From fddec65faf9bd084e5bc170decdd39590013757e Mon Sep 17 00:00:00 2001 From: Satyajit Roy Date: Sun, 10 May 2020 22:05:56 -0700 Subject: [PATCH 1/2] Adding support for prometheus and alertmanager the right way --- rules.tf | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/rules.tf b/rules.tf index db65035c..77674bc3 100644 --- a/rules.tf +++ b/rules.tf @@ -11,6 +11,9 @@ variable "rules" { activemq-61614-tcp = [61614, 61614, "tcp", "ActiveMQ STOMP"] activemq-61617-tcp = [61617, 61617, "tcp", "ActiveMQ OpenWire"] activemq-61619-tcp = [61619, 61619, "tcp", "ActiveMQ WebSocket"] + # Alert Manager + alertmanager-9093-tcp = [9093, 9093, "tcp", "Alert Manager"] + alertmanager-9094-tcp = [9094, 9094, "tcp", "Alert Manager Cluster"] # Carbon relay carbon-line-in-tcp = [2003, 2003, "tcp", "Carbon line-in"] carbon-line-in-udp = [2003, 2003, "udp", "Carbon line-in"] @@ -101,11 +104,14 @@ variable "rules" { openvpn-https-tcp = [443, 443, "tcp", "OpenVPN"] # PostgreSQL postgresql-tcp = [5432, 5432, "tcp", "PostgreSQL"] - # Oracle Database - oracle-db-tcp = [1521, 1521, "tcp", "Oracle"] # Puppet puppet-tcp = [8140, 8140, "tcp", "Puppet"] puppetdb-tcp = [8081, 8081, "tcp", "PuppetDB"] + # Prometheus + prometheus-http-tcp = [9090, 9090, "tcp", "Prometheus"] + prometheus-pushgateway-http-tcp = [9091, 9091, "tcp", "Prometheus Pushgateway"] + # Oracle Database + oracle-db-tcp = [1521, 1521, "tcp", "Oracle"] # RabbitMQ rabbitmq-4369-tcp = [4369, 4369, "tcp", "RabbitMQ epmd"] rabbitmq-5671-tcp = [5671, 5671, "tcp", "RabbitMQ"] @@ -170,6 +176,11 @@ variable "auto_groups" { ingress_with_self = ["all-all"] egress_rules = ["all-all"] } + alertmanager = { + ingress_rules = ["alertmanager-9093-tcp", "alertmanager-9094-tcp"] + ingress_with_self = ["all-all"] + egress_rules = ["all-all"] + } carbon-relay-ng = { ingress_rules = ["carbon-line-in-tcp", "carbon-line-in-udp", "carbon-pickle-tcp", "carbon-pickle-udp", "carbon-gui-udp"] ingress_with_self = ["all-all"] @@ -310,6 +321,11 @@ variable "auto_groups" { ingress_with_self = ["all-all"] egress_rules = ["all-all"] } + prometheus = { + ingress_rules = ["prometheus-http-tcp", "prometheus-pushgateway-http-tcp"] + ingress_with_self = ["all-all"] + egress_rules = ["all-all"] + } rabbitmq = { ingress_rules = ["rabbitmq-4369-tcp", "rabbitmq-5671-tcp", "rabbitmq-5672-tcp", "rabbitmq-15672-tcp", "rabbitmq-25672-tcp"] ingress_with_self = ["all-all"] From 1633ff82d7a03d6a6246b2f6fe5aefd42e51aa20 Mon Sep 17 00:00:00 2001 From: Anton Babenko Date: Mon, 11 May 2020 10:04:09 +0200 Subject: [PATCH 2/2] docs: Updated docs for modules --- README.md | 4 +- modules/README.md | 2 + modules/alertmanager/README.md | 109 +++++++++ modules/alertmanager/auto_values.tf | 79 +++++++ modules/alertmanager/main.tf | 114 ++++++++++ modules/alertmanager/outputs.tf | 24 ++ modules/alertmanager/variables.tf | 342 ++++++++++++++++++++++++++++ modules/alertmanager/versions.tf | 7 + modules/prometheus/README.md | 109 +++++++++ modules/prometheus/auto_values.tf | 79 +++++++ modules/prometheus/main.tf | 114 ++++++++++ modules/prometheus/outputs.tf | 24 ++ modules/prometheus/variables.tf | 342 ++++++++++++++++++++++++++++ modules/prometheus/versions.tf | 7 + rules.tf | 6 +- 15 files changed, 1357 insertions(+), 5 deletions(-) create mode 100644 modules/alertmanager/README.md create mode 100644 modules/alertmanager/auto_values.tf create mode 100644 modules/alertmanager/main.tf create mode 100644 modules/alertmanager/outputs.tf create mode 100644 modules/alertmanager/variables.tf create mode 100644 modules/alertmanager/versions.tf create mode 100644 modules/prometheus/README.md create mode 100644 modules/prometheus/auto_values.tf create mode 100644 modules/prometheus/main.tf create mode 100644 modules/prometheus/outputs.tf create mode 100644 modules/prometheus/variables.tf create mode 100644 modules/prometheus/versions.tf diff --git a/README.md b/README.md index 09cb3399..af4b5718 100644 --- a/README.md +++ b/README.md @@ -174,7 +174,7 @@ No issue is creating limit on this module. | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| -| auto\_groups | Map of groups of security group rules to use to generate modules (see update\_groups.sh) | `map(map(list(string)))` | 
{
  "activemq": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "activemq-5671-tcp",
      "activemq-8883-tcp",
      "activemq-61614-tcp",
      "activemq-61617-tcp",
      "activemq-61619-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "carbon-relay-ng": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "carbon-line-in-tcp",
      "carbon-line-in-udp",
      "carbon-pickle-tcp",
      "carbon-pickle-udp",
      "carbon-gui-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "cassandra": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "cassandra-clients-tcp",
      "cassandra-thrift-clients-tcp",
      "cassandra-jmx-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "consul": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "consul-tcp",
      "consul-cli-rpc-tcp",
      "consul-webui-tcp",
      "consul-dns-tcp",
      "consul-dns-udp",
      "consul-serf-lan-tcp",
      "consul-serf-lan-udp",
      "consul-serf-wan-tcp",
      "consul-serf-wan-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "docker-swarm": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "docker-swarm-mngmt-tcp",
      "docker-swarm-node-tcp",
      "docker-swarm-node-udp",
      "docker-swarm-overlay-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "elasticsearch": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "elasticsearch-rest-tcp",
      "elasticsearch-java-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "grafana": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "grafana-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "graphite-statsd": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "graphite-webui",
      "graphite-2003-tcp",
      "graphite-2004-tcp",
      "graphite-2023-tcp",
      "graphite-2024-tcp",
      "graphite-8080-tcp",
      "graphite-8125-tcp",
      "graphite-8125-udp",
      "graphite-8126-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "http-80": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "http-80-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "http-8080": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "http-8080-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "https-443": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "https-443-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "https-8443": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "https-8443-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ipsec-4500": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ipsec-4500-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ipsec-500": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ipsec-500-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "kafka": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "kafka-broker-tcp",
      "kafka-broker-tls-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "kibana": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "kibana-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "kubernetes-api": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "kubernetes-api-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ldaps": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ldaps-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "memcached": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "memcached-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "mongodb": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "mongodb-27017-tcp",
      "mongodb-27018-tcp",
      "mongodb-27019-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "mssql": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "mssql-tcp",
      "mssql-udp",
      "mssql-analytics-tcp",
      "mssql-broker-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "mysql": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "mysql-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "nfs": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "nfs-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "nomad": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "nomad-http-tcp",
      "nomad-rpc-tcp",
      "nomad-serf-tcp",
      "nomad-serf-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ntp": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ntp-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "openvpn": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "openvpn-udp",
      "openvpn-tcp",
      "openvpn-https-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "oracle-db": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "oracle-db-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "postgresql": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "postgresql-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "puppet": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "puppet-tcp",
      "puppetdb-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "rabbitmq": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "rabbitmq-4369-tcp",
      "rabbitmq-5671-tcp",
      "rabbitmq-5672-tcp",
      "rabbitmq-15672-tcp",
      "rabbitmq-25672-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "rdp": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "rdp-tcp",
      "rdp-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "redis": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "redis-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "redshift": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "redshift-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "splunk": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "splunk-indexer-tcp",
      "splunk-clients-tcp",
      "splunk-splunkd-tcp",
