Skip to content

Commit bff35df

Browse files
clouddrove-ciclouddrove-ci
committed
update README.md
1 parent 36989a8 commit bff35df

File tree

1 file changed

+213
-75
lines changed

1 file changed

+213
-75
lines changed

‎README.md

+213-75
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55

66
<h1 align="center">
7-
Terraform Module Security-Group
7+
Terraform AWS Subnet
88
</h1>
99

1010
<p align="center" style="font-size: 1.2rem;">
@@ -30,10 +30,10 @@
3030
<a href='https://facebook.com/sharer/sharer.php?u=https://github.com/clouddrove/terraform-aws-security-group'>
3131
<img title="Share on Facebook" src="https://user-images.githubusercontent.com/50652676/62817743-4f64cb80-bb59-11e9-90c7-b057252ded50.png" />
3232
</a>
33-
<a href='https://www.linkedin.com/shareArticle?mini=true&title=Terraform+Module+Security-Group&url=https://github.com/clouddrove/terraform-aws-security-group'>
33+
<a href='https://www.linkedin.com/shareArticle?mini=true&title=Terraform+AWS+Subnet&url=https://github.com/clouddrove/terraform-aws-security-group'>
3434
<img title="Share on LinkedIn" src="https://user-images.githubusercontent.com/50652676/62817742-4e339e80-bb59-11e9-87b9-a1f68cae1049.png" />
3535
</a>
36-
<a href='https://twitter.com/intent/tweet/?text=Terraform+Module+Security-Group&url=https://github.com/clouddrove/terraform-aws-security-group'>
36+
<a href='https://twitter.com/intent/tweet/?text=Terraform+AWS+Subnet&url=https://github.com/clouddrove/terraform-aws-security-group'>
3737
<img title="Share on Twitter" src="https://user-images.githubusercontent.com/50652676/62817740-4c69db00-bb59-11e9-8a79-3580fbbf6d5c.png" />
3838
</a>
3939

@@ -53,6 +53,8 @@ We have [*fifty plus terraform modules*][terraform_modules]. A few of them are c
5353
## Prerequisites
5454

5555
This module has a few dependencies:
56+
- [Terraform 1.5.4](https://learn.hashicorp.com/terraform/getting-started/install.html)
57+
5658

