[| no | +| auto\_egress\_with\_self | List of maps defining egress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_ingress\_rules | List of ingress rules to add automatically | `list(string)` |
"all-all"
]
[| no | +| auto\_ingress\_with\_self | List of maps defining ingress rules with self to add automatically | `list(map(string))` |
"minio-tcp"
]
[| no | +| auto\_number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| computed\_egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed egress rules | `list(string)` |
{
"rule": "all-all"
}
]
[| no | +| computed\_egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed egress rules | `list(string)` |
"0.0.0.0/0"
]
[| no | +| computed\_egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `list(string)` | `[]` | no | +| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no | +| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_self | List of computed egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_source\_security\_group\_id | List of computed egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_rules | List of computed ingress rules to create by name | `list(string)` | `[]` | no | +| computed\_ingress\_with\_cidr\_blocks | List of computed ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_ipv6\_cidr\_blocks | List of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_self | List of computed ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_source\_security\_group\_id | List of computed ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| create | Whether to create security group and all rules | `bool` | `true` | no | +| description | Description of security group | `string` | `"Security Group managed by Terraform"` | no | +| egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all egress rules | `list(string)` |
"::/0"
]
[| no | +| egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all egress rules | `list(string)` |
"0.0.0.0/0"
]
[| no | +| egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules | `list(string)` | `[]` | no | +| egress\_rules | List of egress rules to create by name | `list(string)` | `[]` | no | +| egress\_with\_cidr\_blocks | List of egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_ipv6\_cidr\_blocks | List of egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_self | List of egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| egress\_with\_source\_security\_group\_id | List of egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_rules | List of ingress rules to create by name | `list(string)` | `[]` | no | +| ingress\_with\_cidr\_blocks | List of ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_ipv6\_cidr\_blocks | List of ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_self | List of ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| ingress\_with\_source\_security\_group\_id | List of ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| name | Name of security group | `string` | n/a | yes | +| number\_of\_computed\_egress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_cidr\_blocks | Number of computed egress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_ipv6\_cidr\_blocks | Number of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_source\_security\_group\_id | Number of computed egress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_cidr\_blocks | Number of computed ingress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | +| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | +| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| this\_security\_group\_description | The description of the security group | +| this\_security\_group\_id | The ID of the security group | +| this\_security\_group\_name | The name of the security group | +| this\_security\_group\_owner\_id | The owner ID | +| this\_security\_group\_vpc\_id | The VPC ID | + + diff --git a/modules/minio/auto_values.tf b/modules/minio/auto_values.tf new file mode 100644 index 00000000..d5df7976 --- /dev/null +++ b/modules/minio/auto_values.tf @@ -0,0 +1,79 @@ +# This file was generated from values defined in rules.tf using update_groups.sh. +################################### +# DO NOT CHANGE THIS FILE MANUALLY +################################### + +variable "auto_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = ["minio-tcp"] +} + +variable "auto_ingress_with_self" { + description = "List of maps defining ingress rules with self to add automatically" + type = list(map(string)) + default = [{ "rule" = "all-all" }] +} + +variable "auto_egress_rules" { + description = "List of egress rules to add automatically" + type = list(string) + default = ["all-all"] +} + +variable "auto_egress_with_self" { + description = "List of maps defining egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Computed +variable "auto_computed_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_ingress_with_self" { + description = "List of maps defining computed ingress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +variable "auto_computed_egress_rules" { + description = "List of computed egress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_egress_with_self" { + description = "List of maps defining computed egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Number of computed rules +variable "auto_number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + diff --git a/modules/minio/main.tf b/modules/minio/main.tf new file mode 100644 index 00000000..2c85546f --- /dev/null +++ b/modules/minio/main.tf @@ -0,0 +1,114 @@ +module "sg" { + source = "../../" + + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + tags = var.tags + + ########## + # Ingress + ########## + # Rules by names - open for default CIDR + ingress_rules = sort(compact(distinct(concat(var.auto_ingress_rules, var.ingress_rules, [""])))) + + # Open for self + ingress_with_self = concat(var.auto_ingress_with_self, var.ingress_with_self) + + # Open to IPv4 cidr blocks + ingress_with_cidr_blocks = var.ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + ingress_with_ipv6_cidr_blocks = var.ingress_with_ipv6_cidr_blocks + + # Open for security group id + ingress_with_source_security_group_id = var.ingress_with_source_security_group_id + + # Default ingress CIDR blocks + ingress_cidr_blocks = var.ingress_cidr_blocks + ingress_ipv6_cidr_blocks = var.ingress_ipv6_cidr_blocks + + # Default prefix list ids + ingress_prefix_list_ids = var.ingress_prefix_list_ids + + ################### + # Computed Ingress + ################### + # Rules by names - open for default CIDR + computed_ingress_rules = sort(compact(distinct(concat(var.auto_computed_ingress_rules, var.computed_ingress_rules, [""])))) + + # Open for self + computed_ingress_with_self = concat(var.auto_computed_ingress_with_self, var.computed_ingress_with_self) + + # Open to IPv4 cidr blocks + computed_ingress_with_cidr_blocks = var.computed_ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_ingress_with_ipv6_cidr_blocks = var.computed_ingress_with_ipv6_cidr_blocks + + # Open for security group id + computed_ingress_with_source_security_group_id = var.computed_ingress_with_source_security_group_id + + ############################# + # Number of computed ingress + ############################# + number_of_computed_ingress_rules = var.auto_number_of_computed_ingress_rules + var.number_of_computed_ingress_rules + number_of_computed_ingress_with_self = var.auto_number_of_computed_ingress_with_self + var.number_of_computed_ingress_with_self + number_of_computed_ingress_with_cidr_blocks = var.number_of_computed_ingress_with_cidr_blocks + number_of_computed_ingress_with_ipv6_cidr_blocks = var.number_of_computed_ingress_with_ipv6_cidr_blocks + number_of_computed_ingress_with_source_security_group_id = var.number_of_computed_ingress_with_source_security_group_id + + ######### + # Egress + ######### + # Rules by names - open for default CIDR + egress_rules = sort(compact(distinct(concat(var.auto_egress_rules, var.egress_rules, [""])))) + + # Open for self + egress_with_self = concat(var.auto_egress_with_self, var.egress_with_self) + + # Open to IPv4 cidr blocks + egress_with_cidr_blocks = var.egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + egress_with_ipv6_cidr_blocks = var.egress_with_ipv6_cidr_blocks + + # Open for security group id + egress_with_source_security_group_id = var.egress_with_source_security_group_id + + # Default egress CIDR blocks + egress_cidr_blocks = var.egress_cidr_blocks + egress_ipv6_cidr_blocks = var.egress_ipv6_cidr_blocks + + # Default prefix list ids + egress_prefix_list_ids = var.egress_prefix_list_ids + + ################## + # Computed Egress + ################## + # Rules by names - open for default CIDR + computed_egress_rules = sort(compact(distinct(concat(var.auto_computed_egress_rules, var.computed_egress_rules, [""])))) + + # Open for self + computed_egress_with_self = concat(var.auto_computed_egress_with_self, var.computed_egress_with_self) + + # Open to IPv4 cidr blocks + computed_egress_with_cidr_blocks = var.computed_egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_egress_with_ipv6_cidr_blocks = var.computed_egress_with_ipv6_cidr_blocks + + # Open for security group id + computed_egress_with_source_security_group_id = var.computed_egress_with_source_security_group_id + + ############################# + # Number of computed egress + ############################# + number_of_computed_egress_rules = var.auto_number_of_computed_egress_rules + var.number_of_computed_egress_rules + number_of_computed_egress_with_self = var.auto_number_of_computed_egress_with_self + var.number_of_computed_egress_with_self + number_of_computed_egress_with_cidr_blocks = var.number_of_computed_egress_with_cidr_blocks + number_of_computed_egress_with_ipv6_cidr_blocks = var.number_of_computed_egress_with_ipv6_cidr_blocks + number_of_computed_egress_with_source_security_group_id = var.number_of_computed_egress_with_source_security_group_id +} diff --git a/modules/minio/outputs.tf b/modules/minio/outputs.tf new file mode 100644 index 00000000..3d7ad67f --- /dev/null +++ b/modules/minio/outputs.tf @@ -0,0 +1,24 @@ +output "this_security_group_id" { + description = "The ID of the security group" + value = module.sg.this_security_group_id +} + +output "this_security_group_vpc_id" { + description = "The VPC ID" + value = module.sg.this_security_group_vpc_id +} + +output "this_security_group_owner_id" { + description = "The owner ID" + value = module.sg.this_security_group_owner_id +} + +output "this_security_group_name" { + description = "The name of the security group" + value = module.sg.this_security_group_name +} + +output "this_security_group_description" { + description = "The description of the security group" + value = module.sg.this_security_group_description +} diff --git a/modules/minio/variables.tf b/modules/minio/variables.tf new file mode 100644 index 00000000..354b9e37 --- /dev/null +++ b/modules/minio/variables.tf @@ -0,0 +1,342 @@ +################# +# Security group +################# +variable "create" { + description = "Whether to create security group and all rules" + type = bool + default = true +} + +variable "vpc_id" { + description = "ID of the VPC where to create security group" + type = string +} + +variable "name" { + description = "Name of security group" + type = string +} + +variable "use_name_prefix" { + description = "Whether to use name_prefix or fixed name. Should be true to able to update security group name after initial creation" + type = bool + default = true +} + +variable "description" { + description = "Description of security group" + type = string + default = "Security Group managed by Terraform" +} + +variable "tags" { + description = "A mapping of tags to assign to security group" + type = map(string) + default = {} +} + +########## +# Ingress +########## +variable "ingress_rules" { + description = "List of ingress rules to create by name" + type = list(string) + default = [] +} + +variable "ingress_with_self" { + description = "List of ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "ingress_with_cidr_blocks" { + description = "List of ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_ipv6_cidr_blocks" { + description = "List of ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_source_security_group_id" { + description = "List of ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules" + type = list(string) + default = [] +} + +################### +# Computed Ingress +################### +variable "computed_ingress_rules" { + description = "List of computed ingress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_ingress_with_self" { + description = "List of computed ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_cidr_blocks" { + description = "List of computed ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_ipv6_cidr_blocks" { + description = "List of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_source_security_group_id" { + description = "List of computed ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = list(string) + default = [] +} + +################################### +# Number of computed ingress rules +################################### +variable "number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_cidr_blocks" { + description = "Number of computed ingress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_ipv6_cidr_blocks" { + description = "Number of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_source_security_group_id" { + description = "Number of computed ingress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = number + default = 0 +} + +######### +# Egress +######### +variable "egress_rules" { + description = "List of egress rules to create by name" + type = list(string) + default = [] +} + +variable "egress_with_self" { + description = "List of egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "egress_with_cidr_blocks" { + description = "List of egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_ipv6_cidr_blocks" { + description = "List of egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_source_security_group_id" { + description = "List of egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all egress rules" + type = list(string) + default = ["::/0"] +} + +variable "egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules" + type = list(string) + default = [] +} + +################## +# Computed Egress +################## +variable "computed_egress_rules" { + description = "List of computed egress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_egress_with_self" { + description = "List of computed egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_cidr_blocks" { + description = "List of computed egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_ipv6_cidr_blocks" { + description = "List of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_source_security_group_id" { + description = "List of computed egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "computed_egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["::/0"] +} + +variable "computed_egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = list(string) + default = [] +} + +################################## +# Number of computed egress rules +################################## +variable "number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_cidr_blocks" { + description = "Number of computed egress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_ipv6_cidr_blocks" { + description = "Number of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_source_security_group_id" { + description = "Number of computed egress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = number + default = 0 +} diff --git a/modules/minio/versions.tf b/modules/minio/versions.tf new file mode 100644 index 00000000..b8569144 --- /dev/null +++ b/modules/minio/versions.tf @@ -0,0 +1,7 @@ +terraform { + required_version = "~> 0.12.6" + + required_providers { + aws = "~> 2.42" + } +} diff --git a/rules.tf b/rules.tf index f88bb418..c96a9385 100644 --- a/rules.tf +++ b/rules.tf @@ -80,6 +80,8 @@ variable "rules" { ldaps-tcp = [636, 636, "tcp", "LDAPS"] # Memcached memcached-tcp = [11211, 11211, "tcp", "Memcached"] + # MinIO + minio-tcp = [9000, 9000, "tcp", "MinIO"] # MongoDB mongodb-27017-tcp = [27017, 27017, "tcp", "MongoDB"] mongodb-27018-tcp = [27018, 27018, "tcp", "MongoDB shard"] @@ -271,6 +273,11 @@ variable "auto_groups" { ingress_with_self = ["all-all"] egress_rules = ["all-all"] } + minio = { + ingress_rules = ["minio-tcp"] + ingress_with_self = ["all-all"] + egress_rules = ["all-all"] + } mongodb = { ingress_rules = ["mongodb-27017-tcp", "mongodb-27018-tcp", "mongodb-27019-tcp"] ingress_with_self = ["all-all"] From 373e0d324cc57e4302842b199cd6b660f493c584 Mon Sep 17 00:00:00 2001 From: Anton Babenko
"::/0"
]
{
"activemq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"activemq-5671-tcp",
"activemq-8883-tcp",
"activemq-61614-tcp",
"activemq-61617-tcp",
"activemq-61619-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"alertmanager": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"alertmanager-9093-tcp",
"alertmanager-9094-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"carbon-relay-ng": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"carbon-line-in-tcp",
"carbon-line-in-udp",
"carbon-pickle-tcp",
"carbon-pickle-udp",
"carbon-gui-udp"
],
"ingress_with_self": [
"all-all"
]
},
"cassandra": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"cassandra-clients-tcp",
"cassandra-thrift-clients-tcp",
"cassandra-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"consul": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"consul-tcp",
"consul-cli-rpc-tcp",
"consul-webui-tcp",
"consul-dns-tcp",
"consul-dns-udp",
"consul-serf-lan-tcp",
"consul-serf-lan-udp",
"consul-serf-wan-tcp",
"consul-serf-wan-udp"
],
"ingress_with_self": [
"all-all"
]
},
"docker-swarm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"docker-swarm-mngmt-tcp",
"docker-swarm-node-tcp",
"docker-swarm-node-udp",
"docker-swarm-overlay-udp"
],
"ingress_with_self": [
"all-all"
]
},
"elasticsearch": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"elasticsearch-rest-tcp",
"elasticsearch-java-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"grafana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"grafana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"graphite-statsd": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"graphite-webui",
"graphite-2003-tcp",
"graphite-2004-tcp",
"graphite-2023-tcp",
"graphite-2024-tcp",
"graphite-8080-tcp",
"graphite-8125-tcp",
"graphite-8125-udp",
"graphite-8126-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-80": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-8080": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-8080-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-8443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-8443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-4500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-4500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"kafka": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kafka-broker-tcp",
"kafka-broker-tls-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kibana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kibana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kubernetes-api": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kubernetes-api-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ldaps": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ldaps-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"memcached": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"memcached-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mongodb": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mongodb-27017-tcp",
"mongodb-27018-tcp",
"mongodb-27019-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mssql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mssql-tcp",
"mssql-udp",
"mssql-analytics-tcp",
"mssql-broker-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mysql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mysql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nfs": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nfs-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nomad": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nomad-http-tcp",
"nomad-rpc-tcp",
"nomad-serf-tcp",
"nomad-serf-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ntp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ntp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"openvpn": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"openvpn-udp",
"openvpn-tcp",
"openvpn-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"oracle-db": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"oracle-db-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"postgresql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"postgresql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"prometheus": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"prometheus-http-tcp",
"prometheus-pushgateway-http-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"puppet": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"puppet-tcp",
"puppetdb-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rabbitmq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rabbitmq-4369-tcp",
"rabbitmq-5671-tcp",
"rabbitmq-5672-tcp",
"rabbitmq-15672-tcp",
"rabbitmq-25672-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rdp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rdp-tcp",
"rdp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"redis": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redis-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"redshift": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redshift-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"splunk": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"splunk-indexer-tcp",
"splunk-clients-tcp",
"splunk-splunkd-tcp",
"splunk-hec-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"squid": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"squid-proxy-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ssh": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ssh-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"storm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"storm-nimbus-tcp",
"storm-ui-tcp",
"storm-supervisor-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"web": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp",
"http-8080-tcp",
"https-443-tcp",
"web-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"winrm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"winrm-http-tcp",
"winrm-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zipkin": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zipkin-admin-tcp",
"zipkin-admin-query-tcp",
"zipkin-admin-web-tcp",
"zipkin-query-tcp",
"zipkin-web-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zookeeper": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zookeeper-2181-tcp",
"zookeeper-2888-tcp",
"zookeeper-3888-tcp",
"zookeeper-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
}
} | no |
+| auto\_groups | Map of groups of security group rules to use to generate modules (see update\_groups.sh) | `map(map(list(string)))` | {
"activemq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"activemq-5671-tcp",
"activemq-8883-tcp",
"activemq-61614-tcp",
"activemq-61617-tcp",
"activemq-61619-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"alertmanager": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"alertmanager-9093-tcp",
"alertmanager-9094-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"carbon-relay-ng": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"carbon-line-in-tcp",
"carbon-line-in-udp",
"carbon-pickle-tcp",
"carbon-pickle-udp",
"carbon-gui-udp"
],
"ingress_with_self": [
"all-all"
]
},
"cassandra": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"cassandra-clients-tcp",
"cassandra-thrift-clients-tcp",
"cassandra-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"consul": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"consul-tcp",
"consul-cli-rpc-tcp",
"consul-webui-tcp",
"consul-dns-tcp",
"consul-dns-udp",
"consul-serf-lan-tcp",
"consul-serf-lan-udp",
"consul-serf-wan-tcp",
"consul-serf-wan-udp"
],
"ingress_with_self": [
"all-all"
]
},
"docker-swarm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"docker-swarm-mngmt-tcp",
"docker-swarm-node-tcp",
"docker-swarm-node-udp",
"docker-swarm-overlay-udp"
],
"ingress_with_self": [
"all-all"
]
},
"elasticsearch": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"elasticsearch-rest-tcp",
"elasticsearch-java-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"grafana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"grafana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"graphite-statsd": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"graphite-webui",
"graphite-2003-tcp",
"graphite-2004-tcp",
"graphite-2023-tcp",
"graphite-2024-tcp",
"graphite-8080-tcp",
"graphite-8125-tcp",
"graphite-8125-udp",
"graphite-8126-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-80": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-8080": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-8080-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-8443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-8443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-4500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-4500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"kafka": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kafka-broker-tcp",
"kafka-broker-tls-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kibana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kibana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kubernetes-api": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kubernetes-api-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ldaps": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ldaps-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"memcached": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"memcached-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"minio": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"minio-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mongodb": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mongodb-27017-tcp",
"mongodb-27018-tcp",
"mongodb-27019-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mssql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mssql-tcp",
"mssql-udp",
"mssql-analytics-tcp",
"mssql-broker-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mysql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mysql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nfs": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nfs-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nomad": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nomad-http-tcp",
"nomad-rpc-tcp",
"nomad-serf-tcp",
"nomad-serf-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ntp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ntp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"openvpn": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"openvpn-udp",
"openvpn-tcp",
"openvpn-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"oracle-db": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"oracle-db-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"postgresql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"postgresql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"prometheus": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"prometheus-http-tcp",
"prometheus-pushgateway-http-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"puppet": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"puppet-tcp",
"puppetdb-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rabbitmq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rabbitmq-4369-tcp",
"rabbitmq-5671-tcp",
"rabbitmq-5672-tcp",
"rabbitmq-15672-tcp",
"rabbitmq-25672-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rdp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rdp-tcp",
"rdp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"redis": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redis-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"redshift": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redshift-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"splunk": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"splunk-indexer-tcp",
"splunk-clients-tcp",
"splunk-splunkd-tcp",
"splunk-hec-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"squid": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"squid-proxy-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ssh": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ssh-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"storm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"storm-nimbus-tcp",
"storm-ui-tcp",