      "splunk-hec-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "squid": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "squid-proxy-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ssh": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ssh-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "storm": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "storm-nimbus-tcp",
      "storm-ui-tcp",
      "storm-supervisor-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "web": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "http-80-tcp",
      "http-8080-tcp",
      "https-443-tcp",
      "web-jmx-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "winrm": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "winrm-http-tcp",
      "winrm-https-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "zipkin": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "zipkin-admin-tcp",
      "zipkin-admin-query-tcp",
      "zipkin-admin-web-tcp",
      "zipkin-query-tcp",
      "zipkin-web-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "zookeeper": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "zookeeper-2181-tcp",
      "zookeeper-2888-tcp",
      "zookeeper-3888-tcp",
      "zookeeper-jmx-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  }
}
| no | +| auto\_groups | Map of groups of security group rules to use to generate modules (see update\_groups.sh) | `map(map(list(string)))` | 
{
  "activemq": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "activemq-5671-tcp",
      "activemq-8883-tcp",
      "activemq-61614-tcp",
      "activemq-61617-tcp",
      "activemq-61619-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "alertmanager": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "alertmanager-9093-tcp",
      "alertmanager-9094-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "carbon-relay-ng": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "carbon-line-in-tcp",
      "carbon-line-in-udp",
      "carbon-pickle-tcp",
      "carbon-pickle-udp",
      "carbon-gui-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "cassandra": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "cassandra-clients-tcp",
      "cassandra-thrift-clients-tcp",
      "cassandra-jmx-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "consul": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "consul-tcp",
      "consul-cli-rpc-tcp",
      "consul-webui-tcp",
      "consul-dns-tcp",
      "consul-dns-udp",
      "consul-serf-lan-tcp",
      "consul-serf-lan-udp",
      "consul-serf-wan-tcp",
      "consul-serf-wan-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "docker-swarm": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "docker-swarm-mngmt-tcp",
      "docker-swarm-node-tcp",
      "docker-swarm-node-udp",
      "docker-swarm-overlay-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "elasticsearch": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "elasticsearch-rest-tcp",
      "elasticsearch-java-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "grafana": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "grafana-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "graphite-statsd": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "graphite-webui",
      "graphite-2003-tcp",
      "graphite-2004-tcp",
      "graphite-2023-tcp",
      "graphite-2024-tcp",
      "graphite-8080-tcp",
      "graphite-8125-tcp",
      "graphite-8125-udp",
      "graphite-8126-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "http-80": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "http-80-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "http-8080": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "http-8080-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "https-443": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "https-443-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "https-8443": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "https-8443-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ipsec-4500": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ipsec-4500-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ipsec-500": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ipsec-500-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "kafka": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "kafka-broker-tcp",
      "kafka-broker-tls-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "kibana": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "kibana-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "kubernetes-api": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "kubernetes-api-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ldaps": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ldaps-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "memcached": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "memcached-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "mongodb": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "mongodb-27017-tcp",
      "mongodb-27018-tcp",
      "mongodb-27019-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "mssql": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "mssql-tcp",
      "mssql-udp",
      "mssql-analytics-tcp",
      "mssql-broker-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "mysql": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "mysql-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "nfs": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "nfs-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "nomad": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "nomad-http-tcp",
      "nomad-rpc-tcp",
      "nomad-serf-tcp",
      "nomad-serf-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ntp": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ntp-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "openvpn": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "openvpn-udp",
      "openvpn-tcp",
      "openvpn-https-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "oracle-db": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "oracle-db-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "postgresql": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "postgresql-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "prometheus": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "prometheus-http-tcp",
      "prometheus-pushgateway-http-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "puppet": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "puppet-tcp",
      "puppetdb-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "rabbitmq": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "rabbitmq-4369-tcp",
      "rabbitmq-5671-tcp",
      "rabbitmq-5672-tcp",
      "rabbitmq-15672-tcp",
      "rabbitmq-25672-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "rdp": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "rdp-tcp",
      "rdp-udp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "redis": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "redis-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "redshift": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "redshift-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "splunk": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "splunk-indexer-tcp",
      "splunk-clients-tcp",
      "splunk-splunkd-tcp",
      "splunk-hec-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "squid": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "squid-proxy-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "ssh": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "ssh-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "storm": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "storm-nimbus-tcp",
      "storm-ui-tcp",
      "storm-supervisor-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "web": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "http-80-tcp",
      "http-8080-tcp",
      "https-443-tcp",
      "web-jmx-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "winrm": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "winrm-http-tcp",
      "winrm-https-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "zipkin": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "zipkin-admin-tcp",
      "zipkin-admin-query-tcp",
      "zipkin-admin-web-tcp",
      "zipkin-query-tcp",
      "zipkin-web-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  },
  "zookeeper": {
    "egress_rules": [
      "all-all"
    ],
    "ingress_rules": [
      "zookeeper-2181-tcp",
      "zookeeper-2888-tcp",
      "zookeeper-3888-tcp",
      "zookeeper-jmx-tcp"
    ],
    "ingress_with_self": [
      "all-all"
    ]
  }
}
| no | | computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no | | computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | | computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | @@ -214,7 +214,7 @@ No issue is creating limit on this module. | number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | | number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | -| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | 
{
  "_": [
    "",
    "",
    ""
  ],
  "activemq-5671-tcp": [
    5671,
    5671,
    "tcp",
    "ActiveMQ AMQP"
  ],
  "activemq-61614-tcp": [
    61614,
    61614,
    "tcp",
    "ActiveMQ STOMP"
  ],
  "activemq-61617-tcp": [
    61617,
    61617,
    "tcp",
    "ActiveMQ OpenWire"
  ],
  "activemq-61619-tcp": [
    61619,
    61619,
    "tcp",
    "ActiveMQ WebSocket"
  ],
  "activemq-8883-tcp": [
    8883,
    8883,
    "tcp",
    "ActiveMQ MQTT"
  ],
  "all-all": [
    -1,
    -1,
    "-1",
    "All protocols"
  ],
  "all-icmp": [
    -1,
    -1,
    "icmp",
    "All IPV4 ICMP"
  ],
  "all-ipv6-icmp": [
    -1,
    -1,
    58,
    "All IPV6 ICMP"
  ],
  "all-tcp": [
    0,