5759

5860

@@ -66,75 +68,200 @@ This module has a few dependencies:
6668

6769

6870
Here are some examples of how you can use this module in your inventory structure:
69-
### NEW_SECURITY_GROUP
71+
### Basic
7072
Here is an example of how you can use this module in your inventory structure:
7173
```hcl
7274
# use this
7375
module "security_group" {
74-
source = "clouddrove/security-group/aws"
75-
version = "1.3.0"
76-
name = "security-group"
76+
source = "clouddrove/security-group/aws"
77+
version = "2.0.0"
78+
name = "app"
7779
environment = "test"
78-
label_order = ["name", "environment"]
79-
80-
vpc_id = module.vpc.vpc_id
81-
new_enable_security_group = true
82-
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
83-
allowed_ports = [22, 27017]
84-
security_groups = []
85-
max_entries = 5
86-
prefix_list_enabled = true
87-
prefix_list_id = []
88-
entry = [
89-
{
90-
cidr = "10.0.0.0/16"
91-
description = "VPC CIDR"
80+
vpc_id = module.vpc.vpc_id
81+
82+
## INGRESS Rules
83+
new_sg_ingress_rules_with_cidr_blocks = [{
84+
rule_count = 1
85+
from_port = 22
86+
protocol = "tcp"
87+
to_port = 22
88+
cidr_blocks = [module.vpc.vpc_cidr_block, "172.16.0.0/16"]
89+
description = "Allow ssh traffic."
9290
},
9391
{
94-
cidr = "10.10.0.0/24"
95-
description = "VPC CIDR"
92+
rule_count = 2
93+
from_port = 27017
94+
protocol = "tcp"
95+
to_port = 27017
96+
cidr_blocks = ["172.16.0.0/16"]
97+
description = "Allow Mongodb traffic."
9698
}
9799
]
100+
101+
## EGRESS Rules
102+
new_sg_egress_rules_with_cidr_blocks = [{
103+
rule_count = 1
104+
from_port = 22
105+
protocol = "tcp"
106+
to_port = 22
107+
cidr_blocks = [module.vpc.vpc_cidr_block, "172.16.0.0/16"]
108+
description = "Allow ssh outbound traffic."
109+
},
110+
{
111+
rule_count = 2
112+
from_port = 27017
113+
protocol = "tcp"
114+
to_port = 27017
115+
cidr_blocks = ["172.16.0.0/16"]
116+
description = "Allow Mongodb outbound traffic."
117+
}]
98118
}
99119
```
100-
### NEW_SECURITY_GROUP_WITH_EGRESS
101-
module "security_group" {
120+
121+
### ONLY RULES
122+
module "security_group_rules" {
102123
source = "clouddrove/security-group/aws"
103-
version = "1.3.0"
104-
name = "security-group"
105-
environment = "test"
106-
label_order = ["name", "environment"]
107-
108-
vpc_id = module.vpc.vpc_id
109-
prefix_list_enabled = false
110-
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
111-
allowed_ipv6 = ["2405:201:5e00:3684:cd17:9397:5734:a167/128"]
112-
allowed_ports = [22, 27017]
113-
security_groups = ["sg-xxxxxxxxx"]
114-
prefix_list_id = ["pl-6da54004"]
115-
egress_rule = true
116-
egress_allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
117-
egress_allowed_ports = [22, 27017]
118-
egress_protocol = "tcp"
119-
egress_prefix_list_ids = ["pl-xxxxxxxxx"]
120-
egress_security_groups = ["sg-xxxxxxxxx"]
124+
version = "2.0.0"
125+
name = "app"
126+
environment = "test"
127+
vpc_id = "vpc-xxxxxxxxx"
128+
new_sg = false
129+
existing_sg_id = "sg-xxxxxxxxx"
130+
131+
## INGRESS Rules
132+
existing_sg_ingress_rules_with_cidr_blocks = [{
133+
rule_count = 1
134+
from_port = 22
135+
protocol = "tcp"
136+
to_port = 22
137+
cidr_blocks = ["10.9.0.0/16"]
138+
description = "Allow ssh traffic."
139+
},
140+
{
141+
rule_count = 2
142+
from_port = 27017
143+
protocol = "tcp"
144+
to_port = 27017