"storm-supervisor-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"web": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp",
"http-8080-tcp",
"https-443-tcp",
"web-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"winrm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"winrm-http-tcp",
"winrm-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zipkin": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zipkin-admin-tcp",
"zipkin-admin-query-tcp",
"zipkin-admin-web-tcp",
"zipkin-query-tcp",
"zipkin-web-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zookeeper": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zookeeper-2181-tcp",
"zookeeper-2888-tcp",
"zookeeper-3888-tcp",
"zookeeper-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
}
} | no |
| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no |
| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no |
| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no |
@@ -214,7 +214,7 @@ No issue is creating limit on this module.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
-| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | {
"_": [
"",
"",
""
],
"activemq-5671-tcp": [
5671,
5671,
"tcp",
"ActiveMQ AMQP"
],
"activemq-61614-tcp": [
61614,
61614,
"tcp",
"ActiveMQ STOMP"
],
"activemq-61617-tcp": [
61617,
61617,
"tcp",
"ActiveMQ OpenWire"
],
"activemq-61619-tcp": [
61619,
61619,
"tcp",
"ActiveMQ WebSocket"
],
"activemq-8883-tcp": [
8883,
8883,
"tcp",
"ActiveMQ MQTT"
],
"alertmanager-9093-tcp": [
9093,
9093,
"tcp",
"Alert Manager"
],
"alertmanager-9094-tcp": [
9094,
9094,
"tcp",
"Alert Manager Cluster"
],
"all-all": [
-1,
-1,
"-1",
"All protocols"
],
"all-icmp": [
-1,
-1,
"icmp",
"All IPV4 ICMP"
],
"all-ipv6-icmp": [
-1,
-1,
58,
"All IPV6 ICMP"
],
"all-tcp": [
0,
65535,
"tcp",
"All TCP ports"
],
"all-udp": [
0,
65535,
"udp",
"All UDP ports"
],
"carbon-admin-tcp": [
2004,
2004,
"tcp",
"Carbon admin"
],
"carbon-gui-udp": [
8081,
8081,
"tcp",
"Carbon GUI"
],
"carbon-line-in-tcp": [
2003,
2003,
"tcp",
"Carbon line-in"
],
"carbon-line-in-udp": [
2003,
2003,
"udp",
"Carbon line-in"
],
"carbon-pickle-tcp": [
2013,
2013,
"tcp",
"Carbon pickle"
],
"carbon-pickle-udp": [
2013,
2013,
"udp",
"Carbon pickle"
],
"cassandra-clients-tcp": [
9042,
9042,
"tcp",
"Cassandra clients"
],
"cassandra-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
],
"cassandra-thrift-clients-tcp": [
9160,
9160,
"tcp",
"Cassandra Thrift clients"
],
"consul-cli-rpc-tcp": [
8400,
8400,
"tcp",
"Consul CLI RPC"
],
"consul-dns-tcp": [
8600,
8600,
"tcp",
"Consul DNS"
],
"consul-dns-udp": [
8600,
8600,
"udp",
"Consul DNS"
],
"consul-serf-lan-tcp": [
8301,
8301,
"tcp",
"Serf LAN"
],
"consul-serf-lan-udp": [
8301,
8301,
"udp",
"Serf LAN"
],
"consul-serf-wan-tcp": [
8302,
8302,
"tcp",
"Serf WAN"
],
"consul-serf-wan-udp": [
8302,
8302,
"udp",
"Serf WAN"
],
"consul-tcp": [
8300,
8300,
"tcp",
"Consul server"
],
"consul-webui-tcp": [
8500,
8500,
"tcp",
"Consul web UI"
],
"dns-tcp": [
53,
53,
"tcp",
"DNS"
],
"dns-udp": [
53,
53,
"udp",
"DNS"
],
"docker-swarm-mngmt-tcp": [
2377,
2377,
"tcp",
"Docker Swarm cluster management"
],
"docker-swarm-node-tcp": [
7946,
7946,
"tcp",
"Docker Swarm node"
],
"docker-swarm-node-udp": [
7946,
7946,
"udp",
"Docker Swarm node"
],
"docker-swarm-overlay-udp": [
4789,
4789,
"udp",
"Docker Swarm Overlay Network Traffic"
],
"elasticsearch-java-tcp": [
9300,
9300,
"tcp",
"Elasticsearch Java interface"
],
"elasticsearch-rest-tcp": [
9200,
9200,
"tcp",
"Elasticsearch REST interface"
],
"grafana-tcp": [
3000,
3000,
"tcp",
"Grafana Dashboard"
],
"graphite-2003-tcp": [
2003,
2003,
"tcp",
"Carbon receiver plain text"
],
"graphite-2004-tcp": [
2004,
2004,
"tcp",
"Carbon receiver pickle"
],
"graphite-2023-tcp": [
2023,
2023,
"tcp",
"Carbon aggregator plaintext"
],
"graphite-2024-tcp": [
2024,
2024,
"tcp",
"Carbon aggregator pickle"
],
"graphite-8080-tcp": [
8080,
8080,
"tcp",
"Graphite gunicorn port"
],
"graphite-8125-tcp": [
8125,
8125,
"tcp",
"Statsd TCP"
],
"graphite-8125-udp": [
8125,
8125,
"udp",
"Statsd UDP default"
],
"graphite-8126-tcp": [
8126,
8126,
"tcp",
"Statsd admin"
],
"graphite-webui": [
80,
80,
"tcp",
"Graphite admin interface"
],
"http-80-tcp": [
80,
80,
"tcp",
"HTTP"
],
"http-8080-tcp": [
8080,
8080,
"tcp",
"HTTP"
],
"https-443-tcp": [
443,
443,
"tcp",
"HTTPS"
],
"https-8443-tcp": [
8443,
8443,
"tcp",
"HTTPS"
],
"ipsec-4500-udp": [
4500,
4500,
"udp",
"IPSEC NAT-T"
],
"ipsec-500-udp": [
500,
500,
"udp",
"IPSEC ISAKMP"
],
"kafka-broker-tcp": [
9092,
9092,
"tcp",
"Kafka broker 0.8.2+"
],
"kafka-broker-tls-tcp": [
9094,
9094,
"tcp",
"Kafka TLS enabled broker 0.8.2+"
],
"kibana-tcp": [
5601,
5601,
"tcp",
"Kibana Web Interface"
],
"kubernetes-api-tcp": [
6443,
6443,
"tcp",
"Kubernetes API Server"
],
"ldaps-tcp": [
636,
636,
"tcp",
"LDAPS"
],
"memcached-tcp": [
11211,
11211,
"tcp",
"Memcached"
],
"mongodb-27017-tcp": [
27017,
27017,
"tcp",
"MongoDB"
],
"mongodb-27018-tcp": [
27018,
27018,
"tcp",
"MongoDB shard"
],
"mongodb-27019-tcp": [
27019,
27019,
"tcp",
"MongoDB config server"
],
"mssql-analytics-tcp": [
2383,
2383,
"tcp",
"MSSQL Analytics"
],
"mssql-broker-tcp": [
4022,
4022,
"tcp",
"MSSQL Broker"
],
"mssql-tcp": [
1433,
1433,
"tcp",
"MSSQL Server"
],
"mssql-udp": [
1434,
1434,
"udp",
"MSSQL Browser"
],
"mysql-tcp": [
3306,
3306,
"tcp",
"MySQL/Aurora"
],
"nfs-tcp": [
2049,
2049,
"tcp",
"NFS/EFS"
],
"nomad-http-tcp": [
4646,
4646,
"tcp",
"Nomad HTTP"
],
"nomad-rpc-tcp": [
4647,
4647,
"tcp",
"Nomad RPC"
],
"nomad-serf-tcp": [
4648,
4648,
"tcp",
"Serf"
],
"nomad-serf-udp": [
4648,
4648,
"udp",
"Serf"
],
"ntp-udp": [
123,
123,
"udp",
"NTP"
],
"openvpn-https-tcp": [
443,
443,
"tcp",
"OpenVPN"
],
"openvpn-tcp": [
943,
943,
"tcp",
"OpenVPN"
],
"openvpn-udp": [
1194,
1194,
"udp",
"OpenVPN"
],
"oracle-db-tcp": [
1521,
1521,
"tcp",
"Oracle"
],
"postgresql-tcp": [
5432,
5432,
"tcp",
"PostgreSQL"
],
"prometheus-http-tcp": [
9090,
9090,
"tcp",
"Prometheus"
],
"prometheus-pushgateway-http-tcp": [
9091,
9091,
"tcp",
"Prometheus Pushgateway"
],
"puppet-tcp": [
8140,
8140,
"tcp",
"Puppet"
],
"puppetdb-tcp": [
8081,
8081,
"tcp",
"PuppetDB"
],
"rabbitmq-15672-tcp": [
15672,
15672,
"tcp",
"RabbitMQ"
],
"rabbitmq-25672-tcp": [
25672,
25672,
"tcp",
"RabbitMQ"
],
"rabbitmq-4369-tcp": [
4369,
4369,
"tcp",
"RabbitMQ epmd"
],
"rabbitmq-5671-tcp": [
5671,
5671,
"tcp",
"RabbitMQ"
],
"rabbitmq-5672-tcp": [
5672,
5672,
"tcp",
"RabbitMQ"
],
"rdp-tcp": [
3389,
3389,
"tcp",
"Remote Desktop"
],
"rdp-udp": [
3389,
3389,
"udp",
"Remote Desktop"
],
"redis-tcp": [
6379,
6379,
"tcp",
"Redis"
],
"redshift-tcp": [
5439,
5439,
"tcp",
"Redshift"
],
"splunk-hec-tcp": [
8088,
8088,
"tcp",
"Splunk HEC"
],
"splunk-indexer-tcp": [
9997,
9997,
"tcp",
"Splunk indexer"
],
"splunk-splunkd-tcp": [
8089,
8089,
"tcp",
"Splunkd"
],
"splunk-web-tcp": [
8000,
8000,
"tcp",
"Splunk Web"
],
"squid-proxy-tcp": [
3128,
3128,
"tcp",
"Squid default proxy"
],
"ssh-tcp": [
22,
22,
"tcp",
"SSH"
],
"storm-nimbus-tcp": [
6627,
6627,
"tcp",
"Nimbus"
],
"storm-supervisor-tcp": [
6700,
6703,
"tcp",
"Supervisor"
],
"storm-ui-tcp": [
8080,
8080,
"tcp",
"Storm UI"
],
"web-jmx-tcp": [
1099,
1099,
"tcp",
"JMX"
],
"winrm-http-tcp": [
5985,
5985,
"tcp",
"WinRM HTTP"
],
"winrm-https-tcp": [
5986,
5986,
"tcp",
"WinRM HTTPS"
],
"zipkin-admin-query-tcp": [
9901,
9901,
"tcp",
"Zipkin Admin port query"
],
"zipkin-admin-tcp": [
9990,
9990,
"tcp",
"Zipkin Admin port collector"
],
"zipkin-admin-web-tcp": [
9991,
9991,
"tcp",
"Zipkin Admin port web"
],
"zipkin-query-tcp": [
9411,
9411,
"tcp",
"Zipkin query port"
],
"zipkin-web-tcp": [
8080,
8080,
"tcp",
"Zipkin web port"
],
"zookeeper-2181-tcp": [
2181,
2181,
"tcp",
"Zookeeper"
],
"zookeeper-2888-tcp": [
2888,
2888,
"tcp",
"Zookeeper"
],
"zookeeper-3888-tcp": [
3888,
3888,
"tcp",
"Zookeeper"
],
"zookeeper-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
]
} | no |
+| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | {
"_": [
"",
"",
""
],
"activemq-5671-tcp": [
5671,
5671,
"tcp",
"ActiveMQ AMQP"
],
"activemq-61614-tcp": [
61614,
61614,
"tcp",
"ActiveMQ STOMP"
],
"activemq-61617-tcp": [
61617,
61617,
"tcp",
"ActiveMQ OpenWire"
],
"activemq-61619-tcp": [
61619,
61619,
"tcp",
"ActiveMQ WebSocket"
],
"activemq-8883-tcp": [
8883,
8883,
"tcp",
"ActiveMQ MQTT"
],
"alertmanager-9093-tcp": [
9093,
9093,
"tcp",
"Alert Manager"
],
"alertmanager-9094-tcp": [
9094,
9094,
"tcp",
"Alert Manager Cluster"
],
"all-all": [
-1,
-1,
"-1",
"All protocols"
],
"all-icmp": [
-1,
-1,
"icmp",
"All IPV4 ICMP"
],
"all-ipv6-icmp": [
-1,
-1,
58,
"All IPV6 ICMP"
],
"all-tcp": [
0,
65535,
"tcp",
"All TCP ports"
],
"all-udp": [
0,
65535,
"udp",
"All UDP ports"
],
"carbon-admin-tcp": [
2004,
2004,
"tcp",
"Carbon admin"
],
"carbon-gui-udp": [
8081,
8081,
"tcp",
"Carbon GUI"
],
"carbon-line-in-tcp": [
2003,
2003,
"tcp",
"Carbon line-in"
],
"carbon-line-in-udp": [
2003,
2003,
"udp",
"Carbon line-in"
],
"carbon-pickle-tcp": [
2013,
2013,
"tcp",
"Carbon pickle"
],
"carbon-pickle-udp": [
2013,
2013,
"udp",
"Carbon pickle"
],
"cassandra-clients-tcp": [
9042,
9042,
"tcp",
"Cassandra clients"
],
"cassandra-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
],
"cassandra-thrift-clients-tcp": [
9160,
9160,
"tcp",
"Cassandra Thrift clients"
],
"consul-cli-rpc-tcp": [
8400,
8400,
"tcp",
"Consul CLI RPC"
],
"consul-dns-tcp": [
8600,
8600,
"tcp",
"Consul DNS"
],
"consul-dns-udp": [
8600,
8600,
"udp",
"Consul DNS"
],
"consul-serf-lan-tcp": [
8301,
8301,
"tcp",
"Serf LAN"
],
"consul-serf-lan-udp": [
8301,
8301,
"udp",
"Serf LAN"
],
"consul-serf-wan-tcp": [
8302,
8302,
"tcp",
"Serf WAN"
],
"consul-serf-wan-udp": [
8302,
8302,
"udp",
"Serf WAN"
],
"consul-tcp": [
8300,
8300,
"tcp",
"Consul server"
],
"consul-webui-tcp": [
8500,
8500,
"tcp",
"Consul web UI"
],
"dns-tcp": [
53,
53,
"tcp",
"DNS"
],
"dns-udp": [
53,
53,
"udp",
"DNS"
],
"docker-swarm-mngmt-tcp": [
2377,
2377,
"tcp",
"Docker Swarm cluster management"
],
"docker-swarm-node-tcp": [
7946,
7946,
"tcp",
"Docker Swarm node"
],
"docker-swarm-node-udp": [
7946,
7946,
"udp",
"Docker Swarm node"
],
"docker-swarm-overlay-udp": [
4789,
4789,
"udp",
"Docker Swarm Overlay Network Traffic"
],
"elasticsearch-java-tcp": [
9300,
9300,
"tcp",
"Elasticsearch Java interface"
],
"elasticsearch-rest-tcp": [
9200,
9200,
"tcp",
"Elasticsearch REST interface"
],
"grafana-tcp": [
3000,
3000,
"tcp",
"Grafana Dashboard"
],
"graphite-2003-tcp": [
2003,
2003,
"tcp",
"Carbon receiver plain text"
],
"graphite-2004-tcp": [
2004,
2004,
"tcp",
"Carbon receiver pickle"
],
"graphite-2023-tcp": [
2023,
2023,
"tcp",
"Carbon aggregator plaintext"
],
"graphite-2024-tcp": [
2024,
2024,
"tcp",
"Carbon aggregator pickle"
],
"graphite-8080-tcp": [
8080,
8080,
"tcp",
"Graphite gunicorn port"
],
"graphite-8125-tcp": [
8125,
8125,
"tcp",
"Statsd TCP"
],
"graphite-8125-udp": [
8125,
8125,
"udp",
"Statsd UDP default"
],
"graphite-8126-tcp": [
8126,
8126,
"tcp",
"Statsd admin"
],
"graphite-webui": [
80,
80,
"tcp",
"Graphite admin interface"
],
"http-80-tcp": [
80,
80,
"tcp",
"HTTP"
],
"http-8080-tcp": [
8080,
8080,
"tcp",
"HTTP"
],
"https-443-tcp": [
443,
443,
"tcp",
"HTTPS"
],
"https-8443-tcp": [
8443,
8443,
"tcp",
"HTTPS"
],
"ipsec-4500-udp": [
4500,
4500,
"udp",
"IPSEC NAT-T"
],
"ipsec-500-udp": [
500,
500,
"udp",
"IPSEC ISAKMP"
],
"kafka-broker-tcp": [
9092,
9092,
"tcp",
"Kafka broker 0.8.2+"
],
"kafka-broker-tls-tcp": [
9094,
9094,
"tcp",
"Kafka TLS enabled broker 0.8.2+"
],
"kibana-tcp": [
5601,
5601,
"tcp",
"Kibana Web Interface"
],
"kubernetes-api-tcp": [
6443,
6443,
"tcp",
"Kubernetes API Server"
],
"ldaps-tcp": [
636,
636,
"tcp",
"LDAPS"
],
"memcached-tcp": [
11211,
11211,
"tcp",
"Memcached"
],
"minio-tcp": [
9000,
9000,
"tcp",
"MinIO"
],
"mongodb-27017-tcp": [
27017,
27017,
"tcp",
"MongoDB"
],
"mongodb-27018-tcp": [
27018,
27018,
"tcp",
"MongoDB shard"
],
"mongodb-27019-tcp": [
27019,
27019,
"tcp",
"MongoDB config server"
],
"mssql-analytics-tcp": [
2383,
2383,
"tcp",
"MSSQL Analytics"
],
"mssql-broker-tcp": [
4022,
4022,
"tcp",
"MSSQL Broker"
],
"mssql-tcp": [
1433,
1433,
"tcp",
"MSSQL Server"
],
"mssql-udp": [
1434,
1434,
"udp",
"MSSQL Browser"
],
"mysql-tcp": [
3306,
3306,
"tcp",
"MySQL/Aurora"
],
"nfs-tcp": [
2049,
2049,
"tcp",
"NFS/EFS"
],
"nomad-http-tcp": [
4646,
4646,
"tcp",
"Nomad HTTP"
],
"nomad-rpc-tcp": [
4647,
4647,
"tcp",
"Nomad RPC"
],
"nomad-serf-tcp": [
4648,
4648,
"tcp",
"Serf"
],
"nomad-serf-udp": [
4648,
4648,
"udp",
"Serf"
],
"ntp-udp": [
123,
123,
"udp",
"NTP"
],
"openvpn-https-tcp": [
443,
443,
"tcp",
"OpenVPN"
],
"openvpn-tcp": [
943,
943,
"tcp",
"OpenVPN"
],
"openvpn-udp": [
1194,
1194,
"udp",
"OpenVPN"
],
"oracle-db-tcp": [
1521,
1521,
"tcp",
"Oracle"
],
"postgresql-tcp": [
5432,
5432,
"tcp",
"PostgreSQL"
],
"prometheus-http-tcp": [
9090,
9090,
"tcp",
"Prometheus"
],
"prometheus-pushgateway-http-tcp": [
9091,
9091,
"tcp",
"Prometheus Pushgateway"
],
"puppet-tcp": [
8140,
8140,
"tcp",
"Puppet"
],
"puppetdb-tcp": [
8081,
8081,
"tcp",
"PuppetDB"
],
"rabbitmq-15672-tcp": [
15672,
15672,
"tcp",
"RabbitMQ"
],
"rabbitmq-25672-tcp": [
25672,
25672,
"tcp",
"RabbitMQ"
],
"rabbitmq-4369-tcp": [
4369,
4369,
"tcp",
"RabbitMQ epmd"
],
"rabbitmq-5671-tcp": [
5671,
5671,
"tcp",
"RabbitMQ"
],
"rabbitmq-5672-tcp": [
5672,
5672,
"tcp",
"RabbitMQ"
],
"rdp-tcp": [
3389,
3389,
"tcp",
"Remote Desktop"
],
"rdp-udp": [
3389,
3389,
"udp",
"Remote Desktop"
],
"redis-tcp": [
6379,
6379,
"tcp",
"Redis"
],
"redshift-tcp": [
5439,
5439,
"tcp",
"Redshift"
],
"splunk-hec-tcp": [
8088,
8088,
"tcp",
"Splunk HEC"
],
"splunk-indexer-tcp": [
9997,
9997,
"tcp",
"Splunk indexer"
],
"splunk-splunkd-tcp": [
8089,
8089,
"tcp",
"Splunkd"
],
"splunk-web-tcp": [
8000,
8000,
"tcp",
"Splunk Web"
],
"squid-proxy-tcp": [
3128,
3128,
"tcp",
"Squid default proxy"
],
"ssh-tcp": [
22,
22,
"tcp",
"SSH"
],
"storm-nimbus-tcp": [
6627,
6627,
"tcp",
"Nimbus"
],
"storm-supervisor-tcp": [
6700,
6703,
"tcp",
"Supervisor"
],
"storm-ui-tcp": [
8080,
8080,
"tcp",
"Storm UI"
],
"web-jmx-tcp": [
1099,
1099,
"tcp",
"JMX"
],
"winrm-http-tcp": [
5985,
5985,
"tcp",
"WinRM HTTP"
],
"winrm-https-tcp": [
5986,
5986,
"tcp",
"WinRM HTTPS"
],
"zipkin-admin-query-tcp": [
9901,
9901,
"tcp",
"Zipkin Admin port query"
],
"zipkin-admin-tcp": [
9990,
9990,
"tcp",
"Zipkin Admin port collector"
],
"zipkin-admin-web-tcp": [
9991,
9991,
"tcp",
"Zipkin Admin port web"
],
"zipkin-query-tcp": [
9411,
9411,
"tcp",
"Zipkin query port"
],
"zipkin-web-tcp": [
8080,
8080,
"tcp",
"Zipkin web port"
],
"zookeeper-2181-tcp": [
2181,
2181,
"tcp",
"Zookeeper"
],
"zookeeper-2888-tcp": [
2888,
2888,
"tcp",
"Zookeeper"
],
"zookeeper-3888-tcp": [
3888,
3888,
"tcp",
"Zookeeper"
],
"zookeeper-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
]
} | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/rules.tf b/rules.tf
index c96a9385..d190f74d 100644
--- a/rules.tf
+++ b/rules.tf
@@ -81,7 +81,7 @@ variable "rules" {
# Memcached
memcached-tcp = [11211, 11211, "tcp", "Memcached"]
# MinIO
- minio-tcp = [9000, 9000, "tcp", "MinIO"]
+ minio-tcp = [9000, 9000, "tcp", "MinIO"]
# MongoDB
mongodb-27017-tcp = [27017, 27017, "tcp", "MongoDB"]
mongodb-27018-tcp = [27018, 27018, "tcp", "MongoDB shard"]
From 8799422bab175e523ac6ddbf7d44fe6b0a1dc627 Mon Sep 17 00:00:00 2001
From: Anton Babenko {
"activemq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"activemq-5671-tcp",
"activemq-8883-tcp",
"activemq-61614-tcp",
"activemq-61617-tcp",
"activemq-61619-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"alertmanager": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"alertmanager-9093-tcp",
"alertmanager-9094-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"carbon-relay-ng": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"carbon-line-in-tcp",
"carbon-line-in-udp",
"carbon-pickle-tcp",
"carbon-pickle-udp",
"carbon-gui-udp"
],
"ingress_with_self": [
"all-all"
]
},
"cassandra": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"cassandra-clients-tcp",
"cassandra-thrift-clients-tcp",
"cassandra-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"consul": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"consul-tcp",
"consul-cli-rpc-tcp",
"consul-webui-tcp",
"consul-dns-tcp",
"consul-dns-udp",
"consul-serf-lan-tcp",
"consul-serf-lan-udp",
"consul-serf-wan-tcp",
"consul-serf-wan-udp"
],
"ingress_with_self": [
"all-all"
]
},
"docker-swarm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"docker-swarm-mngmt-tcp",
"docker-swarm-node-tcp",
"docker-swarm-node-udp",
"docker-swarm-overlay-udp"
],
"ingress_with_self": [
"all-all"
]
},
"elasticsearch": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"elasticsearch-rest-tcp",
"elasticsearch-java-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"grafana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"grafana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"graphite-statsd": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"graphite-webui",
"graphite-2003-tcp",
"graphite-2004-tcp",
"graphite-2023-tcp",
"graphite-2024-tcp",
"graphite-8080-tcp",
"graphite-8125-tcp",
"graphite-8125-udp",
"graphite-8126-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-80": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-8080": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-8080-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-8443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-8443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-4500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-4500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"kafka": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kafka-broker-tcp",
"kafka-broker-tls-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kibana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kibana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kubernetes-api": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kubernetes-api-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ldaps": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ldaps-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"memcached": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"memcached-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"minio": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"minio-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mongodb": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mongodb-27017-tcp",
"mongodb-27018-tcp",
"mongodb-27019-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mssql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mssql-tcp",
"mssql-udp",
"mssql-analytics-tcp",
"mssql-broker-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mysql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mysql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nfs": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nfs-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nomad": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nomad-http-tcp",
"nomad-rpc-tcp",
"nomad-serf-tcp",
"nomad-serf-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ntp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ntp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"openvpn": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"openvpn-udp",
"openvpn-tcp",
"openvpn-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"oracle-db": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"oracle-db-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"postgresql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"postgresql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"prometheus": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"prometheus-http-tcp",
"prometheus-pushgateway-http-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"puppet": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"puppet-tcp",
"puppetdb-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rabbitmq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rabbitmq-4369-tcp",
"rabbitmq-5671-tcp",
"rabbitmq-5672-tcp",
"rabbitmq-15672-tcp",
"rabbitmq-25672-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rdp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rdp-tcp",
"rdp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"redis": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redis-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"redshift": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redshift-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"splunk": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"splunk-indexer-tcp",
"splunk-clients-tcp",
"splunk-splunkd-tcp",
"splunk-hec-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"squid": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"squid-proxy-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ssh": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ssh-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"storm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"storm-nimbus-tcp",
"storm-ui-tcp",
"storm-supervisor-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"web": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp",
"http-8080-tcp",
"https-443-tcp",
"web-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"winrm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"winrm-http-tcp",
"winrm-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zipkin": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zipkin-admin-tcp",
"zipkin-admin-query-tcp",
"zipkin-admin-web-tcp",
"zipkin-query-tcp",
"zipkin-web-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zookeeper": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zookeeper-2181-tcp",
"zookeeper-2888-tcp",
"zookeeper-3888-tcp",
"zookeeper-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
}
} | no |
+| auto\_groups | Map of groups of security group rules to use to generate modules (see update\_groups.sh) | `map(map(list(string)))` | {
"activemq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"activemq-5671-tcp",
"activemq-8883-tcp",
"activemq-61614-tcp",
"activemq-61617-tcp",
"activemq-61619-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"alertmanager": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"alertmanager-9093-tcp",
"alertmanager-9094-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"carbon-relay-ng": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"carbon-line-in-tcp",
"carbon-line-in-udp",
"carbon-pickle-tcp",
"carbon-pickle-udp",
"carbon-gui-udp"
],
"ingress_with_self": [
"all-all"
]
},
"cassandra": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"cassandra-clients-tcp",
"cassandra-thrift-clients-tcp",
"cassandra-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"consul": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"consul-tcp",
"consul-cli-rpc-tcp",
"consul-webui-tcp",
"consul-dns-tcp",
"consul-dns-udp",
"consul-serf-lan-tcp",
"consul-serf-lan-udp",
"consul-serf-wan-tcp",
"consul-serf-wan-udp"
],
"ingress_with_self": [
"all-all"
]
},
"docker-swarm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"docker-swarm-mngmt-tcp",
"docker-swarm-node-tcp",
"docker-swarm-node-udp",
"docker-swarm-overlay-udp"
],
"ingress_with_self": [
"all-all"
]
},
"elasticsearch": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"elasticsearch-rest-tcp",
"elasticsearch-java-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"grafana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"grafana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"graphite-statsd": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"graphite-webui",
"graphite-2003-tcp",
"graphite-2004-tcp",
"graphite-2023-tcp",
"graphite-2024-tcp",
"graphite-8080-tcp",
"graphite-8125-tcp",
"graphite-8125-udp",
"graphite-8126-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-80": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-8080": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-8080-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-8443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-8443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-4500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-4500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"kafka": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kafka-broker-tcp",
"kafka-broker-tls-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kibana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kibana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kubernetes-api": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kubernetes-api-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ldaps": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ldaps-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"logstash": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"logstash-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"memcached": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"memcached-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"minio": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"minio-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mongodb": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mongodb-27017-tcp",
"mongodb-27018-tcp",
"mongodb-27019-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mssql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mssql-tcp",
"mssql-udp",
"mssql-analytics-tcp",
"mssql-broker-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mysql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mysql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nfs": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nfs-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nomad": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nomad-http-tcp",
"nomad-rpc-tcp",
"nomad-serf-tcp",
"nomad-serf-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ntp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ntp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"openvpn": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"openvpn-udp",
"openvpn-tcp",
"openvpn-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"oracle-db": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"oracle-db-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"postgresql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"postgresql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"prometheus": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"prometheus-http-tcp",
"prometheus-pushgateway-http-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"puppet": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"puppet-tcp",
"puppetdb-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rabbitmq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rabbitmq-4369-tcp",
"rabbitmq-5671-tcp",
"rabbitmq-5672-tcp",
"rabbitmq-15672-tcp",
"rabbitmq-25672-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rdp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rdp-tcp",
"rdp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"redis": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redis-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"redshift": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redshift-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"splunk": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"splunk-indexer-tcp",
"splunk-clients-tcp",
"splunk-splunkd-tcp",
"splunk-hec-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"squid": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"squid-proxy-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ssh": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ssh-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"storm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"storm-nimbus-tcp",
"storm-ui-tcp",
"storm-supervisor-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"web": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp",
"http-8080-tcp",
"https-443-tcp",
"web-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"winrm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"winrm-http-tcp",
"winrm-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zipkin": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zipkin-admin-tcp",
"zipkin-admin-query-tcp",
"zipkin-admin-web-tcp",
"zipkin-query-tcp",
"zipkin-web-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zookeeper": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zookeeper-2181-tcp",
"zookeeper-2888-tcp",
"zookeeper-3888-tcp",
"zookeeper-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
}
} | no |
| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no |
| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no |
| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no |
@@ -214,7 +214,8 @@ No issue is creating limit on this module.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
-| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | {
"_": [
"",
"",
""
],
"activemq-5671-tcp": [
5671,
5671,
"tcp",
"ActiveMQ AMQP"
],
"activemq-61614-tcp": [
61614,
61614,
"tcp",
"ActiveMQ STOMP"
],
"activemq-61617-tcp": [
61617,
61617,
"tcp",
"ActiveMQ OpenWire"
],
"activemq-61619-tcp": [
61619,
61619,
"tcp",
"ActiveMQ WebSocket"
],
"activemq-8883-tcp": [
8883,
8883,
"tcp",
"ActiveMQ MQTT"
],
"alertmanager-9093-tcp": [
9093,
9093,
"tcp",
"Alert Manager"
],