    65535,
    "tcp",
    "All TCP ports"
  ],
  "all-udp": [
    0,
    65535,
    "udp",
    "All UDP ports"
  ],
  "carbon-admin-tcp": [
    2004,
    2004,
    "tcp",
    "Carbon admin"
  ],
  "carbon-gui-udp": [
    8081,
    8081,
    "tcp",
    "Carbon GUI"
  ],
  "carbon-line-in-tcp": [
    2003,
    2003,
    "tcp",
    "Carbon line-in"
  ],
  "carbon-line-in-udp": [
    2003,
    2003,
    "udp",
    "Carbon line-in"
  ],
  "carbon-pickle-tcp": [
    2013,
    2013,
    "tcp",
    "Carbon pickle"
  ],
  "carbon-pickle-udp": [
    2013,
    2013,
    "udp",
    "Carbon pickle"
  ],
  "cassandra-clients-tcp": [
    9042,
    9042,
    "tcp",
    "Cassandra clients"
  ],
  "cassandra-jmx-tcp": [
    7199,
    7199,
    "tcp",
    "JMX"
  ],
  "cassandra-thrift-clients-tcp": [
    9160,
    9160,
    "tcp",
    "Cassandra Thrift clients"
  ],
  "consul-cli-rpc-tcp": [
    8400,
    8400,
    "tcp",
    "Consul CLI RPC"
  ],
  "consul-dns-tcp": [
    8600,
    8600,
    "tcp",
    "Consul DNS"
  ],
  "consul-dns-udp": [
    8600,
    8600,
    "udp",
    "Consul DNS"
  ],
  "consul-serf-lan-tcp": [
    8301,
    8301,
    "tcp",
    "Serf LAN"
  ],
  "consul-serf-lan-udp": [
    8301,
    8301,
    "udp",
    "Serf LAN"
  ],
  "consul-serf-wan-tcp": [
    8302,
    8302,
    "tcp",
    "Serf WAN"
  ],
  "consul-serf-wan-udp": [
    8302,
    8302,
    "udp",
    "Serf WAN"
  ],
  "consul-tcp": [
    8300,
    8300,
    "tcp",
    "Consul server"
  ],
  "consul-webui-tcp": [
    8500,
    8500,
    "tcp",
    "Consul web UI"
  ],
  "dns-tcp": [
    53,
    53,
    "tcp",
    "DNS"
  ],
  "dns-udp": [
    53,
    53,
    "udp",
    "DNS"
  ],
  "docker-swarm-mngmt-tcp": [
    2377,
    2377,
    "tcp",
    "Docker Swarm cluster management"
  ],
  "docker-swarm-node-tcp": [
    7946,
    7946,
    "tcp",
    "Docker Swarm node"
  ],
  "docker-swarm-node-udp": [
    7946,
    7946,
    "udp",
    "Docker Swarm node"
  ],
  "docker-swarm-overlay-udp": [
    4789,
    4789,
    "udp",
    "Docker Swarm Overlay Network Traffic"
  ],
  "elasticsearch-java-tcp": [
    9300,
    9300,
    "tcp",
    "Elasticsearch Java interface"
  ],
  "elasticsearch-rest-tcp": [
    9200,
    9200,
    "tcp",
    "Elasticsearch REST interface"
  ],
  "grafana-tcp": [
    3000,
    3000,
    "tcp",
    "Grafana Dashboard"
  ],
  "graphite-2003-tcp": [
    2003,
    2003,
    "tcp",
    "Carbon receiver plain text"
  ],
  "graphite-2004-tcp": [
    2004,
    2004,
    "tcp",
    "Carbon receiver pickle"
  ],
  "graphite-2023-tcp": [
    2023,
    2023,
    "tcp",
    "Carbon aggregator plaintext"
  ],
  "graphite-2024-tcp": [
    2024,
    2024,
    "tcp",
    "Carbon aggregator pickle"
  ],
  "graphite-8080-tcp": [
    8080,
    8080,
    "tcp",
    "Graphite gunicorn port"
  ],
  "graphite-8125-tcp": [
    8125,
    8125,
    "tcp",
    "Statsd TCP"
  ],
  "graphite-8125-udp": [
    8125,
    8125,
    "udp",
    "Statsd UDP default"
  ],
  "graphite-8126-tcp": [
    8126,
    8126,
    "tcp",
    "Statsd admin"
  ],
  "graphite-webui": [
    80,
    80,
    "tcp",
    "Graphite admin interface"
  ],
  "http-80-tcp": [
    80,
    80,
    "tcp",
    "HTTP"
  ],
  "http-8080-tcp": [
    8080,
    8080,
    "tcp",
    "HTTP"
  ],
  "https-443-tcp": [
    443,
    443,
    "tcp",
    "HTTPS"
  ],
  "https-8443-tcp": [
    8443,
    8443,
    "tcp",
    "HTTPS"
  ],
  "ipsec-4500-udp": [
    4500,
    4500,
    "udp",
    "IPSEC NAT-T"
  ],
  "ipsec-500-udp": [
    500,
    500,
    "udp",
    "IPSEC ISAKMP"
  ],
  "kafka-broker-tcp": [
    9092,
    9092,
    "tcp",
    "Kafka broker 0.8.2+"
  ],
  "kafka-broker-tls-tcp": [
    9094,
    9094,
    "tcp",
    "Kafka TLS enabled broker 0.8.2+"
  ],
  "kibana-tcp": [
    5601,
    5601,
    "tcp",
    "Kibana Web Interface"
  ],
  "kubernetes-api-tcp": [
    6443,
    6443,
    "tcp",
    "Kubernetes API Server"
  ],
  "ldaps-tcp": [
    636,
    636,
    "tcp",
    "LDAPS"
  ],
  "memcached-tcp": [
    11211,
    11211,
    "tcp",
    "Memcached"
  ],
  "mongodb-27017-tcp": [
    27017,
    27017,
    "tcp",
    "MongoDB"
  ],
  "mongodb-27018-tcp": [
    27018,
    27018,
    "tcp",
    "MongoDB shard"
  ],
  "mongodb-27019-tcp": [
    27019,
    27019,
    "tcp",
    "MongoDB config server"
  ],
  "mssql-analytics-tcp": [
    2383,
    2383,
    "tcp",
    "MSSQL Analytics"
  ],
  "mssql-broker-tcp": [
    4022,
    4022,
    "tcp",
    "MSSQL Broker"
  ],
  "mssql-tcp": [
    1433,
    1433,
    "tcp",
    "MSSQL Server"
  ],
  "mssql-udp": [
    1434,
    1434,
    "udp",
    "MSSQL Browser"
  ],
  "mysql-tcp": [
    3306,
    3306,
    "tcp",
    "MySQL/Aurora"
  ],
  "nfs-tcp": [
    2049,
    2049,
    "tcp",
    "NFS/EFS"
  ],
  "nomad-http-tcp": [
    4646,
    4646,
    "tcp",
    "Nomad HTTP"
  ],
  "nomad-rpc-tcp": [
    4647,
    4647,
    "tcp",
    "Nomad RPC"
  ],
  "nomad-serf-tcp": [
    4648,
    4648,
    "tcp",
    "Serf"
  ],
  "nomad-serf-udp": [
    4648,
    4648,
    "udp",
    "Serf"
  ],
  "ntp-udp": [
    123,
    123,
    "udp",
    "NTP"
  ],
  "openvpn-https-tcp": [
    443,
    443,
    "tcp",
    "OpenVPN"
  ],
  "openvpn-tcp": [
    943,
    943,
    "tcp",
    "OpenVPN"
  ],
  "openvpn-udp": [
    1194,
    1194,
    "udp",
    "OpenVPN"
  ],
  "oracle-db-tcp": [
    1521,
    1521,
    "tcp",
    "Oracle"
  ],
  "postgresql-tcp": [
    5432,
    5432,
    "tcp",
    "PostgreSQL"
  ],
  "puppet-tcp": [
    8140,
    8140,
    "tcp",
    "Puppet"
  ],
  "puppetdb-tcp": [
    8081,
    8081,
    "tcp",
    "PuppetDB"
  ],
  "rabbitmq-15672-tcp": [
    15672,
    15672,
    "tcp",
    "RabbitMQ"
  ],
  "rabbitmq-25672-tcp": [
    25672,
    25672,
    "tcp",
    "RabbitMQ"
  ],
  "rabbitmq-4369-tcp": [
    4369,
    4369,
    "tcp",
    "RabbitMQ epmd"
  ],
  "rabbitmq-5671-tcp": [
    5671,
    5671,
    "tcp",
    "RabbitMQ"
  ],
  "rabbitmq-5672-tcp": [
    5672,
    5672,
    "tcp",
    "RabbitMQ"
  ],
  "rdp-tcp": [
    3389,
    3389,
    "tcp",
    "Remote Desktop"
  ],
  "rdp-udp": [
    3389,
    3389,
    "udp",
    "Remote Desktop"
  ],
  "redis-tcp": [
    6379,
    6379,
    "tcp",
    "Redis"
  ],
  "redshift-tcp": [
    5439,
    5439,
    "tcp",
    "Redshift"
  ],
  "splunk-hec-tcp": [
    8088,
    8088,
    "tcp",
    "Splunk HEC"
  ],
  "splunk-indexer-tcp": [
    9997,
    9997,
    "tcp",
    "Splunk indexer"
  ],
  "splunk-splunkd-tcp": [
    8089,
    8089,
    "tcp",
    "Splunkd"
  ],
  "splunk-web-tcp": [
    8000,
    8000,
    "tcp",
    "Splunk Web"
  ],
  "squid-proxy-tcp": [
    3128,
    3128,
    "tcp",
    "Squid default proxy"
  ],
  "ssh-tcp": [
    22,
    22,
    "tcp",
    "SSH"
  ],
  "storm-nimbus-tcp": [
    6627,
    6627,
    "tcp",
    "Nimbus"
  ],
  "storm-supervisor-tcp": [
    6700,
    6703,
    "tcp",
    "Supervisor"
  ],
  "storm-ui-tcp": [
    8080,
    8080,
    "tcp",
    "Storm UI"
  ],
  "web-jmx-tcp": [
    1099,
    1099,
    "tcp",
    "JMX"
  ],
  "winrm-http-tcp": [
    5985,
    5985,
    "tcp",
    "WinRM HTTP"
  ],
  "winrm-https-tcp": [
    5986,
    5986,
    "tcp",
    "WinRM HTTPS"
  ],
  "zipkin-admin-query-tcp": [
    9901,
    9901,
    "tcp",
    "Zipkin Admin port query"
  ],
  "zipkin-admin-tcp": [
    9990,
    9990,
    "tcp",
    "Zipkin Admin port collector"
  ],
  "zipkin-admin-web-tcp": [
    9991,
    9991,
    "tcp",
    "Zipkin Admin port web"
  ],
  "zipkin-query-tcp": [
    9411,
    9411,
    "tcp",
    "Zipkin query port"
  ],
  "zipkin-web-tcp": [
    8080,
    8080,
    "tcp",
    "Zipkin web port"
  ],
  "zookeeper-2181-tcp": [
    2181,
    2181,
    "tcp",
    "Zookeeper"
  ],
  "zookeeper-2888-tcp": [
    2888,
    2888,
    "tcp",
    "Zookeeper"
  ],
  "zookeeper-3888-tcp": [
    3888,
    3888,
    "tcp",
    "Zookeeper"
  ],
  "zookeeper-jmx-tcp": [
    7199,
    7199,
    "tcp",
    "JMX"
  ]
}
| no | +| rules | Map of known security group rules (define as 'name' = ['from port', 'to port', 'protocol', 'description']) | `map(list(any))` | 
{
  "_": [
    "",
    "",
    ""
  ],
  "activemq-5671-tcp": [
    5671,
    5671,
    "tcp",
    "ActiveMQ AMQP"
  ],
  "activemq-61614-tcp": [
    61614,
    61614,
    "tcp",
    "ActiveMQ STOMP"
  ],
  "activemq-61617-tcp": [
    61617,
    61617,
    "tcp",
    "ActiveMQ OpenWire"
  ],
  "activemq-61619-tcp": [
    61619,
    61619,
    "tcp",
    "ActiveMQ WebSocket"
  ],
  "activemq-8883-tcp": [
    8883,
    8883,
    "tcp",
    "ActiveMQ MQTT"
  ],
  "alertmanager-9093-tcp": [
    9093,
    9093,
    "tcp",
    "Alert Manager"
  ],
  "alertmanager-9094-tcp": [
    9094,
    9094,
    "tcp",
    "Alert Manager Cluster"
  ],
  "all-all": [
    -1,
    -1,
    "-1",
    "All protocols"
  ],
  "all-icmp": [
    -1,
    -1,
    "icmp",
    "All IPV4 ICMP"
  ],
  "all-ipv6-icmp": [
    -1,
    -1,
    58,
    "All IPV6 ICMP"
  ],
  "all-tcp": [
    0,
    65535,
    "tcp",
    "All TCP ports"
  ],
  "all-udp": [
    0,
    65535,
    "udp",
    "All UDP ports"
  ],
  "carbon-admin-tcp": [
    2004,
    2004,
    "tcp",
    "Carbon admin"
  ],
  "carbon-gui-udp": [
    8081,
    8081,
    "tcp",
    "Carbon GUI"
  ],
  "carbon-line-in-tcp": [
    2003,
    2003,
    "tcp",
    "Carbon line-in"
  ],
  "carbon-line-in-udp": [
    2003,
    2003,
    "udp",
    "Carbon line-in"
  ],
  "carbon-pickle-tcp": [
    2013,
    2013,
    "tcp",
    "Carbon pickle"
  ],
  "carbon-pickle-udp": [
    2013,
    2013,
    "udp",
    "Carbon pickle"
  ],
  "cassandra-clients-tcp": [
    9042,
    9042,
    "tcp",
    "Cassandra clients"
  ],
  "cassandra-jmx-tcp": [
    7199,
    7199,
    "tcp",
    "JMX"
  ],
  "cassandra-thrift-clients-tcp": [
    9160,
    9160,
    "tcp",
    "Cassandra Thrift clients"
  ],
  "consul-cli-rpc-tcp": [
    8400,
    8400,
    "tcp",
    "Consul CLI RPC"
  ],
  "consul-dns-tcp": [