145+
cidr_blocks = ["10.9.0.0/16"]
146+
description = "Allow Mongodb traffic."
147+
}
148+
]
149+
150+
existing_sg_ingress_rules_with_self = [{
151+
rule_count = 1
152+
from_port = 22
153+
protocol = "tcp"
154+
to_port = 22
155+
description = "Allow ssh traffic."
156+
},
157+
{
158+
rule_count = 2
159+
from_port = 27017
160+
protocol = "tcp"
161+
to_port = 27017
162+
description = "Allow Mongodb traffic."
163+
}
164+
]
121165

166+
existing_sg_ingress_rules_with_source_sg_id = [{
167+
rule_count = 1
168+
from_port = 22
169+
protocol = "tcp"
170+
to_port = 22
171+
source_security_group_id = "sg-xxxxxxxxx"
172+
description = "Allow ssh traffic."
173+
},
174+
{
175+
rule_count = 2
176+
from_port = 27017
177+
protocol = "tcp"
178+
to_port = 27017
179+
source_security_group_id = "sg-xxxxxxxxx"
180+
description = "Allow Mongodb traffic."
181+
}]
182+
183+
## EGRESS Rules
184+
existing_sg_egress_rules_with_cidr_blocks = [{
185+
rule_count = 1
186+
from_port = 22
187+
protocol = "tcp"
188+
to_port = 22
189+
cidr_blocks = ["10.9.0.0/16"]
190+
description = "Allow ssh outbound traffic."
191+
},
192+
{
193+
rule_count = 2
194+
from_port = 27017
195+
protocol = "tcp"
196+
to_port = 27017
197+
cidr_blocks = ["10.9.0.0/16"]
198+
description = "Allow Mongodb outbound traffic."
199+
}]
200+
201+
existing_sg_egress_rules_with_self = [{
202+
rule_count = 1
203+
from_port = 22
204+
protocol = "tcp"
205+
to_port = 22
206+
description = "Allow ssh outbound traffic."
207+
},
208+
{
209+
rule_count = 2
210+
from_port = 27017
211+
protocol = "tcp"
212+
to_port = 27017
213+
description = "Allow Mongodb outbound traffic."
214+
}]
215+
216+
existing_sg_egress_rules_with_source_sg_id = [{
217+
rule_count = 1
218+
from_port = 22
219+
protocol = "tcp"
220+
to_port = 22
221+
source_security_group_id = "sg-xxxxxxxxx"
222+
description = "Allow ssh outbound traffic."
223+
},
224+
{
225+
rule_count = 2
226+
from_port = 27017
227+
protocol = "tcp"
228+
to_port = 27017
229+
source_security_group_id = "sg-xxxxxxxxx"
230+
description = "Allow Mongodb outbound traffic."
231+
}]
122232
}
123233
```
124-
### UPDATED_EXISTING
125-
module "security_group" {
126-
source = "clouddrove/security-group/aws"
127-
version = "1.3.0"
128-
name = "security-group"
129-
environment = "test"
130-
label_order = ["name", "environment"]
131-
132-
is_external = true
133-
existing_sg_id = "sg-xxxxxxxxxxxx"
134-
vpc_id = module.vpc.vpc_id
135-
allowed_ip = ["172.16.0.0/16", "10.0.0.0/16"]
136-
allowed_ports = [22, 27017]
137-
security_groups = ["sg-xxxxxxxxxxxxx"]
234+
235+
### PREFIX LIST
236+
module "security_group" {
237+
source = "clouddrove/security-group/aws"
238+
version = "2.0.0"
239+
name = "app"
240+
environment = "test"
241+
vpc_id = module.vpc.vpc_id
242+
prefix_list_enabled = true
243+
entry = [{
244+
cidr = "10.19.0.0/16"
245+
}]
246+
247+
## INGRESS Rules
248+
new_sg_ingress_rules_with_prefix_list = [{
249+
rule_count = 1
250+
from_port = 22
251+
protocol = "tcp"
252+
to_port = 22
253+
description = "Allow ssh traffic."
254+
}
255+
]
256+
## EGRESS Rules
257+
new_sg_egress_rules_with_prefix_list = [{
258+
rule_count = 1
259+
from_port = 3306
260+
protocol = "tcp"
261+
to_port = 3306
262+
description = "Allow mysql/aurora outbound traffic."
263+
}
264+
]
138265
}
139266
```
140267