"alertmanager-9094-tcp": [
9094,
9094,
"tcp",
"Alert Manager Cluster"
],
"all-all": [
-1,
-1,
"-1",
"All protocols"
],
"all-icmp": [
-1,
-1,
"icmp",
"All IPV4 ICMP"
],
"all-ipv6-icmp": [
-1,
-1,
58,
"All IPV6 ICMP"
],
"all-tcp": [
0,
65535,
"tcp",
"All TCP ports"
],
"all-udp": [
0,
65535,
"udp",
"All UDP ports"
],
"carbon-admin-tcp": [
2004,
2004,
"tcp",
"Carbon admin"
],
"carbon-gui-udp": [
8081,
8081,
"tcp",
"Carbon GUI"
],
"carbon-line-in-tcp": [
2003,
2003,
"tcp",
"Carbon line-in"
],
"carbon-line-in-udp": [
2003,
2003,
"udp",
"Carbon line-in"
],
"carbon-pickle-tcp": [
2013,
2013,
"tcp",
"Carbon pickle"
],
"carbon-pickle-udp": [
2013,
2013,
"udp",
"Carbon pickle"
],
"cassandra-clients-tcp": [
9042,
9042,
"tcp",
"Cassandra clients"
],
"cassandra-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
],
"cassandra-thrift-clients-tcp": [
9160,
9160,
"tcp",
"Cassandra Thrift clients"
],
"consul-cli-rpc-tcp": [
8400,
8400,
"tcp",
"Consul CLI RPC"
],
"consul-dns-tcp": [
8600,
8600,
"tcp",
"Consul DNS"
],
"consul-dns-udp": [
8600,
8600,
"udp",
"Consul DNS"
],
"consul-serf-lan-tcp": [
8301,
8301,
"tcp",
"Serf LAN"
],
"consul-serf-lan-udp": [
8301,
8301,
"udp",
"Serf LAN"
],
"consul-serf-wan-tcp": [
8302,
8302,
"tcp",
"Serf WAN"
],
"consul-serf-wan-udp": [
8302,
8302,
"udp",
"Serf WAN"
],
"consul-tcp": [
8300,
8300,
"tcp",
"Consul server"
],
"consul-webui-tcp": [
8500,
8500,
"tcp",
"Consul web UI"
],
"dns-tcp": [
53,
53,
"tcp",
"DNS"
],
"dns-udp": [
53,
53,
"udp",
"DNS"
],
"docker-swarm-mngmt-tcp": [
2377,
2377,
"tcp",
"Docker Swarm cluster management"
],
"docker-swarm-node-tcp": [
7946,
7946,
"tcp",
"Docker Swarm node"
],
"docker-swarm-node-udp": [
7946,
7946,
"udp",
"Docker Swarm node"
],
"docker-swarm-overlay-udp": [
4789,
4789,
"udp",
"Docker Swarm Overlay Network Traffic"
],
"elasticsearch-java-tcp": [
9300,
9300,
"tcp",
"Elasticsearch Java interface"
],
"elasticsearch-rest-tcp": [
9200,
9200,
"tcp",
"Elasticsearch REST interface"
],
"grafana-tcp": [
3000,
3000,
"tcp",
"Grafana Dashboard"
],
"graphite-2003-tcp": [
2003,
2003,
"tcp",
"Carbon receiver plain text"
],
"graphite-2004-tcp": [
2004,
2004,
"tcp",
"Carbon receiver pickle"
],
"graphite-2023-tcp": [
2023,
2023,
"tcp",
"Carbon aggregator plaintext"
],
"graphite-2024-tcp": [
2024,
2024,
"tcp",
"Carbon aggregator pickle"
],
"graphite-8080-tcp": [
8080,
8080,
"tcp",
"Graphite gunicorn port"
],
"graphite-8125-tcp": [
8125,
8125,
"tcp",
"Statsd TCP"
],
"graphite-8125-udp": [
8125,
8125,
"udp",
"Statsd UDP default"
],
"graphite-8126-tcp": [
8126,
8126,
"tcp",
"Statsd admin"
],
"graphite-webui": [
80,
80,
"tcp",
"Graphite admin interface"
],
"http-80-tcp": [
80,
80,
"tcp",
"HTTP"
],
"http-8080-tcp": [
8080,
8080,
"tcp",
"HTTP"
],
"https-443-tcp": [
443,
443,
"tcp",
"HTTPS"
],
"https-8443-tcp": [
8443,
8443,
"tcp",
"HTTPS"
],
"ipsec-4500-udp": [
4500,
4500,
"udp",
"IPSEC NAT-T"
],
"ipsec-500-udp": [
500,
500,
"udp",
"IPSEC ISAKMP"
],
"kafka-broker-tcp": [
9092,
9092,
"tcp",
"Kafka broker 0.8.2+"
],
"kafka-broker-tls-tcp": [
9094,
9094,
"tcp",
"Kafka TLS enabled broker 0.8.2+"
],
"kibana-tcp": [
5601,
5601,
"tcp",
"Kibana Web Interface"
],
"kubernetes-api-tcp": [
6443,
6443,
"tcp",
"Kubernetes API Server"
],
"ldaps-tcp": [
636,
636,
"tcp",
"LDAPS"
],
"memcached-tcp": [
11211,
11211,
"tcp",
"Memcached"
],
"minio-tcp": [
9000,
9000,
"tcp",
"MinIO"
],
"mongodb-27017-tcp": [
27017,
27017,
"tcp",
"MongoDB"
],
"mongodb-27018-tcp": [
27018,
27018,
"tcp",
"MongoDB shard"
],
"mongodb-27019-tcp": [
27019,
27019,
"tcp",
"MongoDB config server"
],
"mssql-analytics-tcp": [
2383,
2383,
"tcp",
"MSSQL Analytics"
],
"mssql-broker-tcp": [
4022,
4022,
"tcp",
"MSSQL Broker"
],
"mssql-tcp": [
1433,
1433,
"tcp",
"MSSQL Server"
],
"mssql-udp": [
1434,
1434,
"udp",
"MSSQL Browser"
],
"mysql-tcp": [
3306,
3306,
"tcp",
"MySQL/Aurora"
],
"nfs-tcp": [
2049,
2049,
"tcp",
"NFS/EFS"
],
"nomad-http-tcp": [
4646,
4646,
"tcp",
"Nomad HTTP"
],
"nomad-rpc-tcp": [
4647,
4647,
"tcp",
"Nomad RPC"
],
"nomad-serf-tcp": [
4648,
4648,
"tcp",
"Serf"
],
"nomad-serf-udp": [
4648,
4648,
"udp",
"Serf"
],
"ntp-udp": [
123,
123,
"udp",
"NTP"
],
"openvpn-https-tcp": [
443,
443,
"tcp",
"OpenVPN"
],
"openvpn-tcp": [
943,
943,
"tcp",
"OpenVPN"
],
"openvpn-udp": [
1194,
1194,
"udp",
"OpenVPN"
],
"oracle-db-tcp": [
1521,
1521,
"tcp",
"Oracle"
],
"postgresql-tcp": [
5432,
5432,
"tcp",
"PostgreSQL"
],
"prometheus-http-tcp": [
9090,
9090,
"tcp",
"Prometheus"
],
"prometheus-pushgateway-http-tcp": [
9091,
9091,
"tcp",
"Prometheus Pushgateway"
],
"puppet-tcp": [
8140,
8140,
"tcp",
"Puppet"
],
"puppetdb-tcp": [
8081,
8081,
"tcp",
"PuppetDB"
],
"rabbitmq-15672-tcp": [
15672,
15672,
"tcp",
"RabbitMQ"
],
"rabbitmq-25672-tcp": [
25672,
25672,
"tcp",
"RabbitMQ"
],
"rabbitmq-4369-tcp": [
4369,
4369,
"tcp",
"RabbitMQ epmd"
],
"rabbitmq-5671-tcp": [
5671,
5671,
"tcp",
"RabbitMQ"
],
"rabbitmq-5672-tcp": [
5672,
5672,
"tcp",
"RabbitMQ"
],
"rdp-tcp": [
3389,
3389,
"tcp",
"Remote Desktop"
],
"rdp-udp": [
3389,
3389,
"udp",
"Remote Desktop"
],
"redis-tcp": [
6379,
6379,
"tcp",
"Redis"
],
"redshift-tcp": [
5439,
5439,
"tcp",
"Redshift"
],
"splunk-hec-tcp": [
8088,
8088,
"tcp",
"Splunk HEC"
],
"splunk-indexer-tcp": [
9997,
9997,
"tcp",
"Splunk indexer"
],
"splunk-splunkd-tcp": [
8089,
8089,
"tcp",
"Splunkd"
],
"splunk-web-tcp": [
8000,
8000,
"tcp",
"Splunk Web"
],
"squid-proxy-tcp": [
3128,
3128,
"tcp",
"Squid default proxy"
],
"ssh-tcp": [
22,
22,
"tcp",
"SSH"
],
"storm-nimbus-tcp": [
6627,
6627,
"tcp",
"Nimbus"
],
"storm-supervisor-tcp": [
6700,
6703,
"tcp",
"Supervisor"
],
"storm-ui-tcp": [
8080,
8080,
"tcp",
"Storm UI"
],
"web-jmx-tcp": [
1099,
1099,
"tcp",
"JMX"
],
"winrm-http-tcp": [
5985,
5985,
"tcp",
"WinRM HTTP"
],
"winrm-https-tcp": [
5986,
5986,
"tcp",
"WinRM HTTPS"
],
"zipkin-admin-query-tcp": [
9901,
9901,
"tcp",
"Zipkin Admin port query"
],
"zipkin-admin-tcp": [
9990,
9990,
"tcp",
"Zipkin Admin port collector"
],
"zipkin-admin-web-tcp": [
9991,
9991,
"tcp",
"Zipkin Admin port web"
],
"zipkin-query-tcp": [
9411,
9411,
"tcp",
"Zipkin query port"
],
"zipkin-web-tcp": [
8080,
8080,
"tcp",
"Zipkin web port"
],
"zookeeper-2181-tcp": [
2181,
2181,
"tcp",
"Zookeeper"
],
"zookeeper-2888-tcp": [
2888,
2888,
"tcp",
"Zookeeper"
],
"zookeeper-3888-tcp": [
3888,
3888,
"tcp",
"Zookeeper"
],
"zookeeper-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
]
} | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
+| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | {
"_": [
"",
"",
""
],
"activemq-5671-tcp": [
5671,
5671,
"tcp",
"ActiveMQ AMQP"
],
"activemq-61614-tcp": [
61614,
61614,
"tcp",
"ActiveMQ STOMP"
],
"activemq-61617-tcp": [
61617,
61617,
"tcp",
"ActiveMQ OpenWire"
],
"activemq-61619-tcp": [
61619,
61619,
"tcp",
"ActiveMQ WebSocket"
],
"activemq-8883-tcp": [
8883,
8883,
"tcp",
"ActiveMQ MQTT"
],
"alertmanager-9093-tcp": [
9093,
9093,
"tcp",
"Alert Manager"
],
"alertmanager-9094-tcp": [
9094,
9094,
"tcp",
"Alert Manager Cluster"
],
"all-all": [
-1,
-1,
"-1",
"All protocols"
],
"all-icmp": [
-1,
-1,
"icmp",
"All IPV4 ICMP"
],
"all-ipv6-icmp": [
-1,
-1,
58,
"All IPV6 ICMP"
],
"all-tcp": [
0,
65535,
"tcp",
"All TCP ports"
],
"all-udp": [
0,
65535,
"udp",
"All UDP ports"
],
"carbon-admin-tcp": [
2004,
2004,
"tcp",
"Carbon admin"
],
"carbon-gui-udp": [
8081,
8081,
"tcp",
"Carbon GUI"
],
"carbon-line-in-tcp": [
2003,
2003,
"tcp",
"Carbon line-in"
],
"carbon-line-in-udp": [
2003,
2003,
"udp",
"Carbon line-in"
],
"carbon-pickle-tcp": [
2013,
2013,
"tcp",
"Carbon pickle"
],
"carbon-pickle-udp": [
2013,
2013,
"udp",
"Carbon pickle"
],
"cassandra-clients-tcp": [
9042,
9042,
"tcp",
"Cassandra clients"
],
"cassandra-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
],
"cassandra-thrift-clients-tcp": [
9160,
9160,
"tcp",
"Cassandra Thrift clients"
],
"consul-cli-rpc-tcp": [
8400,
8400,
"tcp",
"Consul CLI RPC"
],
"consul-dns-tcp": [
8600,
8600,
"tcp",
"Consul DNS"
],
"consul-dns-udp": [
8600,
8600,
"udp",
"Consul DNS"
],
"consul-serf-lan-tcp": [
8301,
8301,
"tcp",
"Serf LAN"
],
"consul-serf-lan-udp": [
8301,
8301,
"udp",
"Serf LAN"
],
"consul-serf-wan-tcp": [
8302,
8302,
"tcp",
"Serf WAN"
],
"consul-serf-wan-udp": [
8302,
8302,
"udp",
"Serf WAN"
],
"consul-tcp": [
8300,
8300,
"tcp",
"Consul server"
],
"consul-webui-tcp": [
8500,
8500,
"tcp",
"Consul web UI"
],
"dns-tcp": [
53,
53,
"tcp",
"DNS"
],
"dns-udp": [
53,
53,
"udp",
"DNS"
],
"docker-swarm-mngmt-tcp": [
2377,
2377,
"tcp",
"Docker Swarm cluster management"
],
"docker-swarm-node-tcp": [
7946,
7946,
"tcp",
"Docker Swarm node"
],
"docker-swarm-node-udp": [
7946,
7946,
"udp",
"Docker Swarm node"
],
"docker-swarm-overlay-udp": [
4789,
4789,
"udp",
"Docker Swarm Overlay Network Traffic"
],
"elasticsearch-java-tcp": [
9300,
9300,
"tcp",
"Elasticsearch Java interface"
],
"elasticsearch-rest-tcp": [
9200,
9200,
"tcp",
"Elasticsearch REST interface"
],
"grafana-tcp": [
3000,
3000,
"tcp",
"Grafana Dashboard"
],
"graphite-2003-tcp": [
2003,
2003,
"tcp",
"Carbon receiver plain text"
],
"graphite-2004-tcp": [
2004,
2004,
"tcp",
"Carbon receiver pickle"
],
"graphite-2023-tcp": [
2023,
2023,
"tcp",
"Carbon aggregator plaintext"
],
"graphite-2024-tcp": [
2024,
2024,
"tcp",
"Carbon aggregator pickle"
],
"graphite-8080-tcp": [
8080,
8080,
"tcp",
"Graphite gunicorn port"
],
"graphite-8125-tcp": [
8125,
8125,
"tcp",
"Statsd TCP"
],
"graphite-8125-udp": [
8125,
8125,
"udp",
"Statsd UDP default"
],
"graphite-8126-tcp": [
8126,
8126,
"tcp",
"Statsd admin"
],
"graphite-webui": [
80,
80,
"tcp",
"Graphite admin interface"
],
"http-80-tcp": [
80,
80,
"tcp",
"HTTP"
],
"http-8080-tcp": [
8080,
8080,
"tcp",
"HTTP"
],
"https-443-tcp": [
443,
443,
"tcp",
"HTTPS"
],
"https-8443-tcp": [
8443,
8443,
"tcp",
"HTTPS"
],
"ipsec-4500-udp": [
4500,
4500,
"udp",
"IPSEC NAT-T"
],
"ipsec-500-udp": [
500,
500,
"udp",
"IPSEC ISAKMP"
],
"kafka-broker-tcp": [
9092,
9092,
"tcp",
"Kafka broker 0.8.2+"
],
"kafka-broker-tls-tcp": [
9094,
9094,
"tcp",
"Kafka TLS enabled broker 0.8.2+"
],
"kibana-tcp": [
5601,
5601,
"tcp",
"Kibana Web Interface"
],
"kubernetes-api-tcp": [
6443,
6443,
"tcp",
"Kubernetes API Server"
],
"ldaps-tcp": [
636,
636,
"tcp",
"LDAPS"
],
"logstash-tcp": [
5044,
5044,
"tcp",
"Logstash"
],
"memcached-tcp": [
11211,
11211,
"tcp",
"Memcached"
],
"minio-tcp": [
9000,
9000,
"tcp",
"MinIO"
],
"mongodb-27017-tcp": [
27017,
27017,
"tcp",
"MongoDB"
],
"mongodb-27018-tcp": [
27018,
27018,
"tcp",
"MongoDB shard"
],
"mongodb-27019-tcp": [
27019,
27019,
"tcp",
"MongoDB config server"
],
"mssql-analytics-tcp": [
2383,
2383,
"tcp",
"MSSQL Analytics"
],
"mssql-broker-tcp": [
4022,
4022,
"tcp",
"MSSQL Broker"
],
"mssql-tcp": [
1433,
1433,
"tcp",
"MSSQL Server"
],
"mssql-udp": [
1434,
1434,
"udp",
"MSSQL Browser"
],
"mysql-tcp": [
3306,
3306,
"tcp",
"MySQL/Aurora"
],
"nfs-tcp": [
2049,
2049,
"tcp",
"NFS/EFS"
],
"nomad-http-tcp": [
4646,
4646,
"tcp",
"Nomad HTTP"
],
"nomad-rpc-tcp": [
4647,
4647,
"tcp",
"Nomad RPC"
],
"nomad-serf-tcp": [
4648,
4648,
"tcp",
"Serf"
],
"nomad-serf-udp": [
4648,
4648,
"udp",
"Serf"
],
"ntp-udp": [
123,
123,
"udp",
"NTP"
],
"openvpn-https-tcp": [
443,
443,
"tcp",
"OpenVPN"
],
"openvpn-tcp": [
943,
943,
"tcp",
"OpenVPN"
],
"openvpn-udp": [
1194,
1194,
"udp",
"OpenVPN"
],
"oracle-db-tcp": [
1521,
1521,
"tcp",
"Oracle"
],
"postgresql-tcp": [
5432,
5432,
"tcp",
"PostgreSQL"
],
"prometheus-http-tcp": [
9090,
9090,
"tcp",
"Prometheus"
],
"prometheus-pushgateway-http-tcp": [
9091,
9091,
"tcp",
"Prometheus Pushgateway"
],
"puppet-tcp": [
8140,
8140,
"tcp",
"Puppet"
],
"puppetdb-tcp": [
8081,
8081,
"tcp",
"PuppetDB"
],
"rabbitmq-15672-tcp": [
15672,
15672,
"tcp",
"RabbitMQ"
],
"rabbitmq-25672-tcp": [
25672,
25672,
"tcp",
"RabbitMQ"
],
"rabbitmq-4369-tcp": [
4369,
4369,
"tcp",
"RabbitMQ epmd"
],
"rabbitmq-5671-tcp": [
5671,
5671,
"tcp",
"RabbitMQ"
],
"rabbitmq-5672-tcp": [
5672,
5672,
"tcp",
"RabbitMQ"
],
"rdp-tcp": [
3389,
3389,
"tcp",
"Remote Desktop"
],
"rdp-udp": [
3389,
3389,
"udp",
"Remote Desktop"
],
"redis-tcp": [
6379,
6379,
"tcp",
"Redis"
],
"redshift-tcp": [
5439,
5439,
"tcp",
"Redshift"
],
"splunk-hec-tcp": [
8088,
8088,
"tcp",
"Splunk HEC"
],
"splunk-indexer-tcp": [
9997,
9997,
"tcp",
"Splunk indexer"
],
"splunk-splunkd-tcp": [
8089,
8089,
"tcp",
"Splunkd"
],
"splunk-web-tcp": [
8000,
8000,
"tcp",
"Splunk Web"
],
"squid-proxy-tcp": [
3128,
3128,
"tcp",
"Squid default proxy"
],
"ssh-tcp": [
22,
22,
"tcp",
"SSH"
],
"storm-nimbus-tcp": [
6627,
6627,
"tcp",
"Nimbus"
],
"storm-supervisor-tcp": [
6700,
6703,
"tcp",
"Supervisor"
],
"storm-ui-tcp": [
8080,
8080,
"tcp",
"Storm UI"
],
"web-jmx-tcp": [
1099,
1099,
"tcp",
"JMX"
],
"winrm-http-tcp": [
5985,
5985,
"tcp",
"WinRM HTTP"
],
"winrm-https-tcp": [
5986,
5986,
"tcp",
"WinRM HTTPS"
],
"zipkin-admin-query-tcp": [
9901,
9901,
"tcp",
"Zipkin Admin port query"
],
"zipkin-admin-tcp": [
9990,
9990,
"tcp",
"Zipkin Admin port collector"
],
"zipkin-admin-web-tcp": [
9991,
9991,
"tcp",
"Zipkin Admin port web"
],
"zipkin-query-tcp": [
9411,
9411,
"tcp",
"Zipkin query port"
],
"zipkin-web-tcp": [
8080,
8080,
"tcp",
"Zipkin web port"
],
"zookeeper-2181-tcp": [
2181,
2181,
"tcp",
"Zookeeper"
],
"zookeeper-2888-tcp": [
2888,
2888,
"tcp",
"Zookeeper"
],
"zookeeper-3888-tcp": [
3888,
3888,
"tcp",
"Zookeeper"
],
"zookeeper-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
]
} | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/main.tf b/main.tf
index 81ae0abe..38d19863 100644
--- a/main.tf
+++ b/main.tf
@@ -15,9 +15,10 @@ locals {
resource "aws_security_group" "this" {
count = var.create && false == var.use_name_prefix ? 1 : 0
- name = var.name
- description = var.description
- vpc_id = var.vpc_id
+ name = var.name
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
tags = merge(
var.tags,
@@ -33,9 +34,10 @@ resource "aws_security_group" "this" {
resource "aws_security_group" "this_name_prefix" {
count = var.create && var.use_name_prefix ? 1 : 0
- name_prefix = "${var.name}-"
- description = var.description
- vpc_id = var.vpc_id
+ name_prefix = "${var.name}-"
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
tags = merge(
var.tags,
diff --git a/modules/README.md b/modules/README.md
index 51912dda..ead53e3b 100644
--- a/modules/README.md
+++ b/modules/README.md
@@ -21,6 +21,7 @@ List of Security Groups implemented as Terraform modules
* [kibana](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/kibana)
* [kubernetes-api](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/kubernetes-api)
* [ldaps](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/ldaps)
+* [logstash](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/logstash)
* [memcached](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/memcached)
* [minio](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/minio)
* [mongodb](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/mongodb)
diff --git a/modules/_templates/main.tf b/modules/_templates/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/_templates/main.tf
+++ b/modules/_templates/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/_templates/variables.tf b/modules/_templates/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/_templates/variables.tf
+++ b/modules/_templates/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/_templates/versions.tf b/modules/_templates/versions.tf
index b8569144..41f2989f 100644
--- a/modules/_templates/versions.tf
+++ b/modules/_templates/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/activemq/README.md b/modules/activemq/README.md
index 10109b96..adf873b1 100644
--- a/modules/activemq/README.md
+++ b/modules/activemq/README.md
@@ -18,7 +18,7 @@ All automatic values **activemq module** is using are available [here](https://g
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/activemq/main.tf b/modules/activemq/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/activemq/main.tf
+++ b/modules/activemq/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/activemq/variables.tf b/modules/activemq/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/activemq/variables.tf
+++ b/modules/activemq/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/activemq/versions.tf b/modules/activemq/versions.tf
index b8569144..41f2989f 100644
--- a/modules/activemq/versions.tf
+++ b/modules/activemq/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/alertmanager/README.md b/modules/alertmanager/README.md
index 89cb1d3c..923185bc 100644
--- a/modules/alertmanager/README.md
+++ b/modules/alertmanager/README.md
@@ -18,7 +18,7 @@ All automatic values **alertmanager module** is using are available [here](https
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/alertmanager/main.tf b/modules/alertmanager/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/alertmanager/main.tf
+++ b/modules/alertmanager/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/alertmanager/variables.tf b/modules/alertmanager/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/alertmanager/variables.tf
+++ b/modules/alertmanager/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/alertmanager/versions.tf b/modules/alertmanager/versions.tf
index b8569144..41f2989f 100644
--- a/modules/alertmanager/versions.tf
+++ b/modules/alertmanager/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/carbon-relay-ng/README.md b/modules/carbon-relay-ng/README.md
index f27ca5e4..cb27098b 100644
--- a/modules/carbon-relay-ng/README.md
+++ b/modules/carbon-relay-ng/README.md
@@ -18,7 +18,7 @@ All automatic values **carbon-relay-ng module** is using are available [here](ht
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/carbon-relay-ng/main.tf b/modules/carbon-relay-ng/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/carbon-relay-ng/main.tf
+++ b/modules/carbon-relay-ng/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/carbon-relay-ng/variables.tf b/modules/carbon-relay-ng/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/carbon-relay-ng/variables.tf
+++ b/modules/carbon-relay-ng/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/carbon-relay-ng/versions.tf b/modules/carbon-relay-ng/versions.tf
index b8569144..41f2989f 100644
--- a/modules/carbon-relay-ng/versions.tf
+++ b/modules/carbon-relay-ng/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/cassandra/README.md b/modules/cassandra/README.md
index 45aa5313..ba715767 100644
--- a/modules/cassandra/README.md
+++ b/modules/cassandra/README.md
@@ -18,7 +18,7 @@ All automatic values **cassandra module** is using are available [here](https://
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/cassandra/main.tf b/modules/cassandra/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/cassandra/main.tf
+++ b/modules/cassandra/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/cassandra/variables.tf b/modules/cassandra/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/cassandra/variables.tf
+++ b/modules/cassandra/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/cassandra/versions.tf b/modules/cassandra/versions.tf
index b8569144..41f2989f 100644
--- a/modules/cassandra/versions.tf
+++ b/modules/cassandra/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/consul/README.md b/modules/consul/README.md
index 30147b0c..d0d66802 100644
--- a/modules/consul/README.md
+++ b/modules/consul/README.md
@@ -18,7 +18,7 @@ All automatic values **consul module** is using are available [here](https://git
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/consul/main.tf b/modules/consul/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/consul/main.tf
+++ b/modules/consul/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/consul/variables.tf b/modules/consul/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/consul/variables.tf
+++ b/modules/consul/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/consul/versions.tf b/modules/consul/versions.tf
index b8569144..41f2989f 100644
--- a/modules/consul/versions.tf
+++ b/modules/consul/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/docker-swarm/README.md b/modules/docker-swarm/README.md
index c90caacf..114673c9 100644
--- a/modules/docker-swarm/README.md
+++ b/modules/docker-swarm/README.md
@@ -18,7 +18,7 @@ All automatic values **docker-swarm module** is using are available [here](https
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/docker-swarm/main.tf b/modules/docker-swarm/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/docker-swarm/main.tf
+++ b/modules/docker-swarm/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/docker-swarm/variables.tf b/modules/docker-swarm/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/docker-swarm/variables.tf
+++ b/modules/docker-swarm/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/docker-swarm/versions.tf b/modules/docker-swarm/versions.tf
index b8569144..41f2989f 100644
--- a/modules/docker-swarm/versions.tf
+++ b/modules/docker-swarm/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/elasticsearch/README.md b/modules/elasticsearch/README.md
index bfe41859..bf61d3a8 100644
--- a/modules/elasticsearch/README.md
+++ b/modules/elasticsearch/README.md
@@ -18,7 +18,7 @@ All automatic values **elasticsearch module** is using are available [here](http
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/elasticsearch/main.tf b/modules/elasticsearch/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/elasticsearch/main.tf
+++ b/modules/elasticsearch/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/elasticsearch/variables.tf b/modules/elasticsearch/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/elasticsearch/variables.tf
+++ b/modules/elasticsearch/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/elasticsearch/versions.tf b/modules/elasticsearch/versions.tf
index b8569144..41f2989f 100644
--- a/modules/elasticsearch/versions.tf
+++ b/modules/elasticsearch/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/grafana/README.md b/modules/grafana/README.md
index 5fc25182..46c36907 100644
--- a/modules/grafana/README.md
+++ b/modules/grafana/README.md
@@ -18,7 +18,7 @@ All automatic values **grafana module** is using are available [here](https://gi
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/grafana/main.tf b/modules/grafana/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/grafana/main.tf
+++ b/modules/grafana/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/grafana/variables.tf b/modules/grafana/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/grafana/variables.tf
+++ b/modules/grafana/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/grafana/versions.tf b/modules/grafana/versions.tf
index b8569144..41f2989f 100644
--- a/modules/grafana/versions.tf
+++ b/modules/grafana/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/graphite-statsd/README.md b/modules/graphite-statsd/README.md
index d9534009..0605aab9 100644
--- a/modules/graphite-statsd/README.md
+++ b/modules/graphite-statsd/README.md
@@ -18,7 +18,7 @@ All automatic values **graphite-statsd module** is using are available [here](ht
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/graphite-statsd/main.tf b/modules/graphite-statsd/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/graphite-statsd/main.tf
+++ b/modules/graphite-statsd/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/graphite-statsd/variables.tf b/modules/graphite-statsd/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/graphite-statsd/variables.tf
+++ b/modules/graphite-statsd/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/graphite-statsd/versions.tf b/modules/graphite-statsd/versions.tf
index b8569144..41f2989f 100644
--- a/modules/graphite-statsd/versions.tf
+++ b/modules/graphite-statsd/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/http-80/README.md b/modules/http-80/README.md
index 132c2060..0601398c 100644
--- a/modules/http-80/README.md
+++ b/modules/http-80/README.md
@@ -18,7 +18,7 @@ All automatic values **http-80 module** is using are available [here](https://gi
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/http-80/main.tf b/modules/http-80/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/http-80/main.tf
+++ b/modules/http-80/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/http-80/variables.tf b/modules/http-80/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/http-80/variables.tf
+++ b/modules/http-80/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/http-80/versions.tf b/modules/http-80/versions.tf
index b8569144..41f2989f 100644
--- a/modules/http-80/versions.tf
+++ b/modules/http-80/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/http-8080/README.md b/modules/http-8080/README.md
index 601a09bc..67372177 100644
--- a/modules/http-8080/README.md
+++ b/modules/http-8080/README.md
@@ -18,7 +18,7 @@ All automatic values **http-8080 module** is using are available [here](https://
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/http-8080/main.tf b/modules/http-8080/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/http-8080/main.tf
+++ b/modules/http-8080/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/http-8080/variables.tf b/modules/http-8080/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/http-8080/variables.tf
+++ b/modules/http-8080/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/http-8080/versions.tf b/modules/http-8080/versions.tf
index b8569144..41f2989f 100644
--- a/modules/http-8080/versions.tf
+++ b/modules/http-8080/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/https-443/README.md b/modules/https-443/README.md
index 41a80794..4131e5d4 100644
--- a/modules/https-443/README.md
+++ b/modules/https-443/README.md
@@ -18,7 +18,7 @@ All automatic values **https-443 module** is using are available [here](https://
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/https-443/main.tf b/modules/https-443/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/https-443/main.tf
+++ b/modules/https-443/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/https-443/variables.tf b/modules/https-443/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/https-443/variables.tf
+++ b/modules/https-443/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/https-443/versions.tf b/modules/https-443/versions.tf
index b8569144..41f2989f 100644
--- a/modules/https-443/versions.tf
+++ b/modules/https-443/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/https-8443/README.md b/modules/https-8443/README.md
index e6e21af2..aa033b1e 100644
--- a/modules/https-8443/README.md
+++ b/modules/https-8443/README.md
@@ -18,7 +18,7 @@ All automatic values **https-8443 module** is using are available [here](https:/
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/https-8443/main.tf b/modules/https-8443/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/https-8443/main.tf
+++ b/modules/https-8443/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/https-8443/variables.tf b/modules/https-8443/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/https-8443/variables.tf
+++ b/modules/https-8443/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/https-8443/versions.tf b/modules/https-8443/versions.tf
index b8569144..41f2989f 100644
--- a/modules/https-8443/versions.tf
+++ b/modules/https-8443/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/ipsec-4500/README.md b/modules/ipsec-4500/README.md
index 13615511..9eec5cc6 100644
--- a/modules/ipsec-4500/README.md
+++ b/modules/ipsec-4500/README.md
@@ -18,7 +18,7 @@ All automatic values **ipsec-4500 module** is using are available [here](https:/
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/ipsec-4500/main.tf b/modules/ipsec-4500/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/ipsec-4500/main.tf
+++ b/modules/ipsec-4500/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/ipsec-4500/variables.tf b/modules/ipsec-4500/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/ipsec-4500/variables.tf
+++ b/modules/ipsec-4500/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/ipsec-4500/versions.tf b/modules/ipsec-4500/versions.tf
index b8569144..41f2989f 100644
--- a/modules/ipsec-4500/versions.tf
+++ b/modules/ipsec-4500/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/ipsec-500/README.md b/modules/ipsec-500/README.md
index 4a6c6150..84e59e25 100644
--- a/modules/ipsec-500/README.md
+++ b/modules/ipsec-500/README.md
@@ -18,7 +18,7 @@ All automatic values **ipsec-500 module** is using are available [here](https://
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/ipsec-500/main.tf b/modules/ipsec-500/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/ipsec-500/main.tf
+++ b/modules/ipsec-500/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/ipsec-500/variables.tf b/modules/ipsec-500/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/ipsec-500/variables.tf
+++ b/modules/ipsec-500/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/ipsec-500/versions.tf b/modules/ipsec-500/versions.tf
index b8569144..41f2989f 100644
--- a/modules/ipsec-500/versions.tf
+++ b/modules/ipsec-500/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/kafka/README.md b/modules/kafka/README.md
index 67da0265..fdbbd8b7 100644
--- a/modules/kafka/README.md
+++ b/modules/kafka/README.md
@@ -18,7 +18,7 @@ All automatic values **kafka module** is using are available [here](https://gith