    8600,
    8600,
    "tcp",
    "Consul DNS"
  ],
  "consul-dns-udp": [
    8600,
    8600,
    "udp",
    "Consul DNS"
  ],
  "consul-serf-lan-tcp": [
    8301,
    8301,
    "tcp",
    "Serf LAN"
  ],
  "consul-serf-lan-udp": [
    8301,
    8301,
    "udp",
    "Serf LAN"
  ],
  "consul-serf-wan-tcp": [
    8302,
    8302,
    "tcp",
    "Serf WAN"
  ],
  "consul-serf-wan-udp": [
    8302,
    8302,
    "udp",
    "Serf WAN"
  ],
  "consul-tcp": [
    8300,
    8300,
    "tcp",
    "Consul server"
  ],
  "consul-webui-tcp": [
    8500,
    8500,
    "tcp",
    "Consul web UI"
  ],
  "dns-tcp": [
    53,
    53,
    "tcp",
    "DNS"
  ],
  "dns-udp": [
    53,
    53,
    "udp",
    "DNS"
  ],
  "docker-swarm-mngmt-tcp": [
    2377,
    2377,
    "tcp",
    "Docker Swarm cluster management"
  ],
  "docker-swarm-node-tcp": [
    7946,
    7946,
    "tcp",
    "Docker Swarm node"
  ],
  "docker-swarm-node-udp": [
    7946,
    7946,
    "udp",
    "Docker Swarm node"
  ],
  "docker-swarm-overlay-udp": [
    4789,
    4789,
    "udp",
    "Docker Swarm Overlay Network Traffic"
  ],
  "elasticsearch-java-tcp": [
    9300,
    9300,
    "tcp",
    "Elasticsearch Java interface"
  ],
  "elasticsearch-rest-tcp": [
    9200,
    9200,
    "tcp",
    "Elasticsearch REST interface"
  ],
  "grafana-tcp": [
    3000,
    3000,
    "tcp",
    "Grafana Dashboard"
  ],
  "graphite-2003-tcp": [
    2003,
    2003,
    "tcp",
    "Carbon receiver plain text"
  ],
  "graphite-2004-tcp": [
    2004,
    2004,
    "tcp",
    "Carbon receiver pickle"
  ],
  "graphite-2023-tcp": [
    2023,
    2023,
    "tcp",
    "Carbon aggregator plaintext"
  ],
  "graphite-2024-tcp": [
    2024,
    2024,
    "tcp",
    "Carbon aggregator pickle"
  ],
  "graphite-8080-tcp": [
    8080,
    8080,
    "tcp",
    "Graphite gunicorn port"
  ],
  "graphite-8125-tcp": [
    8125,
    8125,
    "tcp",
    "Statsd TCP"
  ],
  "graphite-8125-udp": [
    8125,
    8125,
    "udp",
    "Statsd UDP default"
  ],
  "graphite-8126-tcp": [
    8126,
    8126,
    "tcp",
    "Statsd admin"
  ],
  "graphite-webui": [
    80,
    80,
    "tcp",
    "Graphite admin interface"
  ],
  "http-80-tcp": [
    80,
    80,
    "tcp",
    "HTTP"
  ],
  "http-8080-tcp": [
    8080,
    8080,
    "tcp",
    "HTTP"
  ],
  "https-443-tcp": [
    443,
    443,
    "tcp",
    "HTTPS"
  ],
  "https-8443-tcp": [
    8443,
    8443,
    "tcp",
    "HTTPS"
  ],
  "ipsec-4500-udp": [
    4500,
    4500,
    "udp",
    "IPSEC NAT-T"
  ],
  "ipsec-500-udp": [
    500,
    500,
    "udp",
    "IPSEC ISAKMP"
  ],
  "kafka-broker-tcp": [
    9092,
    9092,
    "tcp",
    "Kafka broker 0.8.2+"
  ],
  "kafka-broker-tls-tcp": [
    9094,
    9094,
    "tcp",
    "Kafka TLS enabled broker 0.8.2+"
  ],
  "kibana-tcp": [
    5601,
    5601,
    "tcp",
    "Kibana Web Interface"
  ],
  "kubernetes-api-tcp": [
    6443,
    6443,
    "tcp",
    "Kubernetes API Server"
  ],
  "ldaps-tcp": [
    636,
    636,
    "tcp",
    "LDAPS"
  ],
  "memcached-tcp": [
    11211,
    11211,
    "tcp",
    "Memcached"
  ],
  "mongodb-27017-tcp": [
    27017,
    27017,
    "tcp",
    "MongoDB"
  ],
  "mongodb-27018-tcp": [
    27018,
    27018,
    "tcp",
    "MongoDB shard"
  ],
  "mongodb-27019-tcp": [
    27019,
    27019,
    "tcp",
    "MongoDB config server"
  ],
  "mssql-analytics-tcp": [
    2383,
    2383,
    "tcp",
    "MSSQL Analytics"
  ],
  "mssql-broker-tcp": [
    4022,
    4022,
    "tcp",
    "MSSQL Broker"
  ],
  "mssql-tcp": [
    1433,
    1433,
    "tcp",
    "MSSQL Server"
  ],
  "mssql-udp": [
    1434,
    1434,
    "udp",
    "MSSQL Browser"
  ],
  "mysql-tcp": [
    3306,
    3306,
    "tcp",
    "MySQL/Aurora"
  ],
  "nfs-tcp": [
    2049,
    2049,
    "tcp",
    "NFS/EFS"
  ],
  "nomad-http-tcp": [
    4646,
    4646,
    "tcp",
    "Nomad HTTP"
  ],
  "nomad-rpc-tcp": [
    4647,
    4647,
    "tcp",
    "Nomad RPC"
  ],
  "nomad-serf-tcp": [
    4648,
    4648,
    "tcp",
    "Serf"
  ],
  "nomad-serf-udp": [
    4648,
    4648,
    "udp",
    "Serf"
  ],
  "ntp-udp": [
    123,
    123,
    "udp",
    "NTP"
  ],
  "openvpn-https-tcp": [
    443,
    443,
    "tcp",
    "OpenVPN"
  ],
  "openvpn-tcp": [
    943,
    943,
    "tcp",
    "OpenVPN"
  ],
  "openvpn-udp": [
    1194,
    1194,
    "udp",
    "OpenVPN"
  ],
  "oracle-db-tcp": [
    1521,
    1521,
    "tcp",
    "Oracle"
  ],
  "postgresql-tcp": [
    5432,
    5432,
    "tcp",
    "PostgreSQL"
  ],
  "prometheus-http-tcp": [
    9090,
    9090,
    "tcp",
    "Prometheus"
  ],
  "prometheus-pushgateway-http-tcp": [
    9091,
    9091,
    "tcp",
    "Prometheus Pushgateway"
  ],
  "puppet-tcp": [
    8140,
    8140,
    "tcp",
    "Puppet"
  ],
  "puppetdb-tcp": [
    8081,
    8081,
    "tcp",
    "PuppetDB"
  ],
  "rabbitmq-15672-tcp": [
    15672,
    15672,
    "tcp",
    "RabbitMQ"
  ],
  "rabbitmq-25672-tcp": [
    25672,
    25672,
    "tcp",
    "RabbitMQ"
  ],
  "rabbitmq-4369-tcp": [
    4369,
    4369,
    "tcp",
    "RabbitMQ epmd"
  ],
  "rabbitmq-5671-tcp": [
    5671,
    5671,
    "tcp",
    "RabbitMQ"
  ],
  "rabbitmq-5672-tcp": [
    5672,
    5672,
    "tcp",
    "RabbitMQ"
  ],
  "rdp-tcp": [
    3389,
    3389,
    "tcp",
    "Remote Desktop"
  ],
  "rdp-udp": [
    3389,
    3389,
    "udp",
    "Remote Desktop"
  ],
  "redis-tcp": [
    6379,
    6379,
    "tcp",
    "Redis"
  ],
  "redshift-tcp": [
    5439,
    5439,
    "tcp",
    "Redshift"
  ],
  "splunk-hec-tcp": [
    8088,
    8088,
    "tcp",
    "Splunk HEC"
  ],
  "splunk-indexer-tcp": [
    9997,
    9997,
    "tcp",
    "Splunk indexer"
  ],
  "splunk-splunkd-tcp": [
    8089,
    8089,
    "tcp",
    "Splunkd"
  ],
  "splunk-web-tcp": [
    8000,
    8000,
    "tcp",
    "Splunk Web"
  ],
  "squid-proxy-tcp": [
    3128,
    3128,
    "tcp",
    "Squid default proxy"
  ],
  "ssh-tcp": [
    22,
    22,
    "tcp",
    "SSH"
  ],
  "storm-nimbus-tcp": [
    6627,
    6627,
    "tcp",
    "Nimbus"
  ],
  "storm-supervisor-tcp": [
    6700,
    6703,
    "tcp",
    "Supervisor"
  ],
  "storm-ui-tcp": [
    8080,
    8080,
    "tcp",
    "Storm UI"
  ],
  "web-jmx-tcp": [
    1099,
    1099,
    "tcp",
    "JMX"
  ],
  "winrm-http-tcp": [
    5985,
    5985,
    "tcp",
    "WinRM HTTP"
  ],
  "winrm-https-tcp": [
    5986,
    5986,
    "tcp",
    "WinRM HTTPS"
  ],
  "zipkin-admin-query-tcp": [
    9901,
    9901,
    "tcp",
    "Zipkin Admin port query"
  ],
  "zipkin-admin-tcp": [
    9990,
    9990,
    "tcp",
    "Zipkin Admin port collector"
  ],
  "zipkin-admin-web-tcp": [
    9991,
    9991,
    "tcp",
    "Zipkin Admin port web"
  ],
  "zipkin-query-tcp": [
    9411,
    9411,
    "tcp",
    "Zipkin query port"
  ],
  "zipkin-web-tcp": [
    8080,
    8080,
    "tcp",
    "Zipkin web port"
  ],
  "zookeeper-2181-tcp": [
    2181,
    2181,
    "tcp",
    "Zookeeper"
  ],
  "zookeeper-2888-tcp": [
    2888,
    2888,
    "tcp",
    "Zookeeper"
  ],
  "zookeeper-3888-tcp": [
    3888,
    3888,
    "tcp",
    "Zookeeper"
  ],
  "zookeeper-jmx-tcp": [
    7199,
    7199,
    "tcp",
    "JMX"
  ]
}
| no | | tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | | use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | | vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | diff --git a/modules/README.md b/modules/README.md index 0ba10c49..bda02371 100644 --- a/modules/README.md +++ b/modules/README.md @@ -3,6 +3,7 @@ List of Security Groups implemented as Terraform modules * [activemq](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/activemq) +* [alertmanager](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/alertmanager) * [carbon-relay-ng](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/carbon-relay-ng) * [cassandra](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/cassandra) * [consul](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/consul) @@ -30,6 +31,7 @@ List of Security Groups implemented as Terraform modules * [openvpn](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/openvpn) * [oracle-db](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/oracle-db) * [postgresql](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/postgresql) +* [prometheus](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/prometheus) * [puppet](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/puppet) * [rabbitmq](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/rabbitmq) * [rdp](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/rdp) diff --git a/modules/alertmanager/README.md b/modules/alertmanager/README.md new file mode 100644 index 00000000..89cb1d3c --- /dev/null +++ b/modules/alertmanager/README.md @@ -0,0 +1,109 @@ +# alertmanager - AWS EC2-VPC Security Group Terraform module + +## Usage + +```hcl +module "alertmanager_security_group" { + source = "terraform-aws-modules/security-group/aws//modules/alertmanager" + version = "~> 3.0" + + # omitted... +} +``` + +All automatic values **alertmanager module** is using are available [here](https://github.com/terraform-aws-modules/terraform-aws-security-group/blob/master/modules/alertmanager/auto_values.tf). + + +## Requirements + +| Name | Version | +|------|---------| +| terraform | ~> 0.12.6 | +| aws | ~> 2.42 | + +## Providers + +No provider. + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| auto\_computed\_egress\_rules | List of computed egress rules to add automatically | `list(string)` | `[]` | no | +| auto\_computed\_egress\_with\_self | List of maps defining computed egress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_computed\_ingress\_rules | List of ingress rules to add automatically | `list(string)` | `[]` | no | +| auto\_computed\_ingress\_with\_self | List of maps defining computed ingress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_egress\_rules | List of egress rules to add automatically | `list(string)` | 
