Skip to content

Commit efd196b

Browse files
SweetOpsSweetOps
authored
feat: use security-group module instead of resource (#166)
1 parent 003be6e commit efd196b

File tree

11 files changed

+216
-62
lines changed

11 files changed

+216
-62
lines changed

‎README.md

Lines changed: 37 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -159,12 +159,30 @@ For a complete example, see [examples/complete](examples/complete)
159159
updating_min_in_service = 0
160160
updating_max_batch = 1
161161
162-
loadbalancer_type = "application"
163-
vpc_id = module.vpc.vpc_id
164-
loadbalancer_subnets = module.subnets.public_subnet_ids
165-
application_subnets = module.subnets.private_subnet_ids
166-
allowed_security_groups = [module.vpc.vpc_default_security_group_id]
167-
162+
loadbalancer_type = "application"
163+
vpc_id = module.vpc.vpc_id
164+
loadbalancer_subnets = module.subnets.public_subnet_ids
165+
application_subnets = module.subnets.private_subnet_ids
166+
security_group_rules = [
167+
{
168+
type = "egress"
169+
from_port = 0
170+
to_port = 65535
171+
protocol = "-1"
172+
cidr_blocks = ["0.0.0.0/0"]
173+
source_security_group_id = null
174+
description = "Allow all outbound traffic"
175+
},
176+
{
177+
type = "ingress"
178+
from_port = 0
179+
to_port = 65535
180+
protocol = "-1"
181+
source_security_group_id = [module.vpc.vpc_default_security_group_id]
182+
cidr_blocks = null
183+
description = "Allow all ingress traffic from trusted Security Groups"
184+
},
185+
]
168186
prefer_legacy_service_policy = false
169187
170188
// https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html
@@ -194,7 +212,6 @@ For a complete example, see [examples/complete](examples/complete)
194212
}
195213
]
196214
}
197-
}
198215
```
199216

200217

@@ -233,6 +250,7 @@ Available targets:
233250
| Name | Source | Version |
234251
|------|--------|---------|
235252
| <a name="module_dns_hostname"></a> [dns\_hostname](#module\_dns\_hostname) | cloudposse/route53-cluster-hostname/aws | 0.12.0 |
253+
| <a name="module_security_group"></a> [security\_group](#module\_security\_group) | cloudposse/security-group/aws | 0.3.1 |
236254
| <a name="module_this"></a> [this](#module\_this) | cloudposse/label/null | 0.24.1 |
237255

238256
## Resources
@@ -253,7 +271,6 @@ Available targets:
253271
| [aws_iam_role_policy_attachment.web_tier](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
254272
| [aws_iam_role_policy_attachment.worker_tier](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
255273
| [aws_s3_bucket.elb_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
256-
| [aws_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
257274
| [aws_ssm_activation.ec2](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_activation) | resource |
258275
| [aws_elb_service_account.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
259276
| [aws_iam_policy_document.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -266,11 +283,9 @@ Available targets:
266283

267284
| Name | Description | Type | Default | Required |
268285
|------|-------------|------|---------|:--------:|
269-
| <a name="input_additional_security_groups"></a> [additional\_security\_groups](#input\_additional\_security\_groups) | List of security groups to be allowed to connect to the EC2 instances | `list(string)` | `[]` | no |
270286
| <a name="input_additional_settings"></a> [additional\_settings](#input\_additional\_settings) | Additional Elastic Beanstalk setttings. For full list of options, see https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/command-options-general.html | <pre>list(object({<br> namespace = string<br> name = string<br> value = string<br> }))</pre> | `[]` | no |