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/kafka/main.tf b/modules/kafka/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/kafka/main.tf
+++ b/modules/kafka/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/kafka/variables.tf b/modules/kafka/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/kafka/variables.tf
+++ b/modules/kafka/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/kafka/versions.tf b/modules/kafka/versions.tf
index b8569144..41f2989f 100644
--- a/modules/kafka/versions.tf
+++ b/modules/kafka/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/kibana/README.md b/modules/kibana/README.md
index 44f52f2f..e2322b71 100644
--- a/modules/kibana/README.md
+++ b/modules/kibana/README.md
@@ -18,7 +18,7 @@ All automatic values **kibana module** is using are available [here](https://git
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/kibana/main.tf b/modules/kibana/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/kibana/main.tf
+++ b/modules/kibana/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/kibana/variables.tf b/modules/kibana/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/kibana/variables.tf
+++ b/modules/kibana/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/kibana/versions.tf b/modules/kibana/versions.tf
index b8569144..41f2989f 100644
--- a/modules/kibana/versions.tf
+++ b/modules/kibana/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/kubernetes-api/README.md b/modules/kubernetes-api/README.md
index 1cfdba23..7f37046a 100644
--- a/modules/kubernetes-api/README.md
+++ b/modules/kubernetes-api/README.md
@@ -18,7 +18,7 @@ All automatic values **kubernetes-api module** is using are available [here](htt
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/kubernetes-api/main.tf b/modules/kubernetes-api/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/kubernetes-api/main.tf
+++ b/modules/kubernetes-api/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/kubernetes-api/variables.tf b/modules/kubernetes-api/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/kubernetes-api/variables.tf
+++ b/modules/kubernetes-api/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/kubernetes-api/versions.tf b/modules/kubernetes-api/versions.tf
index b8569144..41f2989f 100644
--- a/modules/kubernetes-api/versions.tf
+++ b/modules/kubernetes-api/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/ldaps/README.md b/modules/ldaps/README.md
index 3be99eba..22cc7d4b 100644
--- a/modules/ldaps/README.md
+++ b/modules/ldaps/README.md
@@ -18,7 +18,7 @@ All automatic values **ldaps module** is using are available [here](https://gith
| Name | Version |
|------|---------|
-| terraform | ~> 0.12.6 |
+| terraform | >= 0.12.6, < 0.14 |
| aws | ~> 2.42 |
## Providers
@@ -92,6 +92,7 @@ No provider.
| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
+| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/ldaps/main.tf b/modules/ldaps/main.tf
index 2c85546f..758bb7bc 100644
--- a/modules/ldaps/main.tf
+++ b/modules/ldaps/main.tf
@@ -1,12 +1,13 @@
module "sg" {
source = "../../"
- create = var.create
- name = var.name
- use_name_prefix = var.use_name_prefix
- description = var.description
- vpc_id = var.vpc_id
- tags = var.tags
+ create = var.create
+ name = var.name
+ use_name_prefix = var.use_name_prefix
+ description = var.description
+ vpc_id = var.vpc_id
+ revoke_rules_on_delete = var.revoke_rules_on_delete
+ tags = var.tags
##########
# Ingress
diff --git a/modules/ldaps/variables.tf b/modules/ldaps/variables.tf
index 354b9e37..4d331561 100644
--- a/modules/ldaps/variables.tf
+++ b/modules/ldaps/variables.tf
@@ -29,6 +29,12 @@ variable "description" {
default = "Security Group managed by Terraform"
}
+variable "revoke_rules_on_delete" {
+ description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR."
+ type = bool
+ default = false
+}
+
variable "tags" {
description = "A mapping of tags to assign to security group"
type = map(string)
diff --git a/modules/ldaps/versions.tf b/modules/ldaps/versions.tf
index b8569144..41f2989f 100644
--- a/modules/ldaps/versions.tf
+++ b/modules/ldaps/versions.tf
@@ -1,5 +1,5 @@
terraform {
- required_version = "~> 0.12.6"
+ required_version = ">= 0.12.6, < 0.14"
required_providers {
aws = "~> 2.42"
diff --git a/modules/logstash/README.md b/modules/logstash/README.md
new file mode 100644
index 00000000..18753976
--- /dev/null
+++ b/modules/logstash/README.md
@@ -0,0 +1,110 @@
+# logstash - AWS EC2-VPC Security Group Terraform module
+
+## Usage
+
+```hcl
+module "logstash_security_group" {
+ source = "terraform-aws-modules/security-group/aws//modules/logstash"
+ version = "~> 3.0"
+
+ # omitted...
+}
+```
+
+All automatic values **logstash module** is using are available [here](https://github.com/terraform-aws-modules/terraform-aws-security-group/blob/master/modules/logstash/auto_values.tf).
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| terraform | >= 0.12.6, < 0.14 |
+| aws | ~> 2.42 |
+
+## Providers
+
+No provider.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| auto\_computed\_egress\_rules | List of computed egress rules to add automatically | `list(string)` | `[]` | no |
+| auto\_computed\_egress\_with\_self | List of maps defining computed egress rules with self to add automatically | `list(map(string))` | `[]` | no |
+| auto\_computed\_ingress\_rules | List of ingress rules to add automatically | `list(string)` | `[]` | no |
+| auto\_computed\_ingress\_with\_self | List of maps defining computed ingress rules with self to add automatically | `list(map(string))` | `[]` | no |
+| auto\_egress\_rules | List of egress rules to add automatically | `list(string)` | [| no | +| auto\_egress\_with\_self | List of maps defining egress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_ingress\_rules | List of ingress rules to add automatically | `list(string)` |
"all-all"
]
[| no | +| auto\_ingress\_with\_self | List of maps defining ingress rules with self to add automatically | `list(map(string))` |
"logstash-tcp"
]
[| no | +| auto\_number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| computed\_egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed egress rules | `list(string)` |
{
"rule": "all-all"
}
]
[| no | +| computed\_egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed egress rules | `list(string)` |
"0.0.0.0/0"
]
[| no | +| computed\_egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `list(string)` | `[]` | no | +| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no | +| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_self | List of computed egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_source\_security\_group\_id | List of computed egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_rules | List of computed ingress rules to create by name | `list(string)` | `[]` | no | +| computed\_ingress\_with\_cidr\_blocks | List of computed ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_ipv6\_cidr\_blocks | List of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_self | List of computed ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_source\_security\_group\_id | List of computed ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| create | Whether to create security group and all rules | `bool` | `true` | no | +| description | Description of security group | `string` | `"Security Group managed by Terraform"` | no | +| egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all egress rules | `list(string)` |
"::/0"
]
[| no | +| egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all egress rules | `list(string)` |
"0.0.0.0/0"
]
[| no | +| egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules | `list(string)` | `[]` | no | +| egress\_rules | List of egress rules to create by name | `list(string)` | `[]` | no | +| egress\_with\_cidr\_blocks | List of egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_ipv6\_cidr\_blocks | List of egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_self | List of egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| egress\_with\_source\_security\_group\_id | List of egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_rules | List of ingress rules to create by name | `list(string)` | `[]` | no | +| ingress\_with\_cidr\_blocks | List of ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_ipv6\_cidr\_blocks | List of ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_self | List of ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| ingress\_with\_source\_security\_group\_id | List of ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| name | Name of security group | `string` | n/a | yes | +| number\_of\_computed\_egress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_cidr\_blocks | Number of computed egress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_ipv6\_cidr\_blocks | Number of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_source\_security\_group\_id | Number of computed egress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_cidr\_blocks | Number of computed ingress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | +| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | +| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | +| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| this\_security\_group\_description | The description of the security group | +| this\_security\_group\_id | The ID of the security group | +| this\_security\_group\_name | The name of the security group | +| this\_security\_group\_owner\_id | The owner ID | +| this\_security\_group\_vpc\_id | The VPC ID | + + diff --git a/modules/logstash/auto_values.tf b/modules/logstash/auto_values.tf new file mode 100644 index 00000000..6708317b --- /dev/null +++ b/modules/logstash/auto_values.tf @@ -0,0 +1,79 @@ +# This file was generated from values defined in rules.tf using update_groups.sh. +################################### +# DO NOT CHANGE THIS FILE MANUALLY +################################### + +variable "auto_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = ["logstash-tcp"] +} + +variable "auto_ingress_with_self" { + description = "List of maps defining ingress rules with self to add automatically" + type = list(map(string)) + default = [{ "rule" = "all-all" }] +} + +variable "auto_egress_rules" { + description = "List of egress rules to add automatically" + type = list(string) + default = ["all-all"] +} + +variable "auto_egress_with_self" { + description = "List of maps defining egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Computed +variable "auto_computed_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_ingress_with_self" { + description = "List of maps defining computed ingress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +variable "auto_computed_egress_rules" { + description = "List of computed egress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_egress_with_self" { + description = "List of maps defining computed egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Number of computed rules +variable "auto_number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + diff --git a/modules/logstash/main.tf b/modules/logstash/main.tf new file mode 100644 index 00000000..758bb7bc --- /dev/null +++ b/modules/logstash/main.tf @@ -0,0 +1,115 @@ +module "sg" { + source = "../../" + + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags + + ########## + # Ingress + ########## + # Rules by names - open for default CIDR + ingress_rules = sort(compact(distinct(concat(var.auto_ingress_rules, var.ingress_rules, [""])))) + + # Open for self + ingress_with_self = concat(var.auto_ingress_with_self, var.ingress_with_self) + + # Open to IPv4 cidr blocks + ingress_with_cidr_blocks = var.ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + ingress_with_ipv6_cidr_blocks = var.ingress_with_ipv6_cidr_blocks + + # Open for security group id + ingress_with_source_security_group_id = var.ingress_with_source_security_group_id + + # Default ingress CIDR blocks + ingress_cidr_blocks = var.ingress_cidr_blocks + ingress_ipv6_cidr_blocks = var.ingress_ipv6_cidr_blocks + + # Default prefix list ids + ingress_prefix_list_ids = var.ingress_prefix_list_ids + + ################### + # Computed Ingress + ################### + # Rules by names - open for default CIDR + computed_ingress_rules = sort(compact(distinct(concat(var.auto_computed_ingress_rules, var.computed_ingress_rules, [""])))) + + # Open for self + computed_ingress_with_self = concat(var.auto_computed_ingress_with_self, var.computed_ingress_with_self) + + # Open to IPv4 cidr blocks + computed_ingress_with_cidr_blocks = var.computed_ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_ingress_with_ipv6_cidr_blocks = var.computed_ingress_with_ipv6_cidr_blocks + + # Open for security group id + computed_ingress_with_source_security_group_id = var.computed_ingress_with_source_security_group_id + + ############################# + # Number of computed ingress + ############################# + number_of_computed_ingress_rules = var.auto_number_of_computed_ingress_rules + var.number_of_computed_ingress_rules + number_of_computed_ingress_with_self = var.auto_number_of_computed_ingress_with_self + var.number_of_computed_ingress_with_self + number_of_computed_ingress_with_cidr_blocks = var.number_of_computed_ingress_with_cidr_blocks + number_of_computed_ingress_with_ipv6_cidr_blocks = var.number_of_computed_ingress_with_ipv6_cidr_blocks + number_of_computed_ingress_with_source_security_group_id = var.number_of_computed_ingress_with_source_security_group_id + + ######### + # Egress + ######### + # Rules by names - open for default CIDR + egress_rules = sort(compact(distinct(concat(var.auto_egress_rules, var.egress_rules, [""])))) + + # Open for self + egress_with_self = concat(var.auto_egress_with_self, var.egress_with_self) + + # Open to IPv4 cidr blocks + egress_with_cidr_blocks = var.egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + egress_with_ipv6_cidr_blocks = var.egress_with_ipv6_cidr_blocks + + # Open for security group id + egress_with_source_security_group_id = var.egress_with_source_security_group_id + + # Default egress CIDR blocks + egress_cidr_blocks = var.egress_cidr_blocks + egress_ipv6_cidr_blocks = var.egress_ipv6_cidr_blocks + + # Default prefix list ids + egress_prefix_list_ids = var.egress_prefix_list_ids + + ################## + # Computed Egress + ################## + # Rules by names - open for default CIDR + computed_egress_rules = sort(compact(distinct(concat(var.auto_computed_egress_rules, var.computed_egress_rules, [""])))) + + # Open for self + computed_egress_with_self = concat(var.auto_computed_egress_with_self, var.computed_egress_with_self) + + # Open to IPv4 cidr blocks + computed_egress_with_cidr_blocks = var.computed_egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_egress_with_ipv6_cidr_blocks = var.computed_egress_with_ipv6_cidr_blocks + + # Open for security group id + computed_egress_with_source_security_group_id = var.computed_egress_with_source_security_group_id + + ############################# + # Number of computed egress + ############################# + number_of_computed_egress_rules = var.auto_number_of_computed_egress_rules + var.number_of_computed_egress_rules + number_of_computed_egress_with_self = var.auto_number_of_computed_egress_with_self + var.number_of_computed_egress_with_self + number_of_computed_egress_with_cidr_blocks = var.number_of_computed_egress_with_cidr_blocks + number_of_computed_egress_with_ipv6_cidr_blocks = var.number_of_computed_egress_with_ipv6_cidr_blocks + number_of_computed_egress_with_source_security_group_id = var.number_of_computed_egress_with_source_security_group_id +} diff --git a/modules/logstash/outputs.tf b/modules/logstash/outputs.tf new file mode 100644 index 00000000..3d7ad67f --- /dev/null +++ b/modules/logstash/outputs.tf @@ -0,0 +1,24 @@ +output "this_security_group_id" { + description = "The ID of the security group" + value = module.sg.this_security_group_id +} + +output "this_security_group_vpc_id" { + description = "The VPC ID" + value = module.sg.this_security_group_vpc_id +} + +output "this_security_group_owner_id" { + description = "The owner ID" + value = module.sg.this_security_group_owner_id +} + +output "this_security_group_name" { + description = "The name of the security group" + value = module.sg.this_security_group_name +} + +output "this_security_group_description" { + description = "The description of the security group" + value = module.sg.this_security_group_description +} diff --git a/modules/logstash/variables.tf b/modules/logstash/variables.tf new file mode 100644 index 00000000..4d331561 --- /dev/null +++ b/modules/logstash/variables.tf @@ -0,0 +1,348 @@ +################# +# Security group +################# +variable "create" { + description = "Whether to create security group and all rules" + type = bool + default = true +} + +variable "vpc_id" { + description = "ID of the VPC where to create security group" + type = string +} + +variable "name" { + description = "Name of security group" + type = string +} + +variable "use_name_prefix" { + description = "Whether to use name_prefix or fixed name. Should be true to able to update security group name after initial creation" + type = bool + default = true +} + +variable "description" { + description = "Description of security group" + type = string + default = "Security Group managed by Terraform" +} + +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + +variable "tags" { + description = "A mapping of tags to assign to security group" + type = map(string) + default = {} +} + +########## +# Ingress +########## +variable "ingress_rules" { + description = "List of ingress rules to create by name" + type = list(string) + default = [] +} + +variable "ingress_with_self" { + description = "List of ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "ingress_with_cidr_blocks" { + description = "List of ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_ipv6_cidr_blocks" { + description = "List of ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_source_security_group_id" { + description = "List of ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules" + type = list(string) + default = [] +} + +################### +# Computed Ingress +################### +variable "computed_ingress_rules" { + description = "List of computed ingress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_ingress_with_self" { + description = "List of computed ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_cidr_blocks" { + description = "List of computed ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_ipv6_cidr_blocks" { + description = "List of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_source_security_group_id" { + description = "List of computed ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = list(string) + default = [] +} + +################################### +# Number of computed ingress rules +################################### +variable "number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_cidr_blocks" { + description = "Number of computed ingress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_ipv6_cidr_blocks" { + description = "Number of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_source_security_group_id" { + description = "Number of computed ingress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = number + default = 0 +} + +######### +# Egress +######### +variable "egress_rules" { + description = "List of egress rules to create by name" + type = list(string) + default = [] +} + +variable "egress_with_self" { + description = "List of egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "egress_with_cidr_blocks" { + description = "List of egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_ipv6_cidr_blocks" { + description = "List of egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_source_security_group_id" { + description = "List of egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all egress rules" + type = list(string) + default = ["::/0"] +} + +variable "egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules" + type = list(string) + default = [] +} + +################## +# Computed Egress +################## +variable "computed_egress_rules" { + description = "List of computed egress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_egress_with_self" { + description = "List of computed egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_cidr_blocks" { + description = "List of computed egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_ipv6_cidr_blocks" { + description = "List of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_source_security_group_id" { + description = "List of computed egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "computed_egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["::/0"] +} + +variable "computed_egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = list(string) + default = [] +} + +################################## +# Number of computed egress rules +################################## +variable "number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_cidr_blocks" { + description = "Number of computed egress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_ipv6_cidr_blocks" { + description = "Number of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_source_security_group_id" { + description = "Number of computed egress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = number + default = 0 +} diff --git a/modules/logstash/versions.tf b/modules/logstash/versions.tf new file mode 100644 index 00000000..41f2989f --- /dev/null +++ b/modules/logstash/versions.tf @@ -0,0 +1,7 @@ +terraform { + required_version = ">= 0.12.6, < 0.14" + + required_providers { + aws = "~> 2.42" + } +} diff --git a/modules/memcached/README.md b/modules/memcached/README.md index 33993e9a..649c684e 100644 --- a/modules/memcached/README.md +++ b/modules/memcached/README.md @@ -18,7 +18,7 @@ All automatic values **memcached module** is using are available [here](https:// | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/memcached/main.tf b/modules/memcached/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/memcached/main.tf +++ b/modules/memcached/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/memcached/variables.tf b/modules/memcached/variables.tf index 354b9e37..4d331561 100644 --- a/modules/memcached/variables.tf +++ b/modules/memcached/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/memcached/versions.tf b/modules/memcached/versions.tf index b8569144..41f2989f 100644 --- a/modules/memcached/versions.tf +++ b/modules/memcached/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/minio/README.md b/modules/minio/README.md index c1f20149..f3432c09 100644 --- a/modules/minio/README.md +++ b/modules/minio/README.md @@ -18,7 +18,7 @@ All automatic values **minio module** is using are available [here](https://gith | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/minio/main.tf b/modules/minio/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/minio/main.tf +++ b/modules/minio/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/minio/variables.tf b/modules/minio/variables.tf index 354b9e37..4d331561 100644 --- a/modules/minio/variables.tf +++ b/modules/minio/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/minio/versions.tf b/modules/minio/versions.tf index b8569144..41f2989f 100644 --- a/modules/minio/versions.tf +++ b/modules/minio/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/mongodb/README.md b/modules/mongodb/README.md index 1ad49fd4..7c1b026f 100644 --- a/modules/mongodb/README.md +++ b/modules/mongodb/README.md @@ -18,7 +18,7 @@ All automatic values **mongodb module** is using are available [here](https://gi | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/mongodb/main.tf b/modules/mongodb/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/mongodb/main.tf +++ b/modules/mongodb/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/mongodb/variables.tf b/modules/mongodb/variables.tf index 354b9e37..4d331561 100644 --- a/modules/mongodb/variables.tf +++ b/modules/mongodb/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/mongodb/versions.tf b/modules/mongodb/versions.tf index b8569144..41f2989f 100644 --- a/modules/mongodb/versions.tf +++ b/modules/mongodb/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/mssql/README.md b/modules/mssql/README.md index f82dd66a..50a29ea1 100644 --- a/modules/mssql/README.md +++ b/modules/mssql/README.md @@ -18,7 +18,7 @@ All automatic values **mssql module** is using are available [here](https://gith | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/mssql/main.tf b/modules/mssql/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/mssql/main.tf +++ b/modules/mssql/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/mssql/variables.tf b/modules/mssql/variables.tf index 354b9e37..4d331561 100644 --- a/modules/mssql/variables.tf +++ b/modules/mssql/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/mssql/versions.tf b/modules/mssql/versions.tf index b8569144..41f2989f 100644 --- a/modules/mssql/versions.tf +++ b/modules/mssql/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/mysql/README.md b/modules/mysql/README.md index 0dc32a91..e03e8ffa 100644 --- a/modules/mysql/README.md +++ b/modules/mysql/README.md @@ -18,7 +18,7 @@ All automatic values **mysql module** is using are available [here](https://gith | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/mysql/main.tf b/modules/mysql/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/mysql/main.tf +++ b/modules/mysql/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/mysql/variables.tf b/modules/mysql/variables.tf index 354b9e37..4d331561 100644 --- a/modules/mysql/variables.tf +++ b/modules/mysql/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/mysql/versions.tf b/modules/mysql/versions.tf index b8569144..41f2989f 100644 --- a/modules/mysql/versions.tf +++ b/modules/mysql/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/nfs/README.md b/modules/nfs/README.md index 46ca7b67..9ed3b94a 100644 --- a/modules/nfs/README.md +++ b/modules/nfs/README.md @@ -18,7 +18,7 @@ All automatic values **nfs module** is using are available [here](https://github | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/nfs/main.tf b/modules/nfs/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/nfs/main.tf +++ b/modules/nfs/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/nfs/variables.tf b/modules/nfs/variables.tf index 354b9e37..4d331561 100644 --- a/modules/nfs/variables.tf +++ b/modules/nfs/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/nfs/versions.tf b/modules/nfs/versions.tf index b8569144..41f2989f 100644 --- a/modules/nfs/versions.tf +++ b/modules/nfs/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/nomad/README.md b/modules/nomad/README.md index b36eebe0..1e7ed387 100644 --- a/modules/nomad/README.md +++ b/modules/nomad/README.md @@ -18,7 +18,7 @@ All automatic values **nomad module** is using are available [here](https://gith | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/nomad/main.tf b/modules/nomad/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/nomad/main.tf +++ b/modules/nomad/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/nomad/variables.tf b/modules/nomad/variables.tf index 354b9e37..4d331561 100644 --- a/modules/nomad/variables.tf +++ b/modules/nomad/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/nomad/versions.tf b/modules/nomad/versions.tf index b8569144..41f2989f 100644 --- a/modules/nomad/versions.tf +++ b/modules/nomad/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/ntp/README.md b/modules/ntp/README.md index deabd0c3..523be7f8 100644 --- a/modules/ntp/README.md +++ b/modules/ntp/README.md @@ -18,7 +18,7 @@ All automatic values **ntp module** is using are available [here](https://github | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/ntp/main.tf b/modules/ntp/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/ntp/main.tf +++ b/modules/ntp/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/ntp/variables.tf b/modules/ntp/variables.tf index 354b9e37..4d331561 100644 --- a/modules/ntp/variables.tf +++ b/modules/ntp/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/ntp/versions.tf b/modules/ntp/versions.tf index b8569144..41f2989f 100644 --- a/modules/ntp/versions.tf +++ b/modules/ntp/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/openvpn/README.md b/modules/openvpn/README.md index f5b25bfc..5b5b5f06 100644 --- a/modules/openvpn/README.md +++ b/modules/openvpn/README.md @@ -18,7 +18,7 @@ All automatic values **openvpn module** is using are available [here](https://gi | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/openvpn/main.tf b/modules/openvpn/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/openvpn/main.tf +++ b/modules/openvpn/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/openvpn/variables.tf b/modules/openvpn/variables.tf index 354b9e37..4d331561 100644 --- a/modules/openvpn/variables.tf +++ b/modules/openvpn/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/openvpn/versions.tf b/modules/openvpn/versions.tf index