[
  "all-all"
]
| no | +| auto\_egress\_with\_self | List of maps defining egress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_ingress\_rules | List of ingress rules to add automatically | `list(string)` | 
[
  "alertmanager-9093-tcp",
  "alertmanager-9094-tcp"
]
| no | +| auto\_ingress\_with\_self | List of maps defining ingress rules with self to add automatically | `list(map(string))` | 
[
  {
    "rule": "all-all"
  }
]
| no | +| auto\_number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| computed\_egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed egress rules | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| computed\_egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed egress rules | `list(string)` | 
[
  "::/0"
]
| no | +| computed\_egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `list(string)` | `[]` | no | +| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no | +| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_self | List of computed egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_source\_security\_group\_id | List of computed egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_rules | List of computed ingress rules to create by name | `list(string)` | `[]` | no | +| computed\_ingress\_with\_cidr\_blocks | List of computed ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_ipv6\_cidr\_blocks | List of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_self | List of computed ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_source\_security\_group\_id | List of computed ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| create | Whether to create security group and all rules | `bool` | `true` | no | +| description | Description of security group | `string` | `"Security Group managed by Terraform"` | no | +| egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all egress rules | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all egress rules | `list(string)` | 
[
  "::/0"
]
| no | +| egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules | `list(string)` | `[]` | no | +| egress\_rules | List of egress rules to create by name | `list(string)` | `[]` | no | +| egress\_with\_cidr\_blocks | List of egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_ipv6\_cidr\_blocks | List of egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_self | List of egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| egress\_with\_source\_security\_group\_id | List of egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_rules | List of ingress rules to create by name | `list(string)` | `[]` | no | +| ingress\_with\_cidr\_blocks | List of ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_ipv6\_cidr\_blocks | List of ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_self | List of ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| ingress\_with\_source\_security\_group\_id | List of ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| name | Name of security group | `string` | n/a | yes | +| number\_of\_computed\_egress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_cidr\_blocks | Number of computed egress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_ipv6\_cidr\_blocks | Number of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_source\_security\_group\_id | Number of computed egress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_cidr\_blocks | Number of computed ingress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | +| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | +| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| this\_security\_group\_description | The description of the security group | +| this\_security\_group\_id | The ID of the security group | +| this\_security\_group\_name | The name of the security group | +| this\_security\_group\_owner\_id | The owner ID | +| this\_security\_group\_vpc\_id | The VPC ID | + + diff --git a/modules/alertmanager/auto_values.tf b/modules/alertmanager/auto_values.tf new file mode 100644 index 00000000..ee79fc2d --- /dev/null +++ b/modules/alertmanager/auto_values.tf @@ -0,0 +1,79 @@ +# This file was generated from values defined in rules.tf using update_groups.sh. +################################### +# DO NOT CHANGE THIS FILE MANUALLY +################################### + +variable "auto_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = ["alertmanager-9093-tcp", "alertmanager-9094-tcp"] +} + +variable "auto_ingress_with_self" { + description = "List of maps defining ingress rules with self to add automatically" + type = list(map(string)) + default = [{ "rule" = "all-all" }] +} + +variable "auto_egress_rules" { + description = "List of egress rules to add automatically" + type = list(string) + default = ["all-all"] +} + +variable "auto_egress_with_self" { + description = "List of maps defining egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Computed +variable "auto_computed_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_ingress_with_self" { + description = "List of maps defining computed ingress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +variable "auto_computed_egress_rules" { + description = "List of computed egress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_egress_with_self" { + description = "List of maps defining computed egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Number of computed rules +variable "auto_number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + diff --git a/modules/alertmanager/main.tf b/modules/alertmanager/main.tf new file mode 100644 index 00000000..2c85546f --- /dev/null +++ b/modules/alertmanager/main.tf @@ -0,0 +1,114 @@ +module "sg" { + source = "../../" + + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + tags = var.tags + + ########## + # Ingress + ########## + # Rules by names - open for default CIDR + ingress_rules = sort(compact(distinct(concat(var.auto_ingress_rules, var.ingress_rules, [""])))) + + # Open for self + ingress_with_self = concat(var.auto_ingress_with_self, var.ingress_with_self) + + # Open to IPv4 cidr blocks + ingress_with_cidr_blocks = var.ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + ingress_with_ipv6_cidr_blocks = var.ingress_with_ipv6_cidr_blocks + + # Open for security group id + ingress_with_source_security_group_id = var.ingress_with_source_security_group_id + + # Default ingress CIDR blocks + ingress_cidr_blocks = var.ingress_cidr_blocks + ingress_ipv6_cidr_blocks = var.ingress_ipv6_cidr_blocks + + # Default prefix list ids + ingress_prefix_list_ids = var.ingress_prefix_list_ids + + ################### + # Computed Ingress + ################### + # Rules by names - open for default CIDR + computed_ingress_rules = sort(compact(distinct(concat(var.auto_computed_ingress_rules, var.computed_ingress_rules, [""])))) + + # Open for self + computed_ingress_with_self = concat(var.auto_computed_ingress_with_self, var.computed_ingress_with_self) + + # Open to IPv4 cidr blocks + computed_ingress_with_cidr_blocks = var.computed_ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_ingress_with_ipv6_cidr_blocks = var.computed_ingress_with_ipv6_cidr_blocks + + # Open for security group id + computed_ingress_with_source_security_group_id = var.computed_ingress_with_source_security_group_id + + ############################# + # Number of computed ingress + ############################# + number_of_computed_ingress_rules = var.auto_number_of_computed_ingress_rules + var.number_of_computed_ingress_rules + number_of_computed_ingress_with_self = var.auto_number_of_computed_ingress_with_self + var.number_of_computed_ingress_with_self + number_of_computed_ingress_with_cidr_blocks = var.number_of_computed_ingress_with_cidr_blocks + number_of_computed_ingress_with_ipv6_cidr_blocks = var.number_of_computed_ingress_with_ipv6_cidr_blocks + number_of_computed_ingress_with_source_security_group_id = var.number_of_computed_ingress_with_source_security_group_id + + ######### + # Egress + ######### + # Rules by names - open for default CIDR + egress_rules = sort(compact(distinct(concat(var.auto_egress_rules, var.egress_rules, [""])))) + + # Open for self + egress_with_self = concat(var.auto_egress_with_self, var.egress_with_self) + + # Open to IPv4 cidr blocks + egress_with_cidr_blocks = var.egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + egress_with_ipv6_cidr_blocks = var.egress_with_ipv6_cidr_blocks + + # Open for security group id + egress_with_source_security_group_id = var.egress_with_source_security_group_id + + # Default egress CIDR blocks + egress_cidr_blocks = var.egress_cidr_blocks + egress_ipv6_cidr_blocks = var.egress_ipv6_cidr_blocks + + # Default prefix list ids + egress_prefix_list_ids = var.egress_prefix_list_ids + + ################## + # Computed Egress + ################## + # Rules by names - open for default CIDR + computed_egress_rules = sort(compact(distinct(concat(var.auto_computed_egress_rules, var.computed_egress_rules, [""])))) + + # Open for self + computed_egress_with_self = concat(var.auto_computed_egress_with_self, var.computed_egress_with_self) + + # Open to IPv4 cidr blocks + computed_egress_with_cidr_blocks = var.computed_egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_egress_with_ipv6_cidr_blocks = var.computed_egress_with_ipv6_cidr_blocks + + # Open for security group id + computed_egress_with_source_security_group_id = var.computed_egress_with_source_security_group_id + + ############################# + # Number of computed egress + ############################# + number_of_computed_egress_rules = var.auto_number_of_computed_egress_rules + var.number_of_computed_egress_rules + number_of_computed_egress_with_self = var.auto_number_of_computed_egress_with_self + var.number_of_computed_egress_with_self + number_of_computed_egress_with_cidr_blocks = var.number_of_computed_egress_with_cidr_blocks + number_of_computed_egress_with_ipv6_cidr_blocks = var.number_of_computed_egress_with_ipv6_cidr_blocks + number_of_computed_egress_with_source_security_group_id = var.number_of_computed_egress_with_source_security_group_id +} diff --git a/modules/alertmanager/outputs.tf b/modules/alertmanager/outputs.tf new file mode 100644 index 00000000..3d7ad67f --- /dev/null +++ b/modules/alertmanager/outputs.tf @@ -0,0 +1,24 @@ +output "this_security_group_id" { + description = "The ID of the security group" + value = module.sg.this_security_group_id +} + +output "this_security_group_vpc_id" { + description = "The VPC ID" + value = module.sg.this_security_group_vpc_id +} + +output "this_security_group_owner_id" { + description = "The owner ID" + value = module.sg.this_security_group_owner_id +} + +output "this_security_group_name" { + description = "The name of the security group" + value = module.sg.this_security_group_name +} + +output "this_security_group_description" { + description = "The description of the security group" + value = module.sg.this_security_group_description +} diff --git a/modules/alertmanager/variables.tf b/modules/alertmanager/variables.tf new file mode 100644 index 00000000..354b9e37 --- /dev/null +++ b/modules/alertmanager/variables.tf @@ -0,0 +1,342 @@ +################# +# Security group +################# +variable "create" { + description = "Whether to create security group and all rules" + type = bool + default = true +} + +variable "vpc_id" { + description = "ID of the VPC where to create security group" + type = string +} + +variable "name" { + description = "Name of security group" + type = string +} + +variable "use_name_prefix" { + description = "Whether to use name_prefix or fixed name. Should be true to able to update security group name after initial creation" + type = bool + default = true +} + +variable "description" { + description = "Description of security group" + type = string + default = "Security Group managed by Terraform" +} + +variable "tags" { + description = "A mapping of tags to assign to security group" + type = map(string) + default = {} +} + +########## +# Ingress +########## +variable "ingress_rules" { + description = "List of ingress rules to create by name" + type = list(string) + default = [] +} + +variable "ingress_with_self" { + description = "List of ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "ingress_with_cidr_blocks" { + description = "List of ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_ipv6_cidr_blocks" { + description = "List of ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_source_security_group_id" { + description = "List of ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules" + type = list(string) + default = [] +} + +################### +# Computed Ingress +################### +variable "computed_ingress_rules" { + description = "List of computed ingress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_ingress_with_self" { + description = "List of computed ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_cidr_blocks" { + description = "List of computed ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_ipv6_cidr_blocks" { + description = "List of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_source_security_group_id" { + description = "List of computed ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = list(string) + default = [] +} + +################################### +# Number of computed ingress rules +################################### +variable "number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_cidr_blocks" { + description = "Number of computed ingress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_ipv6_cidr_blocks" { + description = "Number of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_source_security_group_id" { + description = "Number of computed ingress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = number + default = 0 +} + +######### +# Egress +######### +variable "egress_rules" { + description = "List of egress rules to create by name" + type = list(string) + default = [] +} + +variable "egress_with_self" { + description = "List of egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "egress_with_cidr_blocks" { + description = "List of egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_ipv6_cidr_blocks" { + description = "List of egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_source_security_group_id" { + description = "List of egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all egress rules" + type = list(string) + default = ["::/0"] +} + +variable "egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules" + type = list(string) + default = [] +} + +################## +# Computed Egress +################## +variable "computed_egress_rules" { + description = "List of computed egress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_egress_with_self" { + description = "List of computed egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_cidr_blocks" { + description = "List of computed egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_ipv6_cidr_blocks" { + description = "List of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_source_security_group_id" { + description = "List of computed egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "computed_egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["::/0"] +} + +variable "computed_egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = list(string) + default = [] +} + +################################## +# Number of computed egress rules +################################## +variable "number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_cidr_blocks" { + description = "Number of computed egress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_ipv6_cidr_blocks" { + description = "Number of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_source_security_group_id" { + description = "Number of computed egress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = number + default = 0 +} diff --git a/modules/alertmanager/versions.tf b/modules/alertmanager/versions.tf new file mode 100644 index 00000000..b8569144 --- /dev/null +++ b/modules/alertmanager/versions.tf @@ -0,0 +1,7 @@ +terraform { + required_version = "~> 0.12.6" + + required_providers { + aws = "~> 2.42" + } +} diff --git a/modules/prometheus/README.md b/modules/prometheus/README.md new file mode 100644 index 00000000..0202bca1 --- /dev/null +++ b/modules/prometheus/README.md @@ -0,0 +1,109 @@ +# prometheus - AWS EC2-VPC Security Group Terraform module + +## Usage + +```hcl +module "prometheus_security_group" { + source = "terraform-aws-modules/security-group/aws//modules/prometheus" + version = "~> 3.0" + + # omitted... +} +``` + +All automatic values **prometheus module** is using are available [here](https://github.com/terraform-aws-modules/terraform-aws-security-group/blob/master/modules/prometheus/auto_values.tf). + + +## Requirements + +| Name | Version | +|------|---------| +| terraform | ~> 0.12.6 | +| aws | ~> 2.42 | + +## Providers + +No provider. + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| auto\_computed\_egress\_rules | List of computed egress rules to add automatically | `list(string)` | `[]` | no | +| auto\_computed\_egress\_with\_self | List of maps defining computed egress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_computed\_ingress\_rules | List of ingress rules to add automatically | `list(string)` | `[]` | no | +| auto\_computed\_ingress\_with\_self | List of maps defining computed ingress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_egress\_rules | List of egress rules to add automatically | `list(string)` | 
[
  "all-all"
]
| no | +| auto\_egress\_with\_self | List of maps defining egress rules with self to add automatically | `list(map(string))` | `[]` | no | +| auto\_ingress\_rules | List of ingress rules to add automatically | `list(string)` | 
[
  "prometheus-http-tcp",
  "prometheus-pushgateway-http-tcp"
]
| no | +| auto\_ingress\_with\_self | List of maps defining ingress rules with self to add automatically | `list(map(string))` | 
[
  {
    "rule": "all-all"
  }
]
| no | +| auto\_number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| auto\_number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| computed\_egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed egress rules | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| computed\_egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed egress rules | `list(string)` | 
[
  "::/0"
]
| no | +| computed\_egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `list(string)` | `[]` | no | +| computed\_egress\_rules | List of computed egress rules to create by name | `list(string)` | `[]` | no | +| computed\_egress\_with\_cidr\_blocks | List of computed egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_ipv6\_cidr\_blocks | List of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_self | List of computed egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_egress\_with\_source\_security\_group\_id | List of computed egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `list(string)` | `[]` | no | +| computed\_ingress\_rules | List of computed ingress rules to create by name | `list(string)` | `[]` | no | +| computed\_ingress\_with\_cidr\_blocks | List of computed ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_ipv6\_cidr\_blocks | List of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_self | List of computed ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| computed\_ingress\_with\_source\_security\_group\_id | List of computed ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| create | Whether to create security group and all rules | `bool` | `true` | no | +| description | Description of security group | `string` | `"Security Group managed by Terraform"` | no | +| egress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all egress rules | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| egress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all egress rules | `list(string)` | 
