@ -36,5 +36,5 @@ module "http_sg_disabled" {
description = "Security group with HTTP ports open for everybody (IPv4 CIDR), egress ports are all world open"
vpc_id = data.aws_vpc.default.id

ingress_cidr_blocks = ["0.0.0.0/0"]
ingress_cidr_ipv4 = ["0.0.0.0/0"]
}
4 changes: 2 additions & 2 deletions examples/dynamic/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -28,9 +28,9 @@ module "http_sg" {
description = "Security group with HTTP port open for everyone, and HTTPS open just for the default security group"
vpc_id = data.aws_vpc.default.id

ingress_cidr_blocks = ["0.0.0.0/0"]
ingress_cidr_ipv4 = ["0.0.0.0/0"]

ingress_with_source_security_group_id = [
ingress_with_referenced_security_group_id = [
{
rule = "https-443-tcp"
source_security_group_id = data.aws_security_group.default.id
Expand Down
18 changes: 9 additions & 9 deletions examples/http/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ module "http_sg" {
description = "Security group with HTTP ports open for everybody (IPv4 CIDR), egress ports are all world open"
vpc_id = data.aws_vpc.default.id

ingress_cidr_blocks = ["0.0.0.0/0"]
ingress_cidr_ipv4 = ["0.0.0.0/0"]
}

###################################
Expand Down Expand Up @@ -72,7 +72,7 @@ module "http_mysql_1_sg" {
description = "Security group with HTTP and MySQL ports open for everybody (IPv4 CIDR)"
vpc_id = data.aws_vpc.default.id

ingress_cidr_blocks = ["0.0.0.0/0"]
ingress_cidr_ipv4 = ["0.0.0.0/0"]

# Add MySQL rules
ingress_rules = ["mysql-tcp"]
Expand All @@ -92,8 +92,8 @@ module "http_mysql_2_sg" {
ingress_rules = ["mysql-tcp"]

# Allow ingress rules to be accessed only within current VPC
ingress_cidr_blocks = [data.aws_vpc.default.cidr_block]
ingress_ipv6_cidr_blocks = [] # Not all VPCs have IPv6 enabled, but if you have it enabled, then this will work - ["${data.aws_vpc.default.ipv6_cidr_block}"]
ingress_cidr_ipv4 = [data.aws_vpc.default.cidr_block]
ingress_cidr_ipv6 = [] # Not all VPCs have IPv6 enabled, but if you have it enabled, then this will work - ["${data.aws_vpc.default.ipv6_cidr_block}"]
}

###########################
Expand All @@ -107,7 +107,7 @@ module "http_with_egress_minimal_sg" {
vpc_id = data.aws_vpc.default.id

# Allow ingress rules to be accessed only within current VPC
ingress_cidr_blocks = [data.aws_vpc.default.cidr_block]
ingress_cidr_ipv4 = [data.aws_vpc.default.cidr_block]

# Allow all rules for all protocols
egress_rules = ["http-80-tcp"]
Expand All @@ -127,10 +127,10 @@ module "http_with_egress_sg" {
ingress_rules = ["mysql-tcp"]

# Allow ingress rules to be accessed only within current VPC
ingress_cidr_blocks = [data.aws_vpc.default.cidr_block]
ingress_ipv6_cidr_blocks = [] # Not all VPCs have IPv6 enabled, but if you have it enabled, then this will work - ["${data.aws_vpc.default.ipv6_cidr_block}"]
ingress_cidr_ipv4 = [data.aws_vpc.default.cidr_block]
ingress_cidr_ipv6 = [] # Not all VPCs have IPv6 enabled, but if you have it enabled, then this will work - ["${data.aws_vpc.default.ipv6_cidr_block}"]

# Allow egress rules to access anything (empty list means everything)
egress_cidr_blocks = ["10.10.10.0/28"]
egress_ipv6_cidr_blocks = [] # Not all VPCs have IPv6 enabled, but if you have it enabled, then this will work - ["${data.aws_vpc.default.ipv6_cidr_block}"]
egress_cidr_ipv4 = ["10.10.10.0/28"]
egress_cidr_ipv6 = [] # Not all VPCs have IPv6 enabled, but if you have it enabled, then this will work - ["${data.aws_vpc.default.ipv6_cidr_block}"]
}
4 changes: 2 additions & 2 deletions examples/rules-only/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ module "rules_one" {

create_sg = false
security_group_id = aws_security_group.service_one.id
ingress_with_source_security_group_id = [
ingress_with_referenced_security_group_id = [
{
description = "http from service two"
rule = "http-80-tcp"
Expand All @@ -51,7 +51,7 @@ module "rules_two" {

create_sg = false
security_group_id = aws_security_group.service_two.id
ingress_with_source_security_group_id = [
ingress_with_referenced_security_group_id = [
{
description = "http from service one"
rule = "http-80-tcp"
Expand Down
Loading
Loading