terraform-study21/securitygroup.tf at main · shu130/terraform-study21 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
# ./securitygroup.tf

# ALB用
resource "aws_security_group" "alb_sg" {
  vpc_id = aws_vpc.vpc03.id
  name   = "${var.vpc_name}-alb-sg"
  description = "Allow HTTP traffic to ALB"

  # Ingress：HTTPアクセス許可
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Egress：全ての通信を許可
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.vpc_name}-alb-sg"
  }
}

# EC2用
resource "aws_security_group" "ec2_sg" {
  vpc_id = aws_vpc.vpc03.id
  name   = "${var.vpc_name}-ec2-sg"
  description = "Allow traffic to EC2 instances from ALB"

  # Ingress：ALBからのHTTP通信のみ許可
  ingress {
    from_port   = 80
    to_port     = 80
    protocol    = "tcp"
    security_groups = [aws_security_group.alb_sg.id]
  }

  # Ingress：SSHアクセスを全体から許可
  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  # Egress (アウトバウンド) - 全ての通信を許可
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.vpc_name}-ec2-sg"
  }
}

# RDS用セキュリティグループ（EC2からのMySQL通信を許可）
resource "aws_security_group" "rds_sg" {
  vpc_id = aws_vpc.vpc03.id
  name   = "${var.vpc_name}-rds-sg"
  description = "Allow MySQL traffic to RDS from EC2 instances"

  # Ingress (インバウンド) - EC2からのMySQL通信のみ許可
  ingress {
    from_port   = 3306
    to_port     = 3306
    protocol    = "tcp"
    security_groups = [aws_security_group.ec2_sg.id]
  }

  # Egress (アウトバウンド) - 全ての通信を許可
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = {
    Name = "${var.vpc_name}-rds-sg"
  }
}