271287
| <a name="input_additional_tag_map"></a> [additional\_tag\_map](#input\_additional\_tag\_map) | Additional tags for appending to tags\_as\_list\_of\_maps. Not added to `tags`. | `map(string)` | `{}` | no |
272288
| <a name="input_alb_zone_id"></a> [alb\_zone\_id](#input\_alb\_zone\_id) | ALB zone id | `map(string)` | <pre>{<br> "af-south-1": "Z1EI3BVKMKK4AM",<br> "ap-east-1": "ZPWYUBWRU171A",<br> "ap-northeast-1": "Z1R25G3KIG2GBW",<br> "ap-northeast-2": "Z3JE5OI70TWKCP",<br> "ap-south-1": "Z18NTBI3Y7N9TZ",<br> "ap-southeast-1": "Z16FZ9L249IFLT",<br> "ap-southeast-2": "Z2PCDNR3VC2G1N",<br> "ca-central-1": "ZJFCZL7SSZB5I",<br> "eu-central-1": "Z1FRNW7UH4DEZJ",<br> "eu-north-1": "Z23GO28BZ5AETM",<br> "eu-south-1": "Z10VDYYOA2JFKM",<br> "eu-west-1": "Z2NYPWQ7DFZAZH",<br> "eu-west-2": "Z1GKAAAUGATPF1",<br> "eu-west-3": "Z3Q77PNBQS71R4",<br> "me-south-1": "Z2BBTEKR2I36N2",<br> "sa-east-1": "Z10X7K2B4QSOFV",<br> "us-east-1": "Z117KPS5GTRQ2G",<br> "us-east-2": "Z14LCN19Q5QHIC",<br> "us-gov-east-1": "Z2NIFVYYW2VKV1",<br> "us-gov-west-1": "Z31GFT0UA1I2HV",<br> "us-west-1": "Z1LQECGX5PH1X",<br> "us-west-2": "Z38NKT9BP95V3O"<br>}</pre> | no |
273-
| <a name="input_allowed_security_groups"></a> [allowed\_security\_groups](#input\_allowed\_security\_groups) | List of security groups to add to the EC2 instances | `list(string)` | `[]` | no |
274289
| <a name="input_ami_id"></a> [ami\_id](#input\_ami\_id) | The id of the AMI to associate with the Amazon EC2 instances | `string` | `null` | no |
275290
| <a name="input_application_port"></a> [application\_port](#input\_application\_port) | Port application is listening on | `number` | `80` | no |
276291
| <a name="input_application_subnets"></a> [application\_subnets](#input\_application\_subnets) | List of subnets to place EC2 instances | `list(string)` | n/a | yes |
@@ -344,6 +359,11 @@ Available targets:
344359
| <a name="input_s3_bucket_encryption_enabled"></a> [s3\_bucket\_encryption\_enabled](#input\_s3\_bucket\_encryption\_enabled) | When set to 'true' the resource will have aes256 encryption enabled by default | `bool` | `true` | no |
345360
| <a name="input_s3_bucket_versioning_enabled"></a> [s3\_bucket\_versioning\_enabled](#input\_s3\_bucket\_versioning\_enabled) | When set to 'true' the s3 origin bucket will have versioning enabled | `bool` | `true` | no |
346361
| <a name="input_scheduled_actions"></a> [scheduled\_actions](#input\_scheduled\_actions) | Define a list of scheduled actions | <pre>list(object({<br> name = string<br> minsize = string<br> maxsize = string<br> desiredcapacity = string<br> starttime = string<br> endtime = string<br> recurrence = string<br> suspend = bool<br> }))</pre> | `[]` | no |
362+
| <a name="input_security_group_description"></a> [security\_group\_description](#input\_security\_group\_description) | The Security Group description. | `string` | `"Elastic Beanstalk environment Security Group"` | no |
363+
| <a name="input_security_group_enabled"></a> [security\_group\_enabled](#input\_security\_group\_enabled) | Whether to create Security Group. | `bool` | `true` | no |
364+