b8569144..41f2989f 100644 --- a/modules/openvpn/versions.tf +++ b/modules/openvpn/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/oracle-db/README.md b/modules/oracle-db/README.md index 47a19f02..328684c2 100644 --- a/modules/oracle-db/README.md +++ b/modules/oracle-db/README.md @@ -18,7 +18,7 @@ All automatic values **oracle-db module** is using are available [here](https:// | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/oracle-db/main.tf b/modules/oracle-db/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/oracle-db/main.tf +++ b/modules/oracle-db/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/oracle-db/variables.tf b/modules/oracle-db/variables.tf index 354b9e37..4d331561 100644 --- a/modules/oracle-db/variables.tf +++ b/modules/oracle-db/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/oracle-db/versions.tf b/modules/oracle-db/versions.tf index b8569144..41f2989f 100644 --- a/modules/oracle-db/versions.tf +++ b/modules/oracle-db/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/postgresql/README.md b/modules/postgresql/README.md index 64dcd89f..e31b2b2f 100644 --- a/modules/postgresql/README.md +++ b/modules/postgresql/README.md @@ -18,7 +18,7 @@ All automatic values **postgresql module** is using are available [here](https:/ | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/postgresql/main.tf b/modules/postgresql/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/postgresql/main.tf +++ b/modules/postgresql/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/postgresql/variables.tf b/modules/postgresql/variables.tf index 354b9e37..4d331561 100644 --- a/modules/postgresql/variables.tf +++ b/modules/postgresql/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/postgresql/versions.tf b/modules/postgresql/versions.tf index b8569144..41f2989f 100644 --- a/modules/postgresql/versions.tf +++ b/modules/postgresql/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/prometheus/README.md b/modules/prometheus/README.md index 0202bca1..61b3c00c 100644 --- a/modules/prometheus/README.md +++ b/modules/prometheus/README.md @@ -18,7 +18,7 @@ All automatic values **prometheus module** is using are available [here](https:/ | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/prometheus/main.tf b/modules/prometheus/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/prometheus/main.tf +++ b/modules/prometheus/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/prometheus/variables.tf b/modules/prometheus/variables.tf index 354b9e37..4d331561 100644 --- a/modules/prometheus/variables.tf +++ b/modules/prometheus/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/prometheus/versions.tf b/modules/prometheus/versions.tf index b8569144..41f2989f 100644 --- a/modules/prometheus/versions.tf +++ b/modules/prometheus/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/puppet/README.md b/modules/puppet/README.md index a4c17682..50228ad4 100644 --- a/modules/puppet/README.md +++ b/modules/puppet/README.md @@ -18,7 +18,7 @@ All automatic values **puppet module** is using are available [here](https://git | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/puppet/main.tf b/modules/puppet/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/puppet/main.tf +++ b/modules/puppet/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/puppet/variables.tf b/modules/puppet/variables.tf index 354b9e37..4d331561 100644 --- a/modules/puppet/variables.tf +++ b/modules/puppet/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/puppet/versions.tf b/modules/puppet/versions.tf index b8569144..41f2989f 100644 --- a/modules/puppet/versions.tf +++ b/modules/puppet/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/rabbitmq/README.md b/modules/rabbitmq/README.md index 1f8bf76c..05e6f7cd 100644 --- a/modules/rabbitmq/README.md +++ b/modules/rabbitmq/README.md @@ -18,7 +18,7 @@ All automatic values **rabbitmq module** is using are available [here](https://g | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/rabbitmq/main.tf b/modules/rabbitmq/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/rabbitmq/main.tf +++ b/modules/rabbitmq/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/rabbitmq/variables.tf b/modules/rabbitmq/variables.tf index 354b9e37..4d331561 100644 --- a/modules/rabbitmq/variables.tf +++ b/modules/rabbitmq/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/rabbitmq/versions.tf b/modules/rabbitmq/versions.tf index b8569144..41f2989f 100644 --- a/modules/rabbitmq/versions.tf +++ b/modules/rabbitmq/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/rdp/README.md b/modules/rdp/README.md index c3edb947..2b219d21 100644 --- a/modules/rdp/README.md +++ b/modules/rdp/README.md @@ -18,7 +18,7 @@ All automatic values **rdp module** is using are available [here](https://github | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/rdp/main.tf b/modules/rdp/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/rdp/main.tf +++ b/modules/rdp/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/rdp/variables.tf b/modules/rdp/variables.tf index 354b9e37..4d331561 100644 --- a/modules/rdp/variables.tf +++ b/modules/rdp/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/rdp/versions.tf b/modules/rdp/versions.tf index b8569144..41f2989f 100644 --- a/modules/rdp/versions.tf +++ b/modules/rdp/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/redis/README.md b/modules/redis/README.md index 906f0516..fb6db94e 100644 --- a/modules/redis/README.md +++ b/modules/redis/README.md @@ -18,7 +18,7 @@ All automatic values **redis module** is using are available [here](https://gith | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/redis/main.tf b/modules/redis/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/redis/main.tf +++ b/modules/redis/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/redis/variables.tf b/modules/redis/variables.tf index 354b9e37..4d331561 100644 --- a/modules/redis/variables.tf +++ b/modules/redis/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/redis/versions.tf b/modules/redis/versions.tf index b8569144..41f2989f 100644 --- a/modules/redis/versions.tf +++ b/modules/redis/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/redshift/README.md b/modules/redshift/README.md index ba388de4..6f70f3e4 100644 --- a/modules/redshift/README.md +++ b/modules/redshift/README.md @@ -18,7 +18,7 @@ All automatic values **redshift module** is using are available [here](https://g | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/redshift/main.tf b/modules/redshift/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/redshift/main.tf +++ b/modules/redshift/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/redshift/variables.tf b/modules/redshift/variables.tf index 354b9e37..4d331561 100644 --- a/modules/redshift/variables.tf +++ b/modules/redshift/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/redshift/versions.tf b/modules/redshift/versions.tf index b8569144..41f2989f 100644 --- a/modules/redshift/versions.tf +++ b/modules/redshift/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/splunk/README.md b/modules/splunk/README.md index 23cb3da4..8c5a68bd 100644 --- a/modules/splunk/README.md +++ b/modules/splunk/README.md @@ -18,7 +18,7 @@ All automatic values **splunk module** is using are available [here](https://git | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/splunk/main.tf b/modules/splunk/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/splunk/main.tf +++ b/modules/splunk/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/splunk/variables.tf b/modules/splunk/variables.tf index 354b9e37..4d331561 100644 --- a/modules/splunk/variables.tf +++ b/modules/splunk/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/splunk/versions.tf b/modules/splunk/versions.tf index b8569144..41f2989f 100644 --- a/modules/splunk/versions.tf +++ b/modules/splunk/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/squid/README.md b/modules/squid/README.md index 2d398515..e3869ce7 100644 --- a/modules/squid/README.md +++ b/modules/squid/README.md @@ -18,7 +18,7 @@ All automatic values **squid module** is using are available [here](https://gith | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/squid/main.tf b/modules/squid/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/squid/main.tf +++ b/modules/squid/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/squid/variables.tf b/modules/squid/variables.tf index 354b9e37..4d331561 100644 --- a/modules/squid/variables.tf +++ b/modules/squid/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/squid/versions.tf b/modules/squid/versions.tf index b8569144..41f2989f 100644 --- a/modules/squid/versions.tf +++ b/modules/squid/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/ssh/README.md b/modules/ssh/README.md index 62b0bf23..f6c150e2 100644 --- a/modules/ssh/README.md +++ b/modules/ssh/README.md @@ -18,7 +18,7 @@ All automatic values **ssh module** is using are available [here](https://github | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/ssh/main.tf b/modules/ssh/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/ssh/main.tf +++ b/modules/ssh/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/ssh/variables.tf b/modules/ssh/variables.tf index 354b9e37..4d331561 100644 --- a/modules/ssh/variables.tf +++ b/modules/ssh/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/ssh/versions.tf b/modules/ssh/versions.tf index b8569144..41f2989f 100644 --- a/modules/ssh/versions.tf +++ b/modules/ssh/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/storm/README.md b/modules/storm/README.md index 37a5e4ef..2d074861 100644 --- a/modules/storm/README.md +++ b/modules/storm/README.md @@ -18,7 +18,7 @@ All automatic values **storm module** is using are available [here](https://gith | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/storm/main.tf b/modules/storm/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/storm/main.tf +++ b/modules/storm/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/storm/variables.tf b/modules/storm/variables.tf index 354b9e37..4d331561 100644 --- a/modules/storm/variables.tf +++ b/modules/storm/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/storm/versions.tf b/modules/storm/versions.tf index b8569144..41f2989f 100644 --- a/modules/storm/versions.tf +++ b/modules/storm/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/web/README.md b/modules/web/README.md index 3cea92cf..02e3cdd0 100644 --- a/modules/web/README.md +++ b/modules/web/README.md @@ -18,7 +18,7 @@ All automatic values **web module** is using are available [here](https://github | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/web/main.tf b/modules/web/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/web/main.tf +++ b/modules/web/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/web/variables.tf b/modules/web/variables.tf index 354b9e37..4d331561 100644 --- a/modules/web/variables.tf +++ b/modules/web/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/web/versions.tf b/modules/web/versions.tf index b8569144..41f2989f 100644 --- a/modules/web/versions.tf +++ b/modules/web/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/winrm/README.md b/modules/winrm/README.md index 44efeeb0..ce56bdd0 100644 --- a/modules/winrm/README.md +++ b/modules/winrm/README.md @@ -18,7 +18,7 @@ All automatic values **winrm module** is using are available [here](https://gith | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/winrm/main.tf b/modules/winrm/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/winrm/main.tf +++ b/modules/winrm/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/winrm/variables.tf b/modules/winrm/variables.tf index 354b9e37..4d331561 100644 --- a/modules/winrm/variables.tf +++ b/modules/winrm/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/winrm/versions.tf b/modules/winrm/versions.tf index b8569144..41f2989f 100644 --- a/modules/winrm/versions.tf +++ b/modules/winrm/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/zipkin/README.md b/modules/zipkin/README.md index 6aff856c..aa4583b6 100644 --- a/modules/zipkin/README.md +++ b/modules/zipkin/README.md @@ -18,7 +18,7 @@ All automatic values **zipkin module** is using are available [here](https://git | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/zipkin/main.tf b/modules/zipkin/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/zipkin/main.tf +++ b/modules/zipkin/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/zipkin/variables.tf b/modules/zipkin/variables.tf index 354b9e37..4d331561 100644 --- a/modules/zipkin/variables.tf +++ b/modules/zipkin/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/zipkin/versions.tf b/modules/zipkin/versions.tf index b8569144..41f2989f 100644 --- a/modules/zipkin/versions.tf +++ b/modules/zipkin/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/modules/zookeeper/README.md b/modules/zookeeper/README.md index e9ac3a9d..e91fd374 100644 --- a/modules/zookeeper/README.md +++ b/modules/zookeeper/README.md @@ -18,7 +18,7 @@ All automatic values **zookeeper module** is using are available [here](https:// | Name | Version | |------|---------| -| terraform | ~> 0.12.6 | +| terraform | >= 0.12.6, < 0.14 | | aws | ~> 2.42 | ## Providers @@ -92,6 +92,7 @@ No provider. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/zookeeper/main.tf b/modules/zookeeper/main.tf index 2c85546f..758bb7bc 100644 --- a/modules/zookeeper/main.tf +++ b/modules/zookeeper/main.tf @@ -1,12 +1,13 @@ module "sg" { source = "../../" - create = var.create - name = var.name - use_name_prefix = var.use_name_prefix - description = var.description - vpc_id = var.vpc_id - tags = var.tags + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags ########## # Ingress diff --git a/modules/zookeeper/variables.tf b/modules/zookeeper/variables.tf index 354b9e37..4d331561 100644 --- a/modules/zookeeper/variables.tf +++ b/modules/zookeeper/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) diff --git a/modules/zookeeper/versions.tf b/modules/zookeeper/versions.tf index b8569144..41f2989f 100644 --- a/modules/zookeeper/versions.tf +++ b/modules/zookeeper/versions.tf @@ -1,5 +1,5 @@ terraform { - required_version = "~> 0.12.6" + required_version = ">= 0.12.6, < 0.14" required_providers { aws = "~> 2.42" diff --git a/rules.tf b/rules.tf index d190f74d..76ba6d62 100644 --- a/rules.tf +++ b/rules.tf @@ -78,6 +78,8 @@ variable "rules" { kubernetes-api-tcp = [6443, 6443, "tcp", "Kubernetes API Server"] # LDAPS ldaps-tcp = [636, 636, "tcp", "LDAPS"] + # Logstash + logstash-tcp = [5044, 5044, "tcp", "Logstash"] # Memcached memcached-tcp = [11211, 11211, "tcp", "Memcached"] # MinIO @@ -268,6 +270,11 @@ variable "auto_groups" { ingress_with_self = ["all-all"] egress_rules = ["all-all"] } + logstash = { + ingress_rules = ["logstash-tcp"] + ingress_with_self = ["all-all"] + egress_rules = ["all-all"] + } memcached = { ingress_rules = ["memcached-tcp"] ingress_with_self = ["all-all"] diff --git a/variables.tf b/variables.tf index 174f6b98..45bb12eb 100644 --- a/variables.tf +++ b/variables.tf @@ -29,6 +29,12 @@ variable "description" { default = "Security Group managed by Terraform" } +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + variable "tags" { description = "A mapping of tags to assign to security group" type = map(string) From ef2a56fa4a1000c329d354a7e4c16fa6b5c55593 Mon Sep 17 00:00:00 2001 From: Anton Babenko
"::/0"
]
{
"activemq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"activemq-5671-tcp",
"activemq-8883-tcp",
"activemq-61614-tcp",
"activemq-61617-tcp",
"activemq-61619-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"alertmanager": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"alertmanager-9093-tcp",
"alertmanager-9094-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"carbon-relay-ng": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"carbon-line-in-tcp",
"carbon-line-in-udp",
"carbon-pickle-tcp",
"carbon-pickle-udp",
"carbon-gui-udp"
],
"ingress_with_self": [
"all-all"
]
},
"cassandra": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"cassandra-clients-tcp",
"cassandra-thrift-clients-tcp",
"cassandra-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"consul": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"consul-tcp",
"consul-cli-rpc-tcp",
"consul-webui-tcp",
"consul-dns-tcp",
"consul-dns-udp",
"consul-serf-lan-tcp",
"consul-serf-lan-udp",
"consul-serf-wan-tcp",
"consul-serf-wan-udp"
],
"ingress_with_self": [
"all-all"
]
},
"docker-swarm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"docker-swarm-mngmt-tcp",
"docker-swarm-node-tcp",
"docker-swarm-node-udp",
"docker-swarm-overlay-udp"
],
"ingress_with_self": [
"all-all"
]
},
"elasticsearch": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"elasticsearch-rest-tcp",
"elasticsearch-java-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"grafana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"grafana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"graphite-statsd": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"graphite-webui",
"graphite-2003-tcp",
"graphite-2004-tcp",
"graphite-2023-tcp",
"graphite-2024-tcp",
"graphite-8080-tcp",
"graphite-8125-tcp",
"graphite-8125-udp",
"graphite-8126-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-80": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-8080": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-8080-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-8443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-8443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-4500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-4500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"kafka": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kafka-broker-tcp",
"kafka-broker-tls-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kibana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kibana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kubernetes-api": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kubernetes-api-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ldaps": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ldaps-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"logstash": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"logstash-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"memcached": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"memcached-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"minio": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"minio-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mongodb": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mongodb-27017-tcp",
"mongodb-27018-tcp",
"mongodb-27019-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mssql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mssql-tcp",
"mssql-udp",
"mssql-analytics-tcp",
"mssql-broker-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mysql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mysql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nfs": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nfs-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nomad": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nomad-http-tcp",
"nomad-rpc-tcp",
"nomad-serf-tcp",
"nomad-serf-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ntp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ntp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"openvpn": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"openvpn-udp",
"openvpn-tcp",
"openvpn-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"oracle-db": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"oracle-db-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"postgresql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"postgresql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"prometheus": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"prometheus-http-tcp",
"prometheus-pushgateway-http-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"puppet": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"puppet-tcp",
"puppetdb-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rabbitmq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rabbitmq-4369-tcp",
"rabbitmq-5671-tcp",
"rabbitmq-5672-tcp",
"rabbitmq-15672-tcp",
"rabbitmq-25672-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rdp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rdp-tcp",
"rdp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"redis": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redis-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"redshift": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redshift-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"splunk": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"splunk-indexer-tcp",
"splunk-clients-tcp",
"splunk-splunkd-tcp",
"splunk-hec-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"squid": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"squid-proxy-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ssh": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ssh-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"storm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"storm-nimbus-tcp",
"storm-ui-tcp",
"storm-supervisor-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"web": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp",
"http-8080-tcp",
"https-443-tcp",
"web-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"winrm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"winrm-http-tcp",
"winrm-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zipkin": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zipkin-admin-tcp",
"zipkin-admin-query-tcp",
"zipkin-admin-web-tcp",
"zipkin-query-tcp",
"zipkin-web-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zookeeper": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zookeeper-2181-tcp",
"zookeeper-2888-tcp",
"zookeeper-3888-tcp",
"zookeeper-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
}
} | no |
+| auto\_groups | Map of groups of security group rules to use to generate modules (see update\_groups.sh) | `map(map(list(string)))` | {
"activemq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"activemq-5671-tcp",
"activemq-8883-tcp",
"activemq-61614-tcp",
"activemq-61617-tcp",
"activemq-61619-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"alertmanager": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"alertmanager-9093-tcp",
"alertmanager-9094-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"carbon-relay-ng": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"carbon-line-in-tcp",
"carbon-line-in-udp",
"carbon-pickle-tcp",
"carbon-pickle-udp",
"carbon-gui-udp"
],
"ingress_with_self": [
"all-all"
]
},
"cassandra": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"cassandra-clients-tcp",
"cassandra-thrift-clients-tcp",
"cassandra-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"consul": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"consul-tcp",
"consul-cli-rpc-tcp",
"consul-webui-tcp",
"consul-dns-tcp",
"consul-dns-udp",
"consul-serf-lan-tcp",
"consul-serf-lan-udp",
"consul-serf-wan-tcp",
"consul-serf-wan-udp"
],
"ingress_with_self": [
"all-all"
]
},
"docker-swarm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"docker-swarm-mngmt-tcp",
"docker-swarm-node-tcp",
"docker-swarm-node-udp",
"docker-swarm-overlay-udp"
],
"ingress_with_self": [
"all-all"
]
},
"elasticsearch": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"elasticsearch-rest-tcp",
"elasticsearch-java-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"grafana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"grafana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"graphite-statsd": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"graphite-webui",
"graphite-2003-tcp",
"graphite-2004-tcp",
"graphite-2023-tcp",
"graphite-2024-tcp",
"graphite-8080-tcp",
"graphite-8125-tcp",
"graphite-8125-udp",
"graphite-8126-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-80": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-8080": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-8080-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-8443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-8443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-4500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-4500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"kafka": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kafka-broker-tcp",
"kafka-broker-tls-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kibana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kibana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kubernetes-api": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kubernetes-api-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ldaps": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ldaps-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"logstash": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"logstash-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"memcached": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"memcached-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"minio": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"minio-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mongodb": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mongodb-27017-tcp",
"mongodb-27018-tcp",
"mongodb-27019-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mssql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mssql-tcp",
"mssql-udp",
"mssql-analytics-tcp",
"mssql-broker-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mysql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mysql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nfs": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nfs-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nomad": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nomad-http-tcp",
"nomad-rpc-tcp",
"nomad-serf-tcp",
"nomad-serf-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ntp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ntp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"openvpn": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"openvpn-udp",
"openvpn-tcp",
"openvpn-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"oracle-db": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"oracle-db-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"postgresql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"postgresql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"prometheus": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"prometheus-http-tcp",
"prometheus-pushgateway-http-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"puppet": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"puppet-tcp",
"puppetdb-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rabbitmq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rabbitmq-4369-tcp",
"rabbitmq-5671-tcp",
"rabbitmq-5672-tcp",
"rabbitmq-15672-tcp",
"rabbitmq-25672-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rdp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rdp-tcp",
"rdp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"redis": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redis-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"redshift": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redshift-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"solr": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"solr-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"splunk": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"splunk-indexer-tcp",
"splunk-clients-tcp",
"splunk-splunkd-tcp",
"splunk-hec-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"squid": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"squid-proxy-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ssh": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ssh-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"storm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"storm-nimbus-tcp",
"storm-ui-tcp",
"storm-supervisor-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"web": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp",
"http-8080-tcp",
"https-443-tcp",
"web-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"winrm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"winrm-http-tcp",
"winrm-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zipkin": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zipkin-admin-tcp",
"zipkin-admin-query-tcp",
"zipkin-admin-web-tcp",
"zipkin-query-tcp",
"zipkin-web-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zookeeper": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zookeeper-2181-tcp",
"zookeeper-2888-tcp",
"zookeeper-3888-tcp",
"zookeeper-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
}
} | no |
| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no |
| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no |
| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no |
@@ -215,7 +215,7 @@ No issue is creating limit on this module.