@@ -147,35 +274,46 @@ module "security_group" {
147274

148275
| Name | Description | Type | Default | Required |
149276
|------|-------------|------|---------|:--------:|
150-
| allowed\_ip | List of allowed ip. | `list(any)` | `[]` | no |
151-
| allowed\_ipv6 | List of allowed ipv6. | `list(any)` | <pre>[<br> "2405:201:5e00:3684:cd17:9397:5734:a167/128"<br>]</pre> | no |
152-
| allowed\_ports | List of allowed ingress ports | `list(any)` | `[]` | no |
153-
| egress\_allowed\_ip | List of allowed ip. | `list(any)` | `[]` | no |
154-
| egress\_allowed\_ports | List of allowed ingress ports | `list(any)` | `[]` | no |
155-
| egress\_prefix\_list\_ids | List of prefix list IDs (for allowing access to VPC endpoints)Only valid with egress | `list(any)` | `[]` | no |
156-
| egress\_protocol | The protocol. If not icmp, tcp, udp, or all use the. | `string` | `"tcp"` | no |
157-
| egress\_rule | Enable to create egress rule | `bool` | `false` | no |
158-
| egress\_security\_groups | List of Security Group IDs allowed to connect to the instance. | `list(string)` | `[]` | no |
277+
| enable | Flag to control module creation. | `bool` | `true` | no |
159278
| entry | Can be specified multiple times for each prefix list entry. | `list(any)` | `[]` | no |
160279
| environment | Environment (e.g. `prod`, `dev`, `staging`). | `string` | `""` | no |
280+
| existing\_sg\_egress\_rules\_with\_cidr\_blocks | Ingress rules with only cidr block. Should be used when there is existing security group. | `any` | `{}` | no |
281+
| existing\_sg\_egress\_rules\_with\_prefix\_list | Egress rules with only prefic ist ids. Should be used when there is existing security group. | `any` | `{}` | no |
282+
| existing\_sg\_egress\_rules\_with\_self | Egress rules with only self. Should be used when there is existing security group. | `any` | `{}` | no |
283+
| existing\_sg\_egress\_rules\_with\_source\_sg\_id | Egress rules with only source security group id. Should be used when there is existing security group. | `any` | `{}` | no |
161284
| existing\_sg\_id | Provide existing security group id for updating existing rule | `string` | `null` | no |
162-
| is\_external | enable to udated existing security Group | `bool` | `false` | no |
163-
| label\_order | Label order, e.g. `name`,`application`. | `list(any)` | `[]` | no |
285+
| existing\_sg\_ingress\_rules\_with\_cidr\_blocks | Ingress rules with only cidr blocks. Should be used when there is existing security group. | `any` | `{}` | no |
286+
| existing\_sg\_ingress\_rules\_with\_prefix\_list | Ingress rules with only prefix\_list. Should be used when new security group is been deployed. | `any` | `{}` | no |
287+
| existing\_sg\_ingress\_rules\_with\_self | Ingress rules with only source security group id. Should be used when new security group is been deployed. | `any` | `{}` | no |
288+
| existing\_sg\_ingress\_rules\_with\_source\_sg\_id | Ingress rules with only prefix list ids. Should be used when there is existing security group. | `any` | `{}` | no |
289+
| label\_order | Label order, e.g. `name`,`application`. | `list(any)` | <pre>[<br> "name",<br> "environment"<br>]</pre> | no |
290+
| managedby | ManagedBy, eg 'CloudDrove'. | `string` | `"[email protected]"` | no |
164291
| max\_entries | The maximum number of entries that this prefix list can contain. | `number` | `5` | no |
165292
| name | Name (e.g. `app` or `cluster`). | `string` | `""` | no |
166-
| new\_enable\_security\_group | Enable default Security Group with only Egress traffic allowed. | `bool` | `true` | no |
167-
| prefix\_list\_enabled | Enable prefix\_list. | `bool` | `true` | no |
168-
| prefix\_list\_id | The ID of the prefix list. | `list(string)` | `[]` | no |
169-
| security\_groups | List of Security Group IDs allowed to connect to the instance. | `list(string)` | `[]` | no |
293+
| new\_sg | Flag to control creation of new security group. | `bool` | `true` | no |
294+
| new\_sg\_egress\_rules\_with\_cidr\_blocks | Egress rules with only cidr\_blockd. Should be used when new security group is been deployed. | `any` | `{}` | no |
295+
| new\_sg\_egress\_rules\_with\_prefix\_list | Egress rules with only prefix list ids. Should be used when new security group is been deployed. | `any` | `{}` | no |
296+
| new\_sg\_egress\_rules\_with\_self | Egress rules with only self. Should be used when new security group is been deployed. | `any` | `{}` | no |
297+
| new\_sg\_egress\_rules\_with\_source\_sg\_id | Egress rules with only source security group id. Should be used when new security group is been deployed. | `any` | `{}` | no |
298+
| new\_sg\_ingress\_rules\_with\_cidr\_blocks | Ingress rules with only cidr blocks. Should be used when new security group is been deployed. | `any` | `{}` | no |
299+
| new\_sg\_ingress\_rules\_with\_prefix\_list | Ingress rules with only prefix list ids. Should be used when new security group is been deployed. | `any` | `{}` | no |
300+
| new\_sg\_ingress\_rules\_with\_self | Ingress rules with only self. Should be used when new security group is been deployed. | `any` | `{}` | no |
301+
| new\_sg\_ingress\_rules\_with\_source\_sg\_id | Ingress rules with only source security group id. Should be used when new security group is been deployed. | `any` | `{}` | no |
302+
| prefix\_list\_address\_family | (Required, Forces new resource) The address family (IPv4 or IPv6) of prefix list. | `string` | `"IPv4"` | no |
303+
| prefix\_list\_enabled | Enable prefix\_list. | `bool` | `false` | no |
304+
| prefix\_list\_ids | The ID of the prefix list. | `list(string)` | `[]` | no |
305+
| repository | Terraform current module repo | `string` | `"https://github.com/clouddrove/terraform-aws-security-group"` | no |
306+
| sg\_description | Security group description. Defaults to Managed by Terraform. Cannot be empty string. NOTE: This field maps to the AWS GroupDescription attribute, for which there is no Update API. If you'd like to classify your security groups in a way that can be updated, use tags. | `string` | `null` | no |
170307
| vpc\_id | The ID of the VPC that the instance security group belongs to. | `string` | `""` | no |
171308

172309
## Outputs
173310

174311
| Name | Description |
175312
|------|-------------|
176-
| prefix\_id | n/a |
177-
| security\_group\_ids | A mapping of security group ids. |
178-
| tags | A mapping of tags to assign to the resource. |
313+
| prefix\_list\_id | The ID of the prefix list. |
314+
| security\_group\_arn | IDs on the AWS Security Groups associated with the instance. |
315+
| security\_group\_id | IDs on the AWS Security Groups associated with the instance. |
316+
| security\_group\_tags | A mapping of public tags to assign to the resource. |
179317

180318

181319

0 commit comments

Comments
 (0)