| <a name="input_security_group_rules"></a> [security\_group\_rules](#input\_security\_group\_rules) | A list of maps of Security Group rules. <br>The values of map is fully complated with `aws_security_group_rule` resource. <br>To get more info see https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule . | `list(any)` | <pre>[<br> {<br> "cidr_blocks": [<br> "0.0.0.0/0"<br> ],<br> "description": "Allow all outbound traffic",<br> "from_port": 0,<br> "protocol": "-1",<br> "to_port": 65535,<br> "type": "egress"<br> }<br>]</pre> | no |
365+
| <a name="input_security_group_use_name_prefix"></a> [security\_group\_use\_name\_prefix](#input\_security\_group\_use\_name\_prefix) | Whether to create a default Security Group with unique name beginning with the normalized prefix. | `bool` | `false` | no |
366+
| <a name="input_security_groups"></a> [security\_groups](#input\_security\_groups) | A list of Security Group IDs to associate with EC2 instances. | `list(string)` | `[]` | no |
347367
| <a name="input_solution_stack_name"></a> [solution\_stack\_name](#input\_solution\_stack\_name) | Elastic Beanstalk stack, e.g. Docker, Go, Node, Java, IIS. For more info, see https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html | `string` | n/a | yes |
348368
| <a name="input_spot_fleet_on_demand_above_base_percentage"></a> [spot\_fleet\_on\_demand\_above\_base\_percentage](#input\_spot\_fleet\_on\_demand\_above\_base\_percentage) | The percentage of On-Demand Instances as part of additional capacity that your Auto Scaling group provisions beyond the SpotOnDemandBase instances. This option is relevant only when enable\_spot\_instances is true. | `number` | `-1` | no |
349369
| <a name="input_spot_fleet_on_demand_base"></a> [spot\_fleet\_on\_demand\_base](#input\_spot\_fleet\_on\_demand\_base) | The minimum number of On-Demand Instances that your Auto Scaling group provisions before considering Spot Instances as your environment scales up. This option is relevant only when enable\_spot\_instances is true. | `number` | `0` | no |
@@ -378,7 +398,9 @@ Available targets:
378398
| <a name="output_load_balancers"></a> [load\_balancers](#output\_load\_balancers) | Elastic Load Balancers in use by this environment |
379399
| <a name="output_name"></a> [name](#output\_name) | Name |
380400
| <a name="output_queues"></a> [queues](#output\_queues) | SQS queues in use by this environment |
381-
| <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | Security group id |
401+
| <a name="output_security_group_arn"></a> [security\_group\_arn](#output\_security\_group\_arn) | Elastic Beanstalk environment Security Group ARN |
402+
| <a name="output_security_group_id"></a> [security\_group\_id](#output\_security\_group\_id) | Elastic Beanstalk environment Security Group ID |
403+
| <a name="output_security_group_name"></a> [security\_group\_name](#output\_security\_group\_name) | Elastic Beanstalk environment Security Group name |
382404
| <a name="output_setting"></a> [setting](#output\_setting) | Settings specifically set for this environment |
383405
| <a name="output_tier"></a> [tier](#output\_tier) | The environment tier |
384406
| <a name="output_triggers"></a> [triggers](#output\_triggers) | Autoscaling triggers in use by this environment |
@@ -532,8 +554,8 @@ Check out [our other projects][github], [follow us on twitter][twitter], [apply
532554
### Contributors
533555

534556
<!-- markdownlint-disable -->
535-