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
-| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | {
"_": [
"",
"",
""
],
"activemq-5671-tcp": [
5671,
5671,
"tcp",
"ActiveMQ AMQP"
],
"activemq-61614-tcp": [
61614,
61614,
"tcp",
"ActiveMQ STOMP"
],
"activemq-61617-tcp": [
61617,
61617,
"tcp",
"ActiveMQ OpenWire"
],
"activemq-61619-tcp": [
61619,
61619,
"tcp",
"ActiveMQ WebSocket"
],
"activemq-8883-tcp": [
8883,
8883,
"tcp",
"ActiveMQ MQTT"
],
"alertmanager-9093-tcp": [
9093,
9093,
"tcp",
"Alert Manager"
],
"alertmanager-9094-tcp": [
9094,
9094,
"tcp",
"Alert Manager Cluster"
],
"all-all": [
-1,
-1,
"-1",
"All protocols"
],
"all-icmp": [
-1,
-1,
"icmp",
"All IPV4 ICMP"
],
"all-ipv6-icmp": [
-1,
-1,
58,
"All IPV6 ICMP"
],
"all-tcp": [
0,
65535,
"tcp",
"All TCP ports"
],
"all-udp": [
0,
65535,
"udp",
"All UDP ports"
],
"carbon-admin-tcp": [
2004,
2004,
"tcp",
"Carbon admin"
],
"carbon-gui-udp": [
8081,
8081,
"tcp",
"Carbon GUI"
],
"carbon-line-in-tcp": [
2003,
2003,
"tcp",
"Carbon line-in"
],
"carbon-line-in-udp": [
2003,
2003,
"udp",
"Carbon line-in"
],
"carbon-pickle-tcp": [
2013,
2013,
"tcp",
"Carbon pickle"
],
"carbon-pickle-udp": [
2013,
2013,
"udp",
"Carbon pickle"
],
"cassandra-clients-tcp": [
9042,
9042,
"tcp",
"Cassandra clients"
],
"cassandra-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
],
"cassandra-thrift-clients-tcp": [
9160,
9160,
"tcp",
"Cassandra Thrift clients"
],
"consul-cli-rpc-tcp": [
8400,
8400,
"tcp",
"Consul CLI RPC"
],
"consul-dns-tcp": [
8600,
8600,
"tcp",
"Consul DNS"
],
"consul-dns-udp": [
8600,
8600,
"udp",
"Consul DNS"
],
"consul-serf-lan-tcp": [
8301,
8301,
"tcp",
"Serf LAN"
],
"consul-serf-lan-udp": [
8301,
8301,
"udp",
"Serf LAN"
],
"consul-serf-wan-tcp": [
8302,
8302,
"tcp",
"Serf WAN"
],
"consul-serf-wan-udp": [
8302,
8302,
"udp",
"Serf WAN"
],
"consul-tcp": [
8300,
8300,
"tcp",
"Consul server"
],
"consul-webui-tcp": [
8500,
8500,
"tcp",
"Consul web UI"
],
"dns-tcp": [
53,
53,
"tcp",
"DNS"
],
"dns-udp": [
53,
53,
"udp",
"DNS"
],
"docker-swarm-mngmt-tcp": [
2377,
2377,
"tcp",
"Docker Swarm cluster management"
],
"docker-swarm-node-tcp": [
7946,
7946,
"tcp",
"Docker Swarm node"
],
"docker-swarm-node-udp": [
7946,
7946,
"udp",
"Docker Swarm node"
],
"docker-swarm-overlay-udp": [
4789,
4789,
"udp",
"Docker Swarm Overlay Network Traffic"
],
"elasticsearch-java-tcp": [
9300,
9300,
"tcp",
"Elasticsearch Java interface"
],
"elasticsearch-rest-tcp": [
9200,
9200,
"tcp",
"Elasticsearch REST interface"
],
"grafana-tcp": [
3000,
3000,
"tcp",
"Grafana Dashboard"
],
"graphite-2003-tcp": [
2003,
2003,
"tcp",
"Carbon receiver plain text"
],
"graphite-2004-tcp": [
2004,
2004,
"tcp",
"Carbon receiver pickle"
],
"graphite-2023-tcp": [
2023,
2023,
"tcp",
"Carbon aggregator plaintext"
],
"graphite-2024-tcp": [
2024,
2024,
"tcp",
"Carbon aggregator pickle"
],
"graphite-8080-tcp": [
8080,
8080,
"tcp",
"Graphite gunicorn port"
],
"graphite-8125-tcp": [
8125,
8125,
"tcp",
"Statsd TCP"
],
"graphite-8125-udp": [
8125,
8125,
"udp",
"Statsd UDP default"
],
"graphite-8126-tcp": [
8126,
8126,
"tcp",
"Statsd admin"
],
"graphite-webui": [
80,
80,
"tcp",
"Graphite admin interface"
],
"http-80-tcp": [
80,
80,
"tcp",
"HTTP"
],
"http-8080-tcp": [
8080,
8080,
"tcp",
"HTTP"
],
"https-443-tcp": [
443,
443,
"tcp",
"HTTPS"
],
"https-8443-tcp": [
8443,
8443,
"tcp",
"HTTPS"
],
"ipsec-4500-udp": [
4500,
4500,
"udp",
"IPSEC NAT-T"
],
"ipsec-500-udp": [
500,
500,
"udp",
"IPSEC ISAKMP"
],
"kafka-broker-tcp": [
9092,
9092,
"tcp",
"Kafka broker 0.8.2+"
],
"kafka-broker-tls-tcp": [
9094,
9094,
"tcp",
"Kafka TLS enabled broker 0.8.2+"
],
"kibana-tcp": [
5601,
5601,
"tcp",
"Kibana Web Interface"
],
"kubernetes-api-tcp": [
6443,
6443,
"tcp",
"Kubernetes API Server"
],
"ldaps-tcp": [
636,
636,
"tcp",
"LDAPS"
],
"logstash-tcp": [
5044,
5044,
"tcp",
"Logstash"
],
"memcached-tcp": [
11211,
11211,
"tcp",
"Memcached"
],
"minio-tcp": [
9000,
9000,
"tcp",
"MinIO"
],
"mongodb-27017-tcp": [
27017,
27017,
"tcp",
"MongoDB"
],
"mongodb-27018-tcp": [
27018,
27018,
"tcp",
"MongoDB shard"
],
"mongodb-27019-tcp": [
27019,
27019,
"tcp",
"MongoDB config server"
],
"mssql-analytics-tcp": [
2383,
2383,
"tcp",
"MSSQL Analytics"
],
"mssql-broker-tcp": [
4022,
4022,
"tcp",
"MSSQL Broker"
],
"mssql-tcp": [
1433,
1433,
"tcp",
"MSSQL Server"
],
"mssql-udp": [
1434,
1434,
"udp",
"MSSQL Browser"
],
"mysql-tcp": [
3306,
3306,
"tcp",
"MySQL/Aurora"
],
"nfs-tcp": [
2049,
2049,
"tcp",
"NFS/EFS"
],
"nomad-http-tcp": [
4646,
4646,
"tcp",
"Nomad HTTP"
],
"nomad-rpc-tcp": [
4647,
4647,
"tcp",
"Nomad RPC"
],
"nomad-serf-tcp": [
4648,
4648,
"tcp",
"Serf"
],
"nomad-serf-udp": [
4648,
4648,
"udp",
"Serf"
],
"ntp-udp": [
123,
123,
"udp",
"NTP"
],
"openvpn-https-tcp": [
443,
443,
"tcp",
"OpenVPN"
],
"openvpn-tcp": [
943,
943,
"tcp",
"OpenVPN"
],
"openvpn-udp": [
1194,
1194,
"udp",
"OpenVPN"
],
"oracle-db-tcp": [
1521,
1521,
"tcp",
"Oracle"
],
"postgresql-tcp": [
5432,
5432,
"tcp",
"PostgreSQL"
],
"prometheus-http-tcp": [
9090,
9090,
"tcp",
"Prometheus"
],
"prometheus-pushgateway-http-tcp": [
9091,
9091,
"tcp",
"Prometheus Pushgateway"
],
"puppet-tcp": [
8140,
8140,
"tcp",
"Puppet"
],
"puppetdb-tcp": [
8081,
8081,
"tcp",
"PuppetDB"
],
"rabbitmq-15672-tcp": [
15672,
15672,
"tcp",
"RabbitMQ"
],
"rabbitmq-25672-tcp": [
25672,
25672,
"tcp",
"RabbitMQ"
],
"rabbitmq-4369-tcp": [
4369,
4369,
"tcp",
"RabbitMQ epmd"
],
"rabbitmq-5671-tcp": [
5671,
5671,
"tcp",
"RabbitMQ"
],
"rabbitmq-5672-tcp": [
5672,
5672,
"tcp",
"RabbitMQ"
],
"rdp-tcp": [
3389,
3389,
"tcp",
"Remote Desktop"
],
"rdp-udp": [
3389,
3389,
"udp",
"Remote Desktop"
],
"redis-tcp": [
6379,
6379,
"tcp",
"Redis"
],
"redshift-tcp": [
5439,
5439,
"tcp",
"Redshift"
],
"splunk-hec-tcp": [
8088,
8088,
"tcp",
"Splunk HEC"
],
"splunk-indexer-tcp": [
9997,
9997,
"tcp",
"Splunk indexer"
],
"splunk-splunkd-tcp": [
8089,
8089,
"tcp",
"Splunkd"
],
"splunk-web-tcp": [
8000,
8000,
"tcp",
"Splunk Web"
],
"squid-proxy-tcp": [
3128,
3128,
"tcp",
"Squid default proxy"
],
"ssh-tcp": [
22,
22,
"tcp",
"SSH"
],
"storm-nimbus-tcp": [
6627,
6627,
"tcp",
"Nimbus"
],
"storm-supervisor-tcp": [
6700,
6703,
"tcp",
"Supervisor"
],
"storm-ui-tcp": [
8080,
8080,
"tcp",
"Storm UI"
],
"web-jmx-tcp": [
1099,
1099,
"tcp",
"JMX"
],
"winrm-http-tcp": [
5985,
5985,
"tcp",
"WinRM HTTP"
],
"winrm-https-tcp": [
5986,
5986,
"tcp",
"WinRM HTTPS"
],
"zipkin-admin-query-tcp": [
9901,
9901,
"tcp",
"Zipkin Admin port query"
],
"zipkin-admin-tcp": [
9990,
9990,
"tcp",
"Zipkin Admin port collector"
],
"zipkin-admin-web-tcp": [
9991,
9991,
"tcp",
"Zipkin Admin port web"
],
"zipkin-query-tcp": [
9411,
9411,
"tcp",
"Zipkin query port"
],
"zipkin-web-tcp": [
8080,
8080,
"tcp",
"Zipkin web port"
],
"zookeeper-2181-tcp": [
2181,
2181,
"tcp",
"Zookeeper"
],
"zookeeper-2888-tcp": [
2888,
2888,
"tcp",
"Zookeeper"
],
"zookeeper-3888-tcp": [
3888,
3888,
"tcp",
"Zookeeper"
],
"zookeeper-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
]
} | no |
+| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | {
"_": [
"",
"",
""
],
"activemq-5671-tcp": [
5671,
5671,
"tcp",
"ActiveMQ AMQP"
],
"activemq-61614-tcp": [
61614,
61614,
"tcp",
"ActiveMQ STOMP"
],
"activemq-61617-tcp": [
61617,
61617,
"tcp",
"ActiveMQ OpenWire"
],
"activemq-61619-tcp": [
61619,
61619,
"tcp",
"ActiveMQ WebSocket"
],
"activemq-8883-tcp": [
8883,
8883,
"tcp",
"ActiveMQ MQTT"
],
"alertmanager-9093-tcp": [
9093,
9093,
"tcp",
"Alert Manager"
],
"alertmanager-9094-tcp": [
9094,
9094,
"tcp",
"Alert Manager Cluster"
],
"all-all": [
-1,
-1,
"-1",
"All protocols"
],
"all-icmp": [
-1,
-1,
"icmp",
"All IPV4 ICMP"
],
"all-ipv6-icmp": [
-1,
-1,
58,
"All IPV6 ICMP"
],
"all-tcp": [
0,
65535,
"tcp",
"All TCP ports"
],
"all-udp": [
0,
65535,
"udp",
"All UDP ports"
],
"carbon-admin-tcp": [
2004,
2004,
"tcp",
"Carbon admin"
],
"carbon-gui-udp": [
8081,
8081,
"tcp",
"Carbon GUI"
],
"carbon-line-in-tcp": [
2003,
2003,
"tcp",
"Carbon line-in"
],
"carbon-line-in-udp": [
2003,
2003,
"udp",
"Carbon line-in"
],
"carbon-pickle-tcp": [
2013,
2013,
"tcp",
"Carbon pickle"
],
"carbon-pickle-udp": [
2013,
2013,
"udp",
"Carbon pickle"
],
"cassandra-clients-tcp": [
9042,
9042,
"tcp",
"Cassandra clients"
],
"cassandra-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
],
"cassandra-thrift-clients-tcp": [
9160,
9160,
"tcp",
"Cassandra Thrift clients"
],
"consul-cli-rpc-tcp": [
8400,
8400,
"tcp",
"Consul CLI RPC"
],
"consul-dns-tcp": [
8600,
8600,
"tcp",
"Consul DNS"
],
"consul-dns-udp": [
8600,
8600,
"udp",
"Consul DNS"
],
"consul-serf-lan-tcp": [
8301,
8301,
"tcp",
"Serf LAN"
],
"consul-serf-lan-udp": [
8301,
8301,
"udp",
"Serf LAN"
],
"consul-serf-wan-tcp": [
8302,
8302,
"tcp",
"Serf WAN"
],
"consul-serf-wan-udp": [
8302,
8302,
"udp",
"Serf WAN"
],
"consul-tcp": [
8300,
8300,
"tcp",
"Consul server"
],
"consul-webui-tcp": [
8500,
8500,
"tcp",
"Consul web UI"
],
"dns-tcp": [
53,
53,
"tcp",
"DNS"
],
"dns-udp": [
53,
53,
"udp",
"DNS"
],
"docker-swarm-mngmt-tcp": [
2377,
2377,
"tcp",
"Docker Swarm cluster management"
],
"docker-swarm-node-tcp": [
7946,
7946,
"tcp",
"Docker Swarm node"
],
"docker-swarm-node-udp": [
7946,
7946,
"udp",
"Docker Swarm node"
],
"docker-swarm-overlay-udp": [
4789,
4789,
"udp",
"Docker Swarm Overlay Network Traffic"
],
"elasticsearch-java-tcp": [
9300,
9300,
"tcp",
"Elasticsearch Java interface"
],
"elasticsearch-rest-tcp": [
9200,
9200,
"tcp",
"Elasticsearch REST interface"
],
"grafana-tcp": [
3000,
3000,
"tcp",
"Grafana Dashboard"
],
"graphite-2003-tcp": [
2003,
2003,
"tcp",
"Carbon receiver plain text"
],
"graphite-2004-tcp": [
2004,
2004,
"tcp",
"Carbon receiver pickle"
],
"graphite-2023-tcp": [
2023,
2023,
"tcp",
"Carbon aggregator plaintext"
],
"graphite-2024-tcp": [
2024,
2024,
"tcp",
"Carbon aggregator pickle"
],
"graphite-8080-tcp": [
8080,
8080,
"tcp",
"Graphite gunicorn port"
],
"graphite-8125-tcp": [
8125,
8125,
"tcp",
"Statsd TCP"
],
"graphite-8125-udp": [
8125,
8125,
"udp",
"Statsd UDP default"
],
"graphite-8126-tcp": [
8126,
8126,
"tcp",
"Statsd admin"
],
"graphite-webui": [
80,
80,
"tcp",
"Graphite admin interface"
],
"http-80-tcp": [
80,
80,
"tcp",
"HTTP"
],
"http-8080-tcp": [
8080,
8080,
"tcp",
"HTTP"
],
"https-443-tcp": [
443,
443,
"tcp",
"HTTPS"
],
"https-8443-tcp": [
8443,
8443,
"tcp",
"HTTPS"
],
"ipsec-4500-udp": [
4500,
4500,
"udp",
"IPSEC NAT-T"
],
"ipsec-500-udp": [
500,
500,
"udp",
"IPSEC ISAKMP"
],
"kafka-broker-tcp": [
9092,
9092,
"tcp",
"Kafka broker 0.8.2+"
],
"kafka-broker-tls-tcp": [
9094,
9094,
"tcp",
"Kafka TLS enabled broker 0.8.2+"
],
"kibana-tcp": [
5601,
5601,
"tcp",
"Kibana Web Interface"
],
"kubernetes-api-tcp": [
6443,
6443,
"tcp",
"Kubernetes API Server"
],
"ldaps-tcp": [
636,
636,
"tcp",
"LDAPS"
],
"logstash-tcp": [
5044,
5044,
"tcp",
"Logstash"
],
"memcached-tcp": [
11211,
11211,
"tcp",
"Memcached"
],
"minio-tcp": [
9000,
9000,
"tcp",
"MinIO"
],
"mongodb-27017-tcp": [
27017,
27017,
"tcp",
"MongoDB"
],
"mongodb-27018-tcp": [
27018,
27018,
"tcp",
"MongoDB shard"
],
"mongodb-27019-tcp": [
27019,
27019,
"tcp",
"MongoDB config server"
],
"mssql-analytics-tcp": [
2383,
2383,
"tcp",
"MSSQL Analytics"
],
"mssql-broker-tcp": [
4022,
4022,
"tcp",
"MSSQL Broker"
],
"mssql-tcp": [
1433,
1433,
"tcp",
"MSSQL Server"
],
"mssql-udp": [
1434,
1434,
"udp",
"MSSQL Browser"
],
"mysql-tcp": [
3306,
3306,
"tcp",
"MySQL/Aurora"
],
"nfs-tcp": [
2049,
2049,
"tcp",
"NFS/EFS"
],
"nomad-http-tcp": [
4646,
4646,
"tcp",
"Nomad HTTP"
],
"nomad-rpc-tcp": [
4647,
4647,
"tcp",
"Nomad RPC"
],
"nomad-serf-tcp": [
4648,
4648,
"tcp",
"Serf"
],
"nomad-serf-udp": [
4648,
4648,
"udp",
"Serf"
],
"ntp-udp": [
123,
123,
"udp",
"NTP"
],
"openvpn-https-tcp": [
443,
443,
"tcp",
"OpenVPN"
],
"openvpn-tcp": [
943,
943,
"tcp",
"OpenVPN"
],
"openvpn-udp": [
1194,
1194,
"udp",
"OpenVPN"
],
"oracle-db-tcp": [
1521,
1521,
"tcp",
"Oracle"
],
"postgresql-tcp": [
5432,
5432,
"tcp",
"PostgreSQL"
],
"prometheus-http-tcp": [
9090,
9090,
"tcp",
"Prometheus"
],
"prometheus-pushgateway-http-tcp": [
9091,
9091,
"tcp",
"Prometheus Pushgateway"
],
"puppet-tcp": [
8140,
8140,
"tcp",
"Puppet"
],
"puppetdb-tcp": [
8081,
8081,
"tcp",
"PuppetDB"
],
"rabbitmq-15672-tcp": [
15672,
15672,
"tcp",
"RabbitMQ"
],
"rabbitmq-25672-tcp": [
25672,
25672,
"tcp",
"RabbitMQ"
],
"rabbitmq-4369-tcp": [
4369,
4369,
"tcp",
"RabbitMQ epmd"
],
"rabbitmq-5671-tcp": [
5671,
5671,
"tcp",
"RabbitMQ"
],
"rabbitmq-5672-tcp": [
5672,
5672,
"tcp",
"RabbitMQ"
],
"rdp-tcp": [
3389,
3389,
"tcp",
"Remote Desktop"
],
"rdp-udp": [
3389,
3389,
"udp",
"Remote Desktop"
],
"redis-tcp": [
6379,
6379,
"tcp",
"Redis"
],
"redshift-tcp": [
5439,
5439,
"tcp",
"Redshift"
],
"solr-tcp": [
8983,
8987,
"tcp",
"Solr"
],
"splunk-hec-tcp": [
8088,
8088,
"tcp",
"Splunk HEC"
],
"splunk-indexer-tcp": [
9997,
9997,
"tcp",
"Splunk indexer"
],
"splunk-splunkd-tcp": [
8089,
8089,
"tcp",
"Splunkd"
],
"splunk-web-tcp": [
8000,
8000,
"tcp",
"Splunk Web"
],
"squid-proxy-tcp": [
3128,
3128,
"tcp",
"Squid default proxy"
],
"ssh-tcp": [
22,
22,
"tcp",
"SSH"
],
"storm-nimbus-tcp": [
6627,
6627,
"tcp",
"Nimbus"
],
"storm-supervisor-tcp": [
6700,
6703,
"tcp",
"Supervisor"
],
"storm-ui-tcp": [
8080,
8080,
"tcp",
"Storm UI"
],
"web-jmx-tcp": [
1099,
1099,
"tcp",
"JMX"
],
"winrm-http-tcp": [
5985,
5985,
"tcp",
"WinRM HTTP"
],
"winrm-https-tcp": [
5986,
5986,
"tcp",
"WinRM HTTPS"
],
"zipkin-admin-query-tcp": [
9901,
9901,
"tcp",
"Zipkin Admin port query"
],
"zipkin-admin-tcp": [
9990,
9990,
"tcp",
"Zipkin Admin port collector"
],
"zipkin-admin-web-tcp": [
9991,
9991,
"tcp",
"Zipkin Admin port web"
],
"zipkin-query-tcp": [
9411,
9411,
"tcp",
"Zipkin query port"
],
"zipkin-web-tcp": [
8080,
8080,
"tcp",
"Zipkin web port"
],
"zookeeper-2181-tcp": [
2181,
2181,
"tcp",
"Zookeeper"
],
"zookeeper-2888-tcp": [
2888,
2888,
"tcp",
"Zookeeper"
],
"zookeeper-3888-tcp": [
3888,
3888,
"tcp",
"Zookeeper"
],
"zookeeper-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
]
} | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/README.md b/modules/README.md
index ead53e3b..5f4cf93f 100644
--- a/modules/README.md
+++ b/modules/README.md
@@ -39,6 +39,7 @@ List of Security Groups implemented as Terraform modules
* [rdp](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/rdp)
* [redis](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/redis)
* [redshift](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/redshift)
+* [solr](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/solr)
* [splunk](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/splunk)
* [squid](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/squid)
* [ssh](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/ssh)
diff --git a/modules/solr/README.md b/modules/solr/README.md
new file mode 100644
index 00000000..0d8014d6
--- /dev/null
+++ b/modules/solr/README.md
@@ -0,0 +1,110 @@
+# solr - AWS EC2-VPC Security Group Terraform module
+
+## Usage
+
+```hcl
+module "solr_security_group" {
+ source = "terraform-aws-modules/security-group/aws//modules/solr"
+ version = "~> 3.0"
+
+ # omitted...