[
  "::/0"
]
| no | +| egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules | `list(string)` | `[]` | no | +| egress\_rules | List of egress rules to create by name | `list(string)` | `[]` | no | +| egress\_with\_cidr\_blocks | List of egress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_ipv6\_cidr\_blocks | List of egress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| egress\_with\_self | List of egress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| egress\_with\_source\_security\_group\_id | List of egress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| ingress\_cidr\_blocks | List of IPv4 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_ipv6\_cidr\_blocks | List of IPv6 CIDR ranges to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules | `list(string)` | `[]` | no | +| ingress\_rules | List of ingress rules to create by name | `list(string)` | `[]` | no | +| ingress\_with\_cidr\_blocks | List of ingress rules to create where 'cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_ipv6\_cidr\_blocks | List of ingress rules to create where 'ipv6\_cidr\_blocks' is used | `list(map(string))` | `[]` | no | +| ingress\_with\_self | List of ingress rules to create where 'self' is defined | `list(map(string))` | `[]` | no | +| ingress\_with\_source\_security\_group\_id | List of ingress rules to create where 'source\_security\_group\_id' is used | `list(map(string))` | `[]` | no | +| name | Name of security group | `string` | n/a | yes | +| number\_of\_computed\_egress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules | `number` | `0` | no | +| number\_of\_computed\_egress\_rules | Number of computed egress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_cidr\_blocks | Number of computed egress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_ipv6\_cidr\_blocks | Number of computed egress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_self | Number of computed egress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_egress\_with\_source\_security\_group\_id | Number of computed egress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_cidr\_blocks | Number of IPv4 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_ipv6\_cidr\_blocks | Number of IPv6 CIDR ranges to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_prefix\_list\_ids | Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules | `number` | `0` | no | +| number\_of\_computed\_ingress\_rules | Number of computed ingress rules to create by name | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_cidr\_blocks | Number of computed ingress rules to create where 'cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_ipv6\_cidr\_blocks | Number of computed ingress rules to create where 'ipv6\_cidr\_blocks' is used | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_self | Number of computed ingress rules to create where 'self' is defined | `number` | `0` | no | +| number\_of\_computed\_ingress\_with\_source\_security\_group\_id | Number of computed ingress rules to create where 'source\_security\_group\_id' is used | `number` | `0` | no | +| tags | A mapping of tags to assign to security group | `map(string)` | `{}` | no | +| use\_name\_prefix | Whether to use name\_prefix or fixed name. Should be true to able to update security group name after initial creation | `bool` | `true` | no | +| vpc\_id | ID of the VPC where to create security group | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| this\_security\_group\_description | The description of the security group | +| this\_security\_group\_id | The ID of the security group | +| this\_security\_group\_name | The name of the security group | +| this\_security\_group\_owner\_id | The owner ID | +| this\_security\_group\_vpc\_id | The VPC ID | + + diff --git a/modules/prometheus/auto_values.tf b/modules/prometheus/auto_values.tf new file mode 100644 index 00000000..e20d0b8c --- /dev/null +++ b/modules/prometheus/auto_values.tf @@ -0,0 +1,79 @@ +# This file was generated from values defined in rules.tf using update_groups.sh. +################################### +# DO NOT CHANGE THIS FILE MANUALLY +################################### + +variable "auto_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = ["prometheus-http-tcp", "prometheus-pushgateway-http-tcp"] +} + +variable "auto_ingress_with_self" { + description = "List of maps defining ingress rules with self to add automatically" + type = list(map(string)) + default = [{ "rule" = "all-all" }] +} + +variable "auto_egress_rules" { + description = "List of egress rules to add automatically" + type = list(string) + default = ["all-all"] +} + +variable "auto_egress_with_self" { + description = "List of maps defining egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Computed +variable "auto_computed_ingress_rules" { + description = "List of ingress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_ingress_with_self" { + description = "List of maps defining computed ingress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +variable "auto_computed_egress_rules" { + description = "List of computed egress rules to add automatically" + type = list(string) + default = [] +} + +variable "auto_computed_egress_with_self" { + description = "List of maps defining computed egress rules with self to add automatically" + type = list(map(string)) + default = [] +} + +# Number of computed rules +variable "auto_number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "auto_number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + diff --git a/modules/prometheus/main.tf b/modules/prometheus/main.tf new file mode 100644 index 00000000..2c85546f --- /dev/null +++ b/modules/prometheus/main.tf @@ -0,0 +1,114 @@ +module "sg" { + source = "../../" + + create = var.create + name = var.name + use_name_prefix = var.use_name_prefix + description = var.description + vpc_id = var.vpc_id + tags = var.tags + + ########## + # Ingress + ########## + # Rules by names - open for default CIDR + ingress_rules = sort(compact(distinct(concat(var.auto_ingress_rules, var.ingress_rules, [""])))) + + # Open for self + ingress_with_self = concat(var.auto_ingress_with_self, var.ingress_with_self) + + # Open to IPv4 cidr blocks + ingress_with_cidr_blocks = var.ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + ingress_with_ipv6_cidr_blocks = var.ingress_with_ipv6_cidr_blocks + + # Open for security group id + ingress_with_source_security_group_id = var.ingress_with_source_security_group_id + + # Default ingress CIDR blocks + ingress_cidr_blocks = var.ingress_cidr_blocks + ingress_ipv6_cidr_blocks = var.ingress_ipv6_cidr_blocks + + # Default prefix list ids + ingress_prefix_list_ids = var.ingress_prefix_list_ids + + ################### + # Computed Ingress + ################### + # Rules by names - open for default CIDR + computed_ingress_rules = sort(compact(distinct(concat(var.auto_computed_ingress_rules, var.computed_ingress_rules, [""])))) + + # Open for self + computed_ingress_with_self = concat(var.auto_computed_ingress_with_self, var.computed_ingress_with_self) + + # Open to IPv4 cidr blocks + computed_ingress_with_cidr_blocks = var.computed_ingress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_ingress_with_ipv6_cidr_blocks = var.computed_ingress_with_ipv6_cidr_blocks + + # Open for security group id + computed_ingress_with_source_security_group_id = var.computed_ingress_with_source_security_group_id + + ############################# + # Number of computed ingress + ############################# + number_of_computed_ingress_rules = var.auto_number_of_computed_ingress_rules + var.number_of_computed_ingress_rules + number_of_computed_ingress_with_self = var.auto_number_of_computed_ingress_with_self + var.number_of_computed_ingress_with_self + number_of_computed_ingress_with_cidr_blocks = var.number_of_computed_ingress_with_cidr_blocks + number_of_computed_ingress_with_ipv6_cidr_blocks = var.number_of_computed_ingress_with_ipv6_cidr_blocks + number_of_computed_ingress_with_source_security_group_id = var.number_of_computed_ingress_with_source_security_group_id + + ######### + # Egress + ######### + # Rules by names - open for default CIDR + egress_rules = sort(compact(distinct(concat(var.auto_egress_rules, var.egress_rules, [""])))) + + # Open for self + egress_with_self = concat(var.auto_egress_with_self, var.egress_with_self) + + # Open to IPv4 cidr blocks + egress_with_cidr_blocks = var.egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + egress_with_ipv6_cidr_blocks = var.egress_with_ipv6_cidr_blocks + + # Open for security group id + egress_with_source_security_group_id = var.egress_with_source_security_group_id + + # Default egress CIDR blocks + egress_cidr_blocks = var.egress_cidr_blocks + egress_ipv6_cidr_blocks = var.egress_ipv6_cidr_blocks + + # Default prefix list ids + egress_prefix_list_ids = var.egress_prefix_list_ids + + ################## + # Computed Egress + ################## + # Rules by names - open for default CIDR + computed_egress_rules = sort(compact(distinct(concat(var.auto_computed_egress_rules, var.computed_egress_rules, [""])))) + + # Open for self + computed_egress_with_self = concat(var.auto_computed_egress_with_self, var.computed_egress_with_self) + + # Open to IPv4 cidr blocks + computed_egress_with_cidr_blocks = var.computed_egress_with_cidr_blocks + + # Open to IPv6 cidr blocks + computed_egress_with_ipv6_cidr_blocks = var.computed_egress_with_ipv6_cidr_blocks + + # Open for security group id + computed_egress_with_source_security_group_id = var.computed_egress_with_source_security_group_id + + ############################# + # Number of computed egress + ############################# + number_of_computed_egress_rules = var.auto_number_of_computed_egress_rules + var.number_of_computed_egress_rules + number_of_computed_egress_with_self = var.auto_number_of_computed_egress_with_self + var.number_of_computed_egress_with_self + number_of_computed_egress_with_cidr_blocks = var.number_of_computed_egress_with_cidr_blocks + number_of_computed_egress_with_ipv6_cidr_blocks = var.number_of_computed_egress_with_ipv6_cidr_blocks + number_of_computed_egress_with_source_security_group_id = var.number_of_computed_egress_with_source_security_group_id +} diff --git a/modules/prometheus/outputs.tf b/modules/prometheus/outputs.tf new file mode 100644 index 00000000..3d7ad67f --- /dev/null +++ b/modules/prometheus/outputs.tf @@ -0,0 +1,24 @@ +output "this_security_group_id" { + description = "The ID of the security group" + value = module.sg.this_security_group_id +} + +output "this_security_group_vpc_id" { + description = "The VPC ID" + value = module.sg.this_security_group_vpc_id +} + +output "this_security_group_owner_id" { + description = "The owner ID" + value = module.sg.this_security_group_owner_id +} + +output "this_security_group_name" { + description = "The name of the security group" + value = module.sg.this_security_group_name +} + +output "this_security_group_description" { + description = "The description of the security group" + value = module.sg.this_security_group_description +} diff --git a/modules/prometheus/variables.tf b/modules/prometheus/variables.tf new file mode 100644 index 00000000..354b9e37 --- /dev/null +++ b/modules/prometheus/variables.tf @@ -0,0 +1,342 @@ +################# +# Security group +################# +variable "create" { + description = "Whether to create security group and all rules" + type = bool + default = true +} + +variable "vpc_id" { + description = "ID of the VPC where to create security group" + type = string +} + +variable "name" { + description = "Name of security group" + type = string +} + +variable "use_name_prefix" { + description = "Whether to use name_prefix or fixed name. Should be true to able to update security group name after initial creation" + type = bool + default = true +} + +variable "description" { + description = "Description of security group" + type = string + default = "Security Group managed by Terraform" +} + +variable "tags" { + description = "A mapping of tags to assign to security group" + type = map(string) + default = {} +} + +########## +# Ingress +########## +variable "ingress_rules" { + description = "List of ingress rules to create by name" + type = list(string) + default = [] +} + +variable "ingress_with_self" { + description = "List of ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "ingress_with_cidr_blocks" { + description = "List of ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_ipv6_cidr_blocks" { + description = "List of ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_with_source_security_group_id" { + description = "List of ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all ingress rules" + type = list(string) + default = [] +} + +variable "ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all ingress rules" + type = list(string) + default = [] +} + +################### +# Computed Ingress +################### +variable "computed_ingress_rules" { + description = "List of computed ingress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_ingress_with_self" { + description = "List of computed ingress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_cidr_blocks" { + description = "List of computed ingress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_ipv6_cidr_blocks" { + description = "List of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_with_source_security_group_id" { + description = "List of computed ingress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_ingress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed ingress rules" + type = list(string) + default = [] +} + +variable "computed_ingress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = list(string) + default = [] +} + +################################### +# Number of computed ingress rules +################################### +variable "number_of_computed_ingress_rules" { + description = "Number of computed ingress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_self" { + description = "Number of computed ingress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_cidr_blocks" { + description = "Number of computed ingress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_ipv6_cidr_blocks" { + description = "Number of computed ingress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_with_source_security_group_id" { + description = "Number of computed ingress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_ingress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed ingress rules" + type = number + default = 0 +} + +variable "number_of_computed_ingress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed ingress rules" + type = number + default = 0 +} + +######### +# Egress +######### +variable "egress_rules" { + description = "List of egress rules to create by name" + type = list(string) + default = [] +} + +variable "egress_with_self" { + description = "List of egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "egress_with_cidr_blocks" { + description = "List of egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_ipv6_cidr_blocks" { + description = "List of egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "egress_with_source_security_group_id" { + description = "List of egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all egress rules" + type = list(string) + default = ["::/0"] +} + +variable "egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all egress rules" + type = list(string) + default = [] +} + +################## +# Computed Egress +################## +variable "computed_egress_rules" { + description = "List of computed egress rules to create by name" + type = list(string) + default = [] +} + +variable "computed_egress_with_self" { + description = "List of computed egress rules to create where 'self' is defined" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_cidr_blocks" { + description = "List of computed egress rules to create where 'cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_ipv6_cidr_blocks" { + description = "List of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_with_source_security_group_id" { + description = "List of computed egress rules to create where 'source_security_group_id' is used" + type = list(map(string)) + default = [] +} + +variable "computed_egress_cidr_blocks" { + description = "List of IPv4 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "computed_egress_ipv6_cidr_blocks" { + description = "List of IPv6 CIDR ranges to use on all computed egress rules" + type = list(string) + default = ["::/0"] +} + +variable "computed_egress_prefix_list_ids" { + description = "List of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = list(string) + default = [] +} + +################################## +# Number of computed egress rules +################################## +variable "number_of_computed_egress_rules" { + description = "Number of computed egress rules to create by name" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_self" { + description = "Number of computed egress rules to create where 'self' is defined" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_cidr_blocks" { + description = "Number of computed egress rules to create where 'cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_ipv6_cidr_blocks" { + description = "Number of computed egress rules to create where 'ipv6_cidr_blocks' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_with_source_security_group_id" { + description = "Number of computed egress rules to create where 'source_security_group_id' is used" + type = number + default = 0 +} + +variable "number_of_computed_egress_cidr_blocks" { + description = "Number of IPv4 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_ipv6_cidr_blocks" { + description = "Number of IPv6 CIDR ranges to use on all computed egress rules" + type = number + default = 0 +} + +variable "number_of_computed_egress_prefix_list_ids" { + description = "Number of prefix list IDs (for allowing access to VPC endpoints) to use on all computed egress rules" + type = number + default = 0 +} diff --git a/modules/prometheus/versions.tf b/modules/prometheus/versions.tf new file mode 100644 index 00000000..b8569144 --- /dev/null +++ b/modules/prometheus/versions.tf @@ -0,0 +1,7 @@ +terraform { + required_version = "~> 0.12.6" + + required_providers { + aws = "~> 2.42" + } +} diff --git a/rules.tf b/rules.tf index 77674bc3..f88bb418 100644 --- a/rules.tf +++ b/rules.tf @@ -11,7 +11,7 @@ variable "rules" { activemq-61614-tcp = [61614, 61614, "tcp", "ActiveMQ STOMP"] activemq-61617-tcp = [61617, 61617, "tcp", "ActiveMQ OpenWire"] activemq-61619-tcp = [61619, 61619, "tcp", "ActiveMQ WebSocket"] - # Alert Manager + # Alert Manager alertmanager-9093-tcp = [9093, 9093, "tcp", "Alert Manager"] alertmanager-9094-tcp = [9094, 9094, "tcp", "Alert Manager Cluster"] # Carbon relay @@ -107,8 +107,8 @@ variable "rules" { # Puppet puppet-tcp = [8140, 8140, "tcp", "Puppet"] puppetdb-tcp = [8081, 8081, "tcp", "PuppetDB"] - # Prometheus - prometheus-http-tcp = [9090, 9090, "tcp", "Prometheus"] + # Prometheus + prometheus-http-tcp = [9090, 9090, "tcp", "Prometheus"] prometheus-pushgateway-http-tcp = [9091, 9091, "tcp", "Prometheus Pushgateway"] # Oracle Database oracle-db-tcp = [1521, 1521, "tcp", "Oracle"]