| [![Erik Osterman][osterman_avatar]][osterman_homepage]<br/>[Erik Osterman][osterman_homepage] | [![Igor Rodionov][goruha_avatar]][goruha_homepage]<br/>[Igor Rodionov][goruha_homepage] | [![Andriy Knysh][aknysh_avatar]][aknysh_homepage]<br/>[Andriy Knysh][aknysh_homepage] | [![Guillaume Delacour][guikcd_avatar]][guikcd_homepage]<br/>[Guillaume Delacour][guikcd_homepage] | [![Viktor Erpylev][velmoga_avatar]][velmoga_homepage]<br/>[Viktor Erpylev][velmoga_homepage] | [![Lucas Pearson][pearson-lucas-dev_avatar]][pearson-lucas-dev_homepage]<br/>[Lucas Pearson][pearson-lucas-dev_homepage] | [![Chris Green][DirectRoot_avatar]][DirectRoot_homepage]<br/>[Chris Green][DirectRoot_homepage] |
536-
|---|---|---|---|---|---|---|
557+
| [![Erik Osterman][osterman_avatar]][osterman_homepage]<br/>[Erik Osterman][osterman_homepage] | [![Igor Rodionov][goruha_avatar]][goruha_homepage]<br/>[Igor Rodionov][goruha_homepage] | [![Andriy Knysh][aknysh_avatar]][aknysh_homepage]<br/>[Andriy Knysh][aknysh_homepage] | [![Guillaume Delacour][guikcd_avatar]][guikcd_homepage]<br/>[Guillaume Delacour][guikcd_homepage] | [![Viktor Erpylev][velmoga_avatar]][velmoga_homepage]<br/>[Viktor Erpylev][velmoga_homepage] | [![Lucas Pearson][pearson-lucas-dev_avatar]][pearson-lucas-dev_homepage]<br/>[Lucas Pearson][pearson-lucas-dev_homepage] | [![Chris Green][DirectRoot_avatar]][DirectRoot_homepage]<br/>[Chris Green][DirectRoot_homepage] | [![Vladimir Syromyatnikov][SweetOps_avatar]][SweetOps_homepage]<br/>[Vladimir Syromyatnikov][SweetOps_homepage] |
558+
|---|---|---|---|---|---|---|---|
537559
<!-- markdownlint-restore -->
538560

539561

@@ -556,6 +578,8 @@ Check out [our other projects][github], [follow us on twitter][twitter], [apply
556578
[pearson-lucas-dev_avatar]: https://img.cloudposse.com/150x150/https://github.com/pearson-lucas-dev.png
557579
[DirectRoot_homepage]: https://github.com/DirectRoot
558580
[DirectRoot_avatar]: https://img.cloudposse.com/150x150/https://github.com/DirectRoot.png
581+
[SweetOps_homepage]: https://github.com/SweetOps
582+
[SweetOps_avatar]: https://img.cloudposse.com/150x150/https://github.com/SweetOps.png
559583

560584
[![README Footer][readme_footer_img]][readme_footer_link]
561585
[![Beacon][beacon]][website]

‎README.yaml

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -125,12 +125,30 @@ usage: |-
125125
updating_min_in_service = 0
126126
updating_max_batch = 1
127127
128-
loadbalancer_type = "application"
129-
vpc_id = module.vpc.vpc_id
130-
loadbalancer_subnets = module.subnets.public_subnet_ids
131-
application_subnets = module.subnets.private_subnet_ids
132-
allowed_security_groups = [module.vpc.vpc_default_security_group_id]
133-
128+
loadbalancer_type = "application"
129+
vpc_id = module.vpc.vpc_id
130+
loadbalancer_subnets = module.subnets.public_subnet_ids
131+
application_subnets = module.subnets.private_subnet_ids
132+
security_group_rules = [
133+
{
134+
type = "egress"
135+
from_port = 0
136+
to_port = 65535
137+
protocol = "-1"
138+
cidr_blocks = ["0.0.0.0/0"]
139+
source_security_group_id = null
140+
description = "Allow all outbound traffic"
141+
},
142+
{
143+
type = "ingress"
144+
from_port = 0
145+
to_port = 65535
146+
protocol = "-1"
147+
source_security_group_id = [module.vpc.vpc_default_security_group_id]
148+
cidr_blocks = null
149+
description = "Allow all ingress traffic from trusted Security Groups"
150+
},
151+
]
134152
prefer_legacy_service_policy = false
135153
136154
// https://docs.aws.amazon.com/elasticbeanstalk/latest/platforms/platforms-supported.html
@@ -160,7 +178,6 @@ usage: |-
160178
}
161179
]
162180
}
163-
}
164181
```
165182
166183
include:
@@ -189,3 +206,5 @@ contributors:
189206
github: "pearson-lucas-dev"
190207
- name: "Chris Green"
191208
github: "DirectRoot"
209+
- name: "Vladimir Syromyatnikov"
210+
github: "SweetOps"

0 commit comments

Comments
 (0)