+}
+```
+
+All automatic values **solr module** is using are available [here](https://github.com/terraform-aws-modules/terraform-aws-security-group/blob/master/modules/solr/auto_values.tf).
+
+
+## Requirements
+
+| Name | Version |
+|------|---------|
+| terraform | >= 0.12.6, < 0.14 |
+| aws | ~> 2.42 |
+
+## Providers
+
+No provider.
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:--------:|
+| auto\_computed\_egress\_rules | List of computed egress rules to add automatically | `list(string)` | `[]` | no |
+| auto\_computed\_egress\_with\_self | List of maps defining computed egress rules with self to add automatically | `list(map(string))` | `[]` | no |
+| auto\_computed\_ingress\_rules | List of ingress rules to add automatically | `list(string)` | `[]` | no |
+| auto\_computed\_ingress\_with\_self | List of maps defining computed ingress rules with self to add automatically | `list(map(string))` | `[]` | no |
+| auto\_egress\_rules | List of egress rules to add automatically | `list(string)` | [| no | +| auto\_egress\_with\_self | List of maps defining egress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_ingress\_rules | List of ingress rules to add automatically | `list(string)` |
"all-all"
]
[| no | +| auto\_ingress\_with\_self | List of maps defining ingress rules with self to add automatically | `list(map(string))` |
"solr-tcp"
]
[| no | +| auto\_number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| computed\_egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed egress rules | `list(string)` |
{
"rule": "all-all"
}
]
[| no | +| computed\_egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed egress rules | `list(string)` |
"0.0.0.0/0"
]
[| no | +| computed\_egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `list(string)` | `[]` | no | +| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no | +| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_self | List of computed egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_source\_security\_group\_id | List of computed egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_rules | List of computed ingress rules to create by name | `list(string)` | `[]` | no | +| computed\_ingress\_with\_cidr\_blocks | List of computed ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_ipv6\_cidr\_blocks | List of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_self | List of computed ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_source\_security\_group\_id | List of computed ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| create | Whether to create security group and all rules | `bool` | `true` | no | +| description | Description of security group | `string` | `"Security Group managed by Terraform"` | no | +| egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all egress rules | `list(string)` |
"::/0"
]
[| no | +| egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all egress rules | `list(string)` |
"0.0.0.0/0"
]
[| no | +| egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules | `list(string)` | `[]` | no | +| egress\_rules | List of egress rules to create by name | `list(string)` | `[]` | no | +| egress\_with\_cidr\_blocks | List of egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_ipv6\_cidr\_blocks | List of egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_self | List of egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| egress\_with\_source\_security\_group\_id | List of egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_rules | List of ingress rules to create by name | `list(string)` | `[]` | no | +| ingress\_with\_cidr\_blocks | List of ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_ipv6\_cidr\_blocks | List of ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_self | List of ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| ingress\_with\_source\_security\_group\_id | List of ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| name | Name of security group | `string` | n/a | yes | +| number\_of\_computed\_egress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_cidr\_blocks | Number of computed egress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_ipv6\_cidr\_blocks | Number of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_source\_security\_group\_id | Number of computed egress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_cidr\_blocks | Number of computed ingress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no | +| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | +| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | +| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| this\_security\_group\_description | The description of the security group | +| this\_security\_group\_id | The ID of the security group | +| this\_security\_group\_name | The name of the security group | +| this\_security\_group\_owner\_id | The owner ID | +| this\_security\_group\_vpc\_id | The VPC ID | + + diff --git a/modules/solr/auto_values.tf b/modules/solr/auto_values.tf new file mode 100644 index 00000000..8968d6c1 --- /dev/null +++ b/modules/solr/auto_values.tf @@ -0,0 +1,79 @@ +# This file was generated from values defined in rules.tf using update_groups.sh. +################################### +# DO NOT CHANGE THIS FILE MANUALLY +################################### + +variable "auto_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = ["solr-tcp"] +} + +variable "auto_ingress_with_self" { + description = "List of maps defining ingress rules with self to add automatically" + type = list(map(string)) + default = [{ "rule" = "all-all" }] +} + +variable "auto_egress_rules" { + description = "List of egress rules to add automatically" + type = list(string) + default = ["all-all"] +} + +variable "auto_egress_with_self" { + description = "List of maps defining egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Computed +variable "auto_computed_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_ingress_with_self" { + description = "List of maps defining computed ingress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +variable "auto_computed_egress_rules" { + description = "List of computed egress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_egress_with_self" { + description = "List of maps defining computed egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Number of computed rules +variable "auto_number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + diff --git a/modules/solr/main.tf b/modules/solr/main.tf new file mode 100644 index 00000000..758bb7bc --- /dev/null +++ b/modules/solr/main.tf @@ -0,0 +1,115 @@ +module "sg" { + source = "../../" + + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + revoke_rules_on_delete = var.revoke_rules_on_delete + tags = var.tags + + ########## + # Ingress + ########## + # Rules by names - open for default CIDR + ingress_rules = sort(compact(distinct(concat(var.auto_ingress_rules, var.ingress_rules, [""])))) + + # Open for self + ingress_with_self = concat(var.auto_ingress_with_self, var.ingress_with_self) + + # Open to IPv4 cidr blocks + ingress_with_cidr_blocks = var.ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + ingress_with_ipv6_cidr_blocks = var.ingress_with_ipv6_cidr_blocks + + # Open for security group id + ingress_with_source_security_group_id = var.ingress_with_source_security_group_id + + # Default ingress CIDR blocks + ingress_cidr_blocks = var.ingress_cidr_blocks + ingress_ipv6_cidr_blocks = var.ingress_ipv6_cidr_blocks + + # Default prefix list ids + ingress_prefix_list_ids = var.ingress_prefix_list_ids + + ################### + # Computed Ingress + ################### + # Rules by names - open for default CIDR + computed_ingress_rules = sort(compact(distinct(concat(var.auto_computed_ingress_rules, var.computed_ingress_rules, [""])))) + + # Open for self + computed_ingress_with_self = concat(var.auto_computed_ingress_with_self, var.computed_ingress_with_self) + + # Open to IPv4 cidr blocks + computed_ingress_with_cidr_blocks = var.computed_ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_ingress_with_ipv6_cidr_blocks = var.computed_ingress_with_ipv6_cidr_blocks + + # Open for security group id + computed_ingress_with_source_security_group_id = var.computed_ingress_with_source_security_group_id + + ############################# + # Number of computed ingress + ############################# + number_of_computed_ingress_rules = var.auto_number_of_computed_ingress_rules + var.number_of_computed_ingress_rules + number_of_computed_ingress_with_self = var.auto_number_of_computed_ingress_with_self + var.number_of_computed_ingress_with_self + number_of_computed_ingress_with_cidr_blocks = var.number_of_computed_ingress_with_cidr_blocks + number_of_computed_ingress_with_ipv6_cidr_blocks = var.number_of_computed_ingress_with_ipv6_cidr_blocks + number_of_computed_ingress_with_source_security_group_id = var.number_of_computed_ingress_with_source_security_group_id + + ######### + # Egress + ######### + # Rules by names - open for default CIDR + egress_rules = sort(compact(distinct(concat(var.auto_egress_rules, var.egress_rules, [""])))) + + # Open for self + egress_with_self = concat(var.auto_egress_with_self, var.egress_with_self) + + # Open to IPv4 cidr blocks + egress_with_cidr_blocks = var.egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + egress_with_ipv6_cidr_blocks = var.egress_with_ipv6_cidr_blocks + + # Open for security group id + egress_with_source_security_group_id = var.egress_with_source_security_group_id + + # Default egress CIDR blocks + egress_cidr_blocks = var.egress_cidr_blocks + egress_ipv6_cidr_blocks = var.egress_ipv6_cidr_blocks + + # Default prefix list ids + egress_prefix_list_ids = var.egress_prefix_list_ids + + ################## + # Computed Egress + ################## + # Rules by names - open for default CIDR + computed_egress_rules = sort(compact(distinct(concat(var.auto_computed_egress_rules, var.computed_egress_rules, [""])))) + + # Open for self + computed_egress_with_self = concat(var.auto_computed_egress_with_self, var.computed_egress_with_self) + + # Open to IPv4 cidr blocks + computed_egress_with_cidr_blocks = var.computed_egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_egress_with_ipv6_cidr_blocks = var.computed_egress_with_ipv6_cidr_blocks + + # Open for security group id + computed_egress_with_source_security_group_id = var.computed_egress_with_source_security_group_id + + ############################# + # Number of computed egress + ############################# + number_of_computed_egress_rules = var.auto_number_of_computed_egress_rules + var.number_of_computed_egress_rules + number_of_computed_egress_with_self = var.auto_number_of_computed_egress_with_self + var.number_of_computed_egress_with_self + number_of_computed_egress_with_cidr_blocks = var.number_of_computed_egress_with_cidr_blocks + number_of_computed_egress_with_ipv6_cidr_blocks = var.number_of_computed_egress_with_ipv6_cidr_blocks + number_of_computed_egress_with_source_security_group_id = var.number_of_computed_egress_with_source_security_group_id +} diff --git a/modules/solr/outputs.tf b/modules/solr/outputs.tf new file mode 100644 index 00000000..3d7ad67f --- /dev/null +++ b/modules/solr/outputs.tf @@ -0,0 +1,24 @@ +output "this_security_group_id" { + description = "The ID of the security group" + value = module.sg.this_security_group_id +} + +output "this_security_group_vpc_id" { + description = "The VPC ID" + value = module.sg.this_security_group_vpc_id +} + +output "this_security_group_owner_id" { + description = "The owner ID" + value = module.sg.this_security_group_owner_id +} + +output "this_security_group_name" { + description = "The name of the security group" + value = module.sg.this_security_group_name +} + +output "this_security_group_description" { + description = "The description of the security group" + value = module.sg.this_security_group_description +} diff --git a/modules/solr/variables.tf b/modules/solr/variables.tf new file mode 100644 index 00000000..4d331561 --- /dev/null +++ b/modules/solr/variables.tf @@ -0,0 +1,348 @@ +################# +# Security group +################# +variable "create" { + description = "Whether to create security group and all rules" + type = bool + default = true +} + +variable "vpc_id" { + description = "ID of the VPC where to create security group" + type = string +} + +variable "name" { + description = "Name of security group" + type = string +} + +variable "use_name_prefix" { + description = "Whether to use name_prefix or fixed name. Should be true to able to update security group name after initial creation" + type = bool + default = true +} + +variable "description" { + description = "Description of security group" + type = string + default = "Security Group managed by Terraform" +} + +variable "revoke_rules_on_delete" { + description = "Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR." + type = bool + default = false +} + +variable "tags" { + description = "A mapping of tags to assign to security group" + type = map(string) + default = {} +} + +########## +# Ingress +########## +variable "ingress_rules" { + description = "List of ingress rules to create by name" + type = list(string) + default = [] +} + +variable "ingress_with_self" { + description = "List of ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "ingress_with_cidr_blocks" { + description = "List of ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_ipv6_cidr_blocks" { + description = "List of ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_source_security_group_id" { + description = "List of ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules" + type = list(string) + default = [] +} + +################### +# Computed Ingress +################### +variable "computed_ingress_rules" { + description = "List of computed ingress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_ingress_with_self" { + description = "List of computed ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_cidr_blocks" { + description = "List of computed ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_ipv6_cidr_blocks" { + description = "List of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_source_security_group_id" { + description = "List of computed ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = list(string) + default = [] +} + +################################### +# Number of computed ingress rules +################################### +variable "number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_cidr_blocks" { + description = "Number of computed ingress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_ipv6_cidr_blocks" { + description = "Number of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_source_security_group_id" { + description = "Number of computed ingress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = number + default = 0 +} + +######### +# Egress +######### +variable "egress_rules" { + description = "List of egress rules to create by name" + type = list(string) + default = [] +} + +variable "egress_with_self" { + description = "List of egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "egress_with_cidr_blocks" { + description = "List of egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_ipv6_cidr_blocks" { + description = "List of egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_source_security_group_id" { + description = "List of egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all egress rules" + type = list(string) + default = ["::/0"] +} + +variable "egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules" + type = list(string) + default = [] +} + +################## +# Computed Egress +################## +variable "computed_egress_rules" { + description = "List of computed egress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_egress_with_self" { + description = "List of computed egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_cidr_blocks" { + description = "List of computed egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_ipv6_cidr_blocks" { + description = "List of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_source_security_group_id" { + description = "List of computed egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "computed_egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["::/0"] +} + +variable "computed_egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = list(string) + default = [] +} + +################################## +# Number of computed egress rules +################################## +variable "number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_cidr_blocks" { + description = "Number of computed egress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_ipv6_cidr_blocks" { + description = "Number of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_source_security_group_id" { + description = "Number of computed egress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = number + default = 0 +} diff --git a/modules/solr/versions.tf b/modules/solr/versions.tf new file mode 100644 index 00000000..41f2989f --- /dev/null +++ b/modules/solr/versions.tf @@ -0,0 +1,7 @@ +terraform { + required_version = ">= 0.12.6, < 0.14" + + required_providers { + aws = "~> 2.42" + } +} diff --git a/rules.tf b/rules.tf index 76ba6d62..33b522f4 100644 --- a/rules.tf +++ b/rules.tf @@ -129,6 +129,8 @@ variable "rules" { redis-tcp = [6379, 6379, "tcp", "Redis"] # Redshift redshift-tcp = [5439, 5439, "tcp", "Redshift"] + # Solr + solr-tcp = [8983, 8987, "tcp", "Solr"] # Splunk splunk-indexer-tcp = [9997, 9997, "tcp", "Splunk indexer"] splunk-web-tcp = [8000, 8000, "tcp", "Splunk Web"] @@ -360,6 +362,11 @@ variable "auto_groups" { ingress_with_self = ["all-all"] egress_rules = ["all-all"] } + solr = { + ingress_rules = ["solr-tcp"] + ingress_with_self = ["all-all"] + egress_rules = ["all-all"] + } splunk = { ingress_rules = ["splunk-indexer-tcp", "splunk-clients-tcp", "splunk-splunkd-tcp", "splunk-hec-tcp"] ingress_with_self = ["all-all"] From 9f082c149bc116a02170f060f70f88297a77b80d Mon Sep 17 00:00:00 2001 From: Anton Babenko
"::/0"
]
{
"activemq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"activemq-5671-tcp",
"activemq-8883-tcp",
"activemq-61614-tcp",
"activemq-61617-tcp",
"activemq-61619-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"alertmanager": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"alertmanager-9093-tcp",
"alertmanager-9094-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"carbon-relay-ng": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"carbon-line-in-tcp",
"carbon-line-in-udp",
"carbon-pickle-tcp",
"carbon-pickle-udp",
"carbon-gui-udp"
],
"ingress_with_self": [
"all-all"
]
},
"cassandra": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"cassandra-clients-tcp",
"cassandra-thrift-clients-tcp",
"cassandra-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"consul": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"consul-tcp",
"consul-cli-rpc-tcp",
"consul-webui-tcp",
"consul-dns-tcp",
"consul-dns-udp",
"consul-serf-lan-tcp",
"consul-serf-lan-udp",
"consul-serf-wan-tcp",
"consul-serf-wan-udp"
],
"ingress_with_self": [
"all-all"
]
},
"docker-swarm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"docker-swarm-mngmt-tcp",
"docker-swarm-node-tcp",
"docker-swarm-node-udp",
"docker-swarm-overlay-udp"
],
"ingress_with_self": [
"all-all"
]
},
"elasticsearch": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"elasticsearch-rest-tcp",
"elasticsearch-java-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"grafana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"grafana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"graphite-statsd": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"graphite-webui",
"graphite-2003-tcp",
"graphite-2004-tcp",
"graphite-2023-tcp",
"graphite-2024-tcp",
"graphite-8080-tcp",
"graphite-8125-tcp",
"graphite-8125-udp",
"graphite-8126-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-80": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-8080": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-8080-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-8443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-8443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-4500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-4500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"kafka": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kafka-broker-tcp",
"kafka-broker-tls-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kibana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kibana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kubernetes-api": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kubernetes-api-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ldaps": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ldaps-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"logstash": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"logstash-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"memcached": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"memcached-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"minio": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"minio-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mongodb": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mongodb-27017-tcp",
"mongodb-27018-tcp",
"mongodb-27019-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mssql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mssql-tcp",
"mssql-udp",
"mssql-analytics-tcp",
"mssql-broker-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mysql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mysql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nfs": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nfs-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nomad": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nomad-http-tcp",
"nomad-rpc-tcp",
"nomad-serf-tcp",
"nomad-serf-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ntp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ntp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"openvpn": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"openvpn-udp",
"openvpn-tcp",
"openvpn-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"oracle-db": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"oracle-db-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"postgresql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"postgresql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"prometheus": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"prometheus-http-tcp",
"prometheus-pushgateway-http-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"puppet": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"puppet-tcp",
"puppetdb-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rabbitmq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rabbitmq-4369-tcp",
"rabbitmq-5671-tcp",
"rabbitmq-5672-tcp",
"rabbitmq-15672-tcp",
"rabbitmq-25672-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rdp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rdp-tcp",
"rdp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"redis": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redis-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"redshift": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redshift-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"solr": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"solr-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"splunk": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"splunk-indexer-tcp",
"splunk-clients-tcp",
"splunk-splunkd-tcp",
"splunk-hec-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"squid": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"squid-proxy-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ssh": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ssh-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"storm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"storm-nimbus-tcp",
"storm-ui-tcp",
"storm-supervisor-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"web": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp",
"http-8080-tcp",
"https-443-tcp",
"web-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"winrm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"winrm-http-tcp",
"winrm-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zipkin": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zipkin-admin-tcp",
"zipkin-admin-query-tcp",
"zipkin-admin-web-tcp",
"zipkin-query-tcp",
"zipkin-web-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zookeeper": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zookeeper-2181-tcp",
"zookeeper-2888-tcp",
"zookeeper-3888-tcp",
"zookeeper-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
}
} | no |
+| auto\_groups | Map of groups of security group rules to use to generate modules (see update\_groups.sh) | `map(map(list(string)))` | {
"activemq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"activemq-5671-tcp",
"activemq-8883-tcp",
"activemq-61614-tcp",
"activemq-61617-tcp",
"activemq-61619-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"alertmanager": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"alertmanager-9093-tcp",
"alertmanager-9094-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"carbon-relay-ng": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"carbon-line-in-tcp",
"carbon-line-in-udp",
"carbon-pickle-tcp",
"carbon-pickle-udp",
"carbon-gui-udp"
],
"ingress_with_self": [
"all-all"
]
},
"cassandra": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"cassandra-clients-tcp",
"cassandra-thrift-clients-tcp",
"cassandra-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"consul": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"consul-tcp",
"consul-cli-rpc-tcp",
"consul-webui-tcp",
"consul-dns-tcp",
"consul-dns-udp",
"consul-serf-lan-tcp",
"consul-serf-lan-udp",
"consul-serf-wan-tcp",
"consul-serf-wan-udp"
],
"ingress_with_self": [
"all-all"
]
},
"docker-swarm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"docker-swarm-mngmt-tcp",
"docker-swarm-node-tcp",
"docker-swarm-node-udp",
"docker-swarm-overlay-udp"
],
"ingress_with_self": [
"all-all"
]
},
"elasticsearch": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"elasticsearch-rest-tcp",
"elasticsearch-java-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"grafana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"grafana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"graphite-statsd": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"graphite-webui",
"graphite-2003-tcp",
"graphite-2004-tcp",
"graphite-2023-tcp",
"graphite-2024-tcp",
"graphite-8080-tcp",
"graphite-8125-tcp",
"graphite-8125-udp",
"graphite-8126-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-80": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"http-8080": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-8080-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"https-8443": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"https-8443-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-4500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-4500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ipsec-500": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ipsec-500-udp"
],
"ingress_with_self": [
"all-all"
]
},
"kafka": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kafka-broker-tcp",
"kafka-broker-tls-tcp",
"kafka-jmx-exporter-tcp",
"kafka-node-exporter-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kibana": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kibana-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"kubernetes-api": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"kubernetes-api-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ldaps": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ldaps-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"logstash": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"logstash-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"memcached": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"memcached-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"minio": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"minio-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mongodb": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mongodb-27017-tcp",
"mongodb-27018-tcp",
"mongodb-27019-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mssql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mssql-tcp",
"mssql-udp",
"mssql-analytics-tcp",
"mssql-broker-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"mysql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"mysql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nfs": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nfs-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"nomad": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"nomad-http-tcp",
"nomad-rpc-tcp",
"nomad-serf-tcp",
"nomad-serf-udp"
],
"ingress_with_self": [
"all-all"
]
},
"ntp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ntp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"openvpn": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"openvpn-udp",
"openvpn-tcp",
"openvpn-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"oracle-db": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"oracle-db-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"postgresql": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"postgresql-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"prometheus": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"prometheus-http-tcp",
"prometheus-pushgateway-http-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"puppet": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"puppet-tcp",
"puppetdb-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rabbitmq": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rabbitmq-4369-tcp",
"rabbitmq-5671-tcp",
"rabbitmq-5672-tcp",
"rabbitmq-15672-tcp",
"rabbitmq-25672-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"rdp": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"rdp-tcp",
"rdp-udp"
],
"ingress_with_self": [
"all-all"
]
},
"redis": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redis-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"redshift": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"redshift-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"solr": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"solr-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"splunk": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"splunk-indexer-tcp",
"splunk-clients-tcp",
"splunk-splunkd-tcp",
"splunk-hec-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"squid": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"squid-proxy-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"ssh": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"ssh-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"storm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"storm-nimbus-tcp",
"storm-ui-tcp",
"storm-supervisor-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"web": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"http-80-tcp",
"http-8080-tcp",
"https-443-tcp",
"web-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"winrm": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"winrm-http-tcp",
"winrm-https-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zipkin": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zipkin-admin-tcp",
"zipkin-admin-query-tcp",
"zipkin-admin-web-tcp",
"zipkin-query-tcp",
"zipkin-web-tcp"
],
"ingress_with_self": [
"all-all"
]
},
"zookeeper": {
"egress_rules": [
"all-all"
],
"ingress_rules": [
"zookeeper-2181-tcp",
"zookeeper-2888-tcp",
"zookeeper-3888-tcp",
"zookeeper-jmx-tcp"
],
"ingress_with_self": [
"all-all"
]
}
} | no |
| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no |
| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no |
| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no |
@@ -215,7 +215,7 @@ No issue is creating limit on this module.
| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no |
| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no |
| revoke\_rules\_on\_delete | Instruct Terraform to revoke all of the Security Groups attached ingress and egress rules before deleting the rule itself. Enable for EMR. | `bool` | `false` | no |
-| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | {
"_": [
"",
"",
""
],
"activemq-5671-tcp": [
5671,
5671,
"tcp",
"ActiveMQ AMQP"
],
"activemq-61614-tcp": [
61614,
61614,
"tcp",
"ActiveMQ STOMP"
],
"activemq-61617-tcp": [
61617,
61617,
"tcp",
"ActiveMQ OpenWire"
],
"activemq-61619-tcp": [
61619,
61619,
"tcp",
"ActiveMQ WebSocket"
],
"activemq-8883-tcp": [
8883,
8883,
"tcp",
"ActiveMQ MQTT"
],
"alertmanager-9093-tcp": [
9093,
9093,
"tcp",
"Alert Manager"
],
"alertmanager-9094-tcp": [
9094,
9094,
"tcp",
"Alert Manager Cluster"
],
"all-all": [
-1,
-1,
"-1",
"All protocols"
],
"all-icmp": [
-1,
-1,
"icmp",
"All IPV4 ICMP"
],
"all-ipv6-icmp": [
-1,
-1,
58,
"All IPV6 ICMP"
],
"all-tcp": [
0,
65535,
"tcp",
"All TCP ports"
],
"all-udp": [
0,
65535,
"udp",
"All UDP ports"
],
"carbon-admin-tcp": [
2004,
2004,
"tcp",
"Carbon admin"
],
"carbon-gui-udp": [
8081,
8081,
"tcp",
"Carbon GUI"
],
"carbon-line-in-tcp": [
2003,
2003,
"tcp",
"Carbon line-in"
],
"carbon-line-in-udp": [
2003,
2003,
"udp",
"Carbon line-in"
],
"carbon-pickle-tcp": [
2013,
2013,
"tcp",
"Carbon pickle"
],
"carbon-pickle-udp": [
2013,
2013,
"udp",
"Carbon pickle"
],
"cassandra-clients-tcp": [
9042,
9042,
"tcp",
"Cassandra clients"
],
"cassandra-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
],
"cassandra-thrift-clients-tcp": [
9160,
9160,
"tcp",
"Cassandra Thrift clients"
],
"consul-cli-rpc-tcp": [
8400,
8400,
"tcp",
"Consul CLI RPC"
],
"consul-dns-tcp": [
8600,
8600,
"tcp",
"Consul DNS"
],
"consul-dns-udp": [
8600,
8600,
"udp",
"Consul DNS"
],
"consul-serf-lan-tcp": [
8301,
8301,
"tcp",
"Serf LAN"
],
"consul-serf-lan-udp": [
8301,
8301,
"udp",
"Serf LAN"
],
"consul-serf-wan-tcp": [
8302,
8302,
"tcp",
"Serf WAN"
],
"consul-serf-wan-udp": [
8302,
8302,
"udp",
"Serf WAN"
],
"consul-tcp": [
8300,
8300,
"tcp",
"Consul server"
],
"consul-webui-tcp": [
8500,
8500,
"tcp",
"Consul web UI"
],
"dns-tcp": [
53,
53,
"tcp",
"DNS"
],
"dns-udp": [
53,
53,
"udp",
"DNS"
],
"docker-swarm-mngmt-tcp": [
2377,
2377,
"tcp",
"Docker Swarm cluster management"
],
"docker-swarm-node-tcp": [
7946,
7946,
"tcp",
"Docker Swarm node"
],
"docker-swarm-node-udp": [
7946,
7946,
"udp",
"Docker Swarm node"
],
"docker-swarm-overlay-udp": [
4789,
4789,
"udp",
"Docker Swarm Overlay Network Traffic"
],
"elasticsearch-java-tcp": [
9300,
9300,
"tcp",
"Elasticsearch Java interface"
],
"elasticsearch-rest-tcp": [
9200,
9200,
"tcp",
"Elasticsearch REST interface"
],
"grafana-tcp": [
3000,
3000,
"tcp",
"Grafana Dashboard"
],
"graphite-2003-tcp": [
2003,
2003,
"tcp",
"Carbon receiver plain text"
],
"graphite-2004-tcp": [
2004,
2004,
"tcp",
"Carbon receiver pickle"
],
"graphite-2023-tcp": [
2023,
2023,
"tcp",
"Carbon aggregator plaintext"
],
"graphite-2024-tcp": [
2024,
2024,
"tcp",
"Carbon aggregator pickle"
],
"graphite-8080-tcp": [
8080,
8080,
"tcp",
"Graphite gunicorn port"
],
"graphite-8125-tcp": [
8125,
8125,
"tcp",
"Statsd TCP"
],
"graphite-8125-udp": [
8125,
8125,
"udp",
"Statsd UDP default"
],
"graphite-8126-tcp": [
8126,
8126,
"tcp",
"Statsd admin"
],
"graphite-webui": [
80,
80,
"tcp",
"Graphite admin interface"
],
"http-80-tcp": [
80,
80,
"tcp",
"HTTP"
],
"http-8080-tcp": [
8080,
8080,
"tcp",
"HTTP"
],
"https-443-tcp": [
443,
443,
"tcp",
"HTTPS"
],
"https-8443-tcp": [
8443,
8443,
"tcp",
"HTTPS"
],
"ipsec-4500-udp": [
4500,
4500,
"udp",
"IPSEC NAT-T"
],
"ipsec-500-udp": [
500,
500,
"udp",
"IPSEC ISAKMP"
],
"kafka-broker-tcp": [
9092,
9092,
"tcp",
"Kafka broker 0.8.2+"
],
"kafka-broker-tls-tcp": [
9094,
9094,
"tcp",
"Kafka TLS enabled broker 0.8.2+"
],
"kibana-tcp": [
5601,
5601,
"tcp",
"Kibana Web Interface"
],
"kubernetes-api-tcp": [
6443,
6443,
"tcp",
"Kubernetes API Server"
],
"ldaps-tcp": [
636,
636,
"tcp",
"LDAPS"
],
"logstash-tcp": [
5044,
5044,
"tcp",
"Logstash"
],
"memcached-tcp": [
11211,
11211,
"tcp",
"Memcached"
],
"minio-tcp": [
9000,
9000,
"tcp",
"MinIO"
],
"mongodb-27017-tcp": [
27017,
27017,
"tcp",
"MongoDB"
],
"mongodb-27018-tcp": [
27018,
27018,
"tcp",
"MongoDB shard"
],
"mongodb-27019-tcp": [
27019,
27019,
"tcp",
"MongoDB config server"
],
"mssql-analytics-tcp": [
2383,
2383,
"tcp",
"MSSQL Analytics"
],
"mssql-broker-tcp": [
4022,
4022,
"tcp",
"MSSQL Broker"
],
"mssql-tcp": [
1433,
1433,
"tcp",
"MSSQL Server"
],
"mssql-udp": [
1434,
1434,
"udp",
"MSSQL Browser"
],
"mysql-tcp": [
3306,
3306,
"tcp",
"MySQL/Aurora"
],
"nfs-tcp": [
2049,
2049,
"tcp",
"NFS/EFS"
],
"nomad-http-tcp": [
4646,
4646,
"tcp",
"Nomad HTTP"
],
"nomad-rpc-tcp": [
4647,
4647,
"tcp",
"Nomad RPC"
],
"nomad-serf-tcp": [
4648,
4648,
"tcp",
"Serf"
],
"nomad-serf-udp": [
4648,
4648,
"udp",
"Serf"
],
"ntp-udp": [
123,
123,
"udp",
"NTP"
],
"openvpn-https-tcp": [
443,
443,
"tcp",
"OpenVPN"
],
"openvpn-tcp": [
943,
943,
"tcp",
"OpenVPN"
],
"openvpn-udp": [
1194,
1194,
"udp",
"OpenVPN"
],
"oracle-db-tcp": [
1521,
1521,
"tcp",
"Oracle"
],
"postgresql-tcp": [
5432,
5432,
"tcp",
"PostgreSQL"
],
"prometheus-http-tcp": [
9090,
9090,
"tcp",
"Prometheus"
],
"prometheus-pushgateway-http-tcp": [
9091,
9091,
"tcp",
"Prometheus Pushgateway"
],
"puppet-tcp": [
8140,
8140,
"tcp",
"Puppet"
],
"puppetdb-tcp": [
8081,
8081,
"tcp",
"PuppetDB"
],
"rabbitmq-15672-tcp": [
15672,
15672,
"tcp",
"RabbitMQ"
],
"rabbitmq-25672-tcp": [
25672,
25672,
"tcp",
"RabbitMQ"
],
"rabbitmq-4369-tcp": [
4369,
4369,
"tcp",
"RabbitMQ epmd"
],
"rabbitmq-5671-tcp": [
5671,
5671,
"tcp",
"RabbitMQ"
],
"rabbitmq-5672-tcp": [
5672,
5672,
"tcp",
"RabbitMQ"
],
"rdp-tcp": [
3389,
3389,
"tcp",
"Remote Desktop"
],
"rdp-udp": [
3389,
3389,
"udp",
"Remote Desktop"
],
"redis-tcp": [
6379,
6379,
"tcp",
"Redis"
],
"redshift-tcp": [
5439,
5439,
"tcp",
"Redshift"
],
"solr-tcp": [
8983,
8987,
"tcp",
"Solr"
],
"splunk-hec-tcp": [
8088,
8088,
"tcp",
"Splunk HEC"
],
"splunk-indexer-tcp": [
9997,
9997,
"tcp",
"Splunk indexer"
],
"splunk-splunkd-tcp": [
8089,
8089,
"tcp",
"Splunkd"
],
"splunk-web-tcp": [
8000,
8000,
"tcp",
"Splunk Web"
],
"squid-proxy-tcp": [
3128,
3128,
"tcp",
"Squid default proxy"
],
"ssh-tcp": [
22,
22,
"tcp",
"SSH"
],
"storm-nimbus-tcp": [
6627,
6627,
"tcp",
"Nimbus"
],
"storm-supervisor-tcp": [
6700,
6703,
"tcp",
"Supervisor"
],
"storm-ui-tcp": [
8080,
8080,
"tcp",
"Storm UI"
],
"web-jmx-tcp": [
1099,
1099,
"tcp",
"JMX"
],
"winrm-http-tcp": [
5985,
5985,
"tcp",
"WinRM HTTP"
],
"winrm-https-tcp": [
5986,
5986,
"tcp",
"WinRM HTTPS"
],
"zipkin-admin-query-tcp": [
9901,
9901,
"tcp",
"Zipkin Admin port query"
],
"zipkin-admin-tcp": [
9990,
9990,
"tcp",
"Zipkin Admin port collector"
],
"zipkin-admin-web-tcp": [
9991,
9991,
"tcp",
"Zipkin Admin port web"
],
"zipkin-query-tcp": [
9411,
9411,
"tcp",
"Zipkin query port"
],
"zipkin-web-tcp": [
8080,
8080,
"tcp",
"Zipkin web port"
],
"zookeeper-2181-tcp": [
2181,
2181,
"tcp",
"Zookeeper"
],
"zookeeper-2888-tcp": [
2888,
2888,
"tcp",
"Zookeeper"
],
"zookeeper-3888-tcp": [
3888,
3888,
"tcp",
"Zookeeper"
],
"zookeeper-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
]
} | no |
+| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | {
"_": [
"",
"",
""
],
"activemq-5671-tcp": [
5671,
5671,
"tcp",
"ActiveMQ AMQP"
],
"activemq-61614-tcp": [
61614,
61614,
"tcp",
"ActiveMQ STOMP"
],
"activemq-61617-tcp": [
61617,
61617,
"tcp",
"ActiveMQ OpenWire"
],
"activemq-61619-tcp": [
61619,
61619,
"tcp",
"ActiveMQ WebSocket"
],
"activemq-8883-tcp": [
8883,
8883,
"tcp",
"ActiveMQ MQTT"
],
"alertmanager-9093-tcp": [
9093,
9093,
"tcp",
"Alert Manager"
],
"alertmanager-9094-tcp": [
9094,
9094,
"tcp",
"Alert Manager Cluster"
],
"all-all": [
-1,
-1,
"-1",
"All protocols"
],
"all-icmp": [
-1,
-1,
"icmp",
"All IPV4 ICMP"
],
"all-ipv6-icmp": [
-1,
-1,
58,
"All IPV6 ICMP"
],
"all-tcp": [
0,
65535,
"tcp",
"All TCP ports"
],
"all-udp": [
0,
65535,
"udp",
"All UDP ports"
],
"carbon-admin-tcp": [
2004,
2004,
"tcp",
"Carbon admin"
],
"carbon-gui-udp": [
8081,
8081,
"tcp",
"Carbon GUI"
],
"carbon-line-in-tcp": [
2003,
2003,
"tcp",
"Carbon line-in"
],
"carbon-line-in-udp": [
2003,
2003,
"udp",
"Carbon line-in"
],
"carbon-pickle-tcp": [
2013,
2013,
"tcp",
"Carbon pickle"
],
"carbon-pickle-udp": [
2013,
2013,
"udp",
"Carbon pickle"
],
"cassandra-clients-tcp": [
9042,
9042,
"tcp",
"Cassandra clients"
],
"cassandra-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
],
"cassandra-thrift-clients-tcp": [
9160,
9160,
"tcp",
"Cassandra Thrift clients"
],
"consul-cli-rpc-tcp": [
8400,
8400,
"tcp",
"Consul CLI RPC"
],
"consul-dns-tcp": [
8600,
8600,
"tcp",
"Consul DNS"
],
"consul-dns-udp": [
8600,
8600,
"udp",
"Consul DNS"
],
"consul-serf-lan-tcp": [
8301,
8301,
"tcp",
"Serf LAN"
],
"consul-serf-lan-udp": [
8301,
8301,
"udp",
"Serf LAN"
],
"consul-serf-wan-tcp": [
8302,
8302,
"tcp",
"Serf WAN"
],
"consul-serf-wan-udp": [
8302,
8302,
"udp",
"Serf WAN"
],
"consul-tcp": [
8300,
8300,
"tcp",
"Consul server"
],
"consul-webui-tcp": [
8500,
8500,
"tcp",
"Consul web UI"
],
"dns-tcp": [
53,
53,
"tcp",
"DNS"
],
"dns-udp": [
53,
53,
"udp",
"DNS"
],
"docker-swarm-mngmt-tcp": [
2377,
2377,
"tcp",
"Docker Swarm cluster management"
],
"docker-swarm-node-tcp": [
7946,
7946,
"tcp",
"Docker Swarm node"
],
"docker-swarm-node-udp": [
7946,
7946,
"udp",
"Docker Swarm node"
],
"docker-swarm-overlay-udp": [
4789,
4789,
"udp",
"Docker Swarm Overlay Network Traffic"
],
"elasticsearch-java-tcp": [
9300,
9300,
"tcp",
"Elasticsearch Java interface"
],
"elasticsearch-rest-tcp": [
9200,
9200,
"tcp",
"Elasticsearch REST interface"
],
"grafana-tcp": [
3000,
3000,
"tcp",
"Grafana Dashboard"
],
"graphite-2003-tcp": [
2003,
2003,
"tcp",
"Carbon receiver plain text"
],
"graphite-2004-tcp": [
2004,
2004,
"tcp",
"Carbon receiver pickle"
],
"graphite-2023-tcp": [
2023,
2023,
"tcp",
"Carbon aggregator plaintext"
],
"graphite-2024-tcp": [
2024,
2024,
"tcp",
"Carbon aggregator pickle"
],
"graphite-8080-tcp": [
8080,
8080,
"tcp",
"Graphite gunicorn port"
],
"graphite-8125-tcp": [
8125,
8125,
"tcp",
"Statsd TCP"
],
"graphite-8125-udp": [
8125,
8125,
"udp",
"Statsd UDP default"
],
"graphite-8126-tcp": [
8126,
8126,
"tcp",
"Statsd admin"
],
"graphite-webui": [
80,
80,
"tcp",
"Graphite admin interface"
],
"http-80-tcp": [
80,
80,
"tcp",
"HTTP"
],
"http-8080-tcp": [
8080,
8080,
"tcp",
"HTTP"
],
"https-443-tcp": [
443,
443,
"tcp",
"HTTPS"
],
"https-8443-tcp": [
8443,
8443,
"tcp",
"HTTPS"
],
"ipsec-4500-udp": [
4500,
4500,
"udp",
"IPSEC NAT-T"
],
"ipsec-500-udp": [
500,
500,
"udp",
"IPSEC ISAKMP"
],
"kafka-broker-tcp": [
9092,
9092,
"tcp",
"Kafka broker 0.8.2+"
],
"kafka-broker-tls-tcp": [
9094,
9094,
"tcp",
"Kafka TLS enabled broker 0.8.2+"
],
"kafka-jmx-exporter-tcp": [
11001,
11001,
"tcp",
"Kafka JMX Exporter"
],
"kafka-node-exporter-tcp": [
11002,
11002,
"tcp",
"Kafka Node Exporter"
],
"kibana-tcp": [
5601,
5601,
"tcp",
"Kibana Web Interface"
],
"kubernetes-api-tcp": [
6443,
6443,
"tcp",
"Kubernetes API Server"
],
"ldaps-tcp": [
636,
636,
"tcp",
"LDAPS"
],
"logstash-tcp": [
5044,
5044,
"tcp",
"Logstash"
],
"memcached-tcp": [
11211,
11211,
"tcp",
"Memcached"
],
"minio-tcp": [
9000,
9000,
"tcp",
"MinIO"
],
"mongodb-27017-tcp": [
27017,
27017,
"tcp",
"MongoDB"
],
"mongodb-27018-tcp": [
27018,
27018,
"tcp",
"MongoDB shard"
],
"mongodb-27019-tcp": [
27019,
27019,
"tcp",
"MongoDB config server"
],
"mssql-analytics-tcp": [
2383,
2383,
"tcp",
"MSSQL Analytics"
],
"mssql-broker-tcp": [
4022,
4022,
"tcp",
"MSSQL Broker"
],
"mssql-tcp": [
1433,
1433,
"tcp",
"MSSQL Server"
],
"mssql-udp": [
1434,
1434,
"udp",
"MSSQL Browser"
],
"mysql-tcp": [
3306,
3306,
"tcp",
"MySQL/Aurora"
],
"nfs-tcp": [
2049,
2049,
"tcp",
"NFS/EFS"
],
"nomad-http-tcp": [
4646,
4646,
"tcp",
"Nomad HTTP"
],
"nomad-rpc-tcp": [
4647,
4647,
"tcp",
"Nomad RPC"
],
"nomad-serf-tcp": [
4648,
4648,
"tcp",
"Serf"
],
"nomad-serf-udp": [
4648,
4648,
"udp",
"Serf"
],
"ntp-udp": [
123,
123,
"udp",
"NTP"
],
"openvpn-https-tcp": [
443,
443,
"tcp",
"OpenVPN"
],
"openvpn-tcp": [
943,
943,
"tcp",
"OpenVPN"
],
"openvpn-udp": [
1194,
1194,
"udp",
"OpenVPN"
],
"oracle-db-tcp": [
1521,
1521,
"tcp",
"Oracle"
],
"postgresql-tcp": [
5432,
5432,
"tcp",
"PostgreSQL"
],
"prometheus-http-tcp": [
9090,
9090,
"tcp",
"Prometheus"
],
"prometheus-pushgateway-http-tcp": [
9091,
9091,
"tcp",
"Prometheus Pushgateway"
],
"puppet-tcp": [
8140,
8140,
"tcp",
"Puppet"
],
"puppetdb-tcp": [
8081,
8081,
"tcp",
"PuppetDB"
],
"rabbitmq-15672-tcp": [
15672,
15672,
"tcp",
"RabbitMQ"
],
"rabbitmq-25672-tcp": [
25672,
25672,
"tcp",
"RabbitMQ"
],
"rabbitmq-4369-tcp": [
4369,
4369,
"tcp",
"RabbitMQ epmd"
],
"rabbitmq-5671-tcp": [
5671,
5671,
"tcp",
"RabbitMQ"
],
"rabbitmq-5672-tcp": [
5672,
5672,
"tcp",
"RabbitMQ"
],
"rdp-tcp": [
3389,
3389,
"tcp",
"Remote Desktop"
],
"rdp-udp": [
3389,
3389,
"udp",
"Remote Desktop"
],
"redis-tcp": [
6379,
6379,
"tcp",
"Redis"
],
"redshift-tcp": [
5439,
5439,
"tcp",
"Redshift"
],
"solr-tcp": [
8983,
8987,
"tcp",
"Solr"
],
"splunk-hec-tcp": [
8088,
8088,
"tcp",
"Splunk HEC"
],
"splunk-indexer-tcp": [
9997,
9997,
"tcp",
"Splunk indexer"
],
"splunk-splunkd-tcp": [
8089,
8089,
"tcp",
"Splunkd"
],
"splunk-web-tcp": [
8000,
8000,
"tcp",
"Splunk Web"
],
"squid-proxy-tcp": [
3128,
3128,
"tcp",
"Squid default proxy"
],
"ssh-tcp": [
22,
22,
"tcp",
"SSH"
],
"storm-nimbus-tcp": [
6627,
6627,
"tcp",
"Nimbus"
],
"storm-supervisor-tcp": [
6700,
6703,
"tcp",
"Supervisor"
],
"storm-ui-tcp": [
8080,
8080,
"tcp",
"Storm UI"
],
"web-jmx-tcp": [
1099,
1099,
"tcp",
"JMX"
],
"winrm-http-tcp": [
5985,
5985,
"tcp",
"WinRM HTTP"
],
"winrm-https-tcp": [
5986,
5986,
"tcp",
"WinRM HTTPS"
],
"zipkin-admin-query-tcp": [
9901,
9901,
"tcp",
"Zipkin Admin port query"
],
"zipkin-admin-tcp": [
9990,
9990,
"tcp",
"Zipkin Admin port collector"
],
"zipkin-admin-web-tcp": [
9991,
9991,
"tcp",
"Zipkin Admin port web"
],
"zipkin-query-tcp": [
9411,
9411,
"tcp",
"Zipkin query port"
],
"zipkin-web-tcp": [
8080,
8080,
"tcp",
"Zipkin web port"
],
"zookeeper-2181-tcp": [
2181,
2181,
"tcp",
"Zookeeper"
],
"zookeeper-2888-tcp": [
2888,
2888,
"tcp",
"Zookeeper"
],
"zookeeper-3888-tcp": [
3888,
3888,
"tcp",
"Zookeeper"
],
"zookeeper-jmx-tcp": [
7199,
7199,
"tcp",
"JMX"
]
} | no |
| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no |
| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no |
| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes |
diff --git a/modules/kafka/README.md b/modules/kafka/README.md
index d3ecf278..4ed8c71f 100644
--- a/modules/kafka/README.md
+++ b/modules/kafka/README.md
@@ -35,7 +35,7 @@ No provider.
| auto\_computed\_ingress\_with\_self | List of maps defining computed ingress rules with self to add automatically | `list(map(string))` | `[]` | no |
| auto\_egress\_rules | List of egress rules to add automatically | `list(string)` | [| no | | auto\_egress\_with\_self | List of maps defining egress rules with self to add automatically | `list(map(string))` | `[]` | no | -| auto\_ingress\_rules | List of ingress rules to add automatically | `list(string)` |
"all-all"
]
[| no | +| auto\_ingress\_rules | List of ingress rules to add automatically | `list(string)` |
"kafka-broker-tcp",
"kafka-broker-tls-tcp"
]
[| no | | auto\_ingress\_with\_self | List of maps defining ingress rules with self to add automatically | `list(map(string))` |
"kafka-broker-tcp",
"kafka-broker-tls-tcp",
"kafka-jmx-exporter-tcp",
"kafka-node-exporter-tcp"
]
[| no | | auto\_number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | | auto\_number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | diff --git a/modules/kafka/auto_values.tf b/modules/kafka/auto_values.tf index 39233530..da2b7953 100644 --- a/modules/kafka/auto_values.tf +++ b/modules/kafka/auto_values.tf @@ -6,7 +6,7 @@ variable "auto_ingress_rules" { description = "List of ingress rules to add automatically" type = list(string) - default = ["kafka-broker-tcp", "kafka-broker-tls-tcp"] + default = ["kafka-broker-tcp", "kafka-broker-tls-tcp", "kafka-jmx-exporter-tcp", "kafka-node-exporter-tcp"] } variable "auto_ingress_with_self" { diff --git a/rules.tf b/rules.tf index 33b522f4..8c1fc3ff 100644 --- a/rules.tf +++ b/rules.tf @@ -70,8 +70,10 @@ variable "rules" { ipsec-500-udp = [500, 500, "udp", "IPSEC ISAKMP"] ipsec-4500-udp = [4500, 4500, "udp", "IPSEC NAT-T"] # Kafka - kafka-broker-tcp = [9092, 9092, "tcp", "Kafka broker 0.8.2+"] - kafka-broker-tls-tcp = [9094, 9094, "tcp", "Kafka TLS enabled broker 0.8.2+"] + kafka-broker-tcp = [9092, 9092, "tcp", "Kafka broker 0.8.2+"] + kafka-broker-tls-tcp = [9094, 9094, "tcp", "Kafka TLS enabled broker 0.8.2+"] + kafka-jmx-exporter-tcp = [11001, 11001, "tcp", "Kafka JMX Exporter"] + kafka-node-exporter-tcp = [11002, 11002, "tcp", "Kafka Node Exporter"] # Kibana kibana-tcp = [5601, 5601, "tcp", "Kibana Web Interface"] # Kubernetes @@ -253,7 +255,7 @@ variable "auto_groups" { egress_rules = ["all-all"] } kafka = { - ingress_rules = ["kafka-broker-tcp", "kafka-broker-tls-tcp"] + ingress_rules = ["kafka-broker-tcp", "kafka-broker-tls-tcp", "kafka-jmx-exporter-tcp", "kafka-node-exporter-tcp"] ingress_with_self = ["all-all"] egress_rules = ["all-all"] } From 743e57b62ffd01fc7fc97b4a5d1fd91fdd8a4f8c Mon Sep 17 00:00:00 2001 From: Anton Babenko
{
"rule": "all-all"
}
]