Skip to content

Commit 05bb4e8

Browse files
bryantbiggsbryantbiggs
committed
fix: Switch from the prior single aws_security_group_rule to separate aws_security_group_ingress_rule/aws_security_group_egress_rule 
1 parent c280e4c commit 05bb4e8

File tree

12 files changed

+192
-75
lines changed

12 files changed

+192
-75
lines changed

‎README.md‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -29,19 +29,19 @@ module "cluster" {
2929
instance_class = "db.r6g.large"
3030
instances = {
3131
one = {}
32-
2 = {
32+
two = {
3333
instance_class = "db.r6g.2xlarge"
3434
}
3535
}
3636
3737
vpc_id = "vpc-12345678"
3838
db_subnet_group_name = "db-subnet-group"
39-
security_group_rules = {
39+
security_group_ingress_rules = {
4040
ex1_ingress = {
41-
cidr_blocks = ["10.20.0.0/20"]
41+
cidr_ipv4 = "10.20.0.0/20"
4242
}
4343
ex1_ingress = {
44-
source_security_group_id = "sg-12345678"
44+
referenced_security_group_id = "sg-12345678"
4545
}
4646
}
4747
@@ -288,7 +288,8 @@ No modules.
288288
| [aws_rds_shard_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_shard_group) | resource |
289289
| [aws_secretsmanager_secret_rotation.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_rotation) | resource |
290290
| [aws_security_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
291-
| [aws_security_group_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource |
291+
| [aws_vpc_security_group_egress_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_egress_rule) | resource |
292+
| [aws_vpc_security_group_ingress_rule.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/vpc_security_group_ingress_rule) | resource |
292293
| [aws_iam_policy_document.monitoring_rds_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
293294
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
294295
| [aws_service_principal.monitoring_rds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/service_principal) | data source |
@@ -394,8 +395,9 @@ No modules.
394395
| <a name="input_s3_import"></a> [s3\_import](#input\_s3\_import) | Configuration map used to restore from a Percona Xtrabackup in S3 (only MySQL is supported) | <pre>object({<br/> bucket_name = string<br/> bucket_prefix = optional(string)<br/> ingestion_role = string<br/> source_engine_version = string<br/> })</pre> | `null` | no |
395396
| <a name="input_scaling_configuration"></a> [scaling\_configuration](#input\_scaling\_configuration) | Map of nested attributes with scaling properties. Only valid when `engine_mode` is set to `serverless` | <pre>object({<br/> auto_pause = optional(bool)<br/> max_capacity = optional(number)<br/> min_capacity = optional(number)<br/> seconds_before_timeout = optional(number)<br/> seconds_until_auto_pause = optional(number)<br/> timeout_action = optional(string)<br/> })</pre> | `null` | no |
396397
| <a name="input_security_group_description"></a> [security\_group\_description](#input\_security\_group\_description) | The description of the security group. If value is set to empty string it will contain cluster name in the description | `string` | `null` | no |
398+
| <a name="input_security_group_egress_rules"></a> [security\_group\_egress\_rules](#input\_security\_group\_egress\_rules) | Map of security group egress rules to add to the security group created | <pre>map(object({<br/> name = optional(string)<br/><br/> cidr_ipv4 = optional(string)<br/> cidr_ipv6 = optional(string)<br/> description = optional(string)<br/> from_port = optional(number)<br/> ip_protocol = optional(string, "tcp")<br/> prefix_list_id = optional(string)<br/> referenced_security_group_id = optional(string)<br/> region = optional(string)<br/> tags = optional(map(string), {})<br/> to_port = optional(number)<br/> }))</pre> | `{}` | no |
399+
| <a name="input_security_group_ingress_rules"></a> [security\_group\_ingress\_rules](#input\_security\_group\_ingress\_rules) | Map of security group ingress rules to add to the security group created | <pre>map(object({<br/> name = optional(string)<br/><br/> cidr_ipv4 = optional(string)<br/> cidr_ipv6 = optional(string)<br/> description = optional(string)<br/> from_port = optional(number)<br/> ip_protocol = optional(string, "tcp")<br/> prefix_list_id = optional(string)<br/> referenced_security_group_id = optional(string)<br/> region = optional(string)<br/> tags = optional(map(string), {})<br/> to_port = optional(number)<br/> }))</pre> | `{}` | no |
397400
| <a name="input_security_group_name"></a> [security\_group\_name](#input\_security\_group\_name) | The security group name. Default value is (`var.name`) | `string` | `""` | no |
398-
| <a name="input_security_group_rules"></a> [security\_group\_rules](#input\_security\_group\_rules) | Map of security group rules to add to the cluster security group created | `any` | `{}` | no |
399401
| <a name="input_security_group_tags"></a> [security\_group\_tags](#input\_security\_group\_tags) | Additional tags for the security group | `map(string)` | `{}` | no |
400402
| <a name="input_security_group_use_name_prefix"></a> [security\_group\_use\_name\_prefix](#input\_security\_group\_use\_name\_prefix) | Determines whether the security group name (`var.name`) is used as a prefix | `bool` | `true` | no |
401403
| <a name="input_serverlessv2_scaling_configuration"></a> [serverlessv2\_scaling\_configuration](#input\_serverlessv2\_scaling\_configuration) | Map of nested attributes with serverless v2 scaling properties. Only valid when `engine_mode` is set to `provisioned` | <pre>object({<br/> max_capacity = number<br/> min_capacity = optional(number)<br/> seconds_until_auto_pause = optional(number)<br/> })</pre> | `null` | no |

‎docs/UPGRADE-10.0.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ If you find a bug, please open an issue with supporting configuration to reprodu
99
- AWS provider `v6.18` is now minimum supported version
1010
- The underlying `aws_security_group_rule` resources has been replaced with `aws_vpc_security_group_ingress_rule` and `aws_vpc_security_group_egress_rule` to allow for more flexibility in defining security group rules.
1111
- `master_password` is no longer supported and only the write-only equivalent is supported (`master_password_wo` and `master_password_wo_version`) ([#513](https://github.com/terraform-aws-modules/terraform-aws-rds-aurora/pull/513))
12+
- `security_group_rules` has been split into `security_group_ingress_rules` and `security_group_egress_rules` to better match the AWS API and allow for more flexibility in defining security group rules
1213

1314
## Additional changes
1415

‎examples/autoscaling/main.tf‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,15 @@ module "aurora" {
3434

3535
vpc_id = module.vpc.vpc_id
3636
db_subnet_group_name = module.vpc.database_subnet_group_name
37-
security_group_rules = {
38-
vpc_ingress = {
39-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
37+
security_group_ingress_rules = {
38+
private-az1 = {
39+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
40+
}
41+
private-az2 = {
42+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
43+
}
44+
private-az3 = {
45+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
4046
}
4147
}
4248

‎examples/global-cluster/main.tf‎

Lines changed: 18 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -55,9 +55,15 @@ module "aurora_primary" {
5555

5656
vpc_id = module.primary_vpc.vpc_id
5757
db_subnet_group_name = module.primary_vpc.database_subnet_group_name
58-
security_group_rules = {
59-
vpc_ingress = {
60-
cidr_blocks = module.primary_vpc.private_subnets_cidr_blocks
58+
security_group_ingress_rules = {
59+
private-az1 = {
60+
cidr_ipv4 = element(module.primary_vpc.private_subnets_cidr_blocks, 0)
61+
}
62+
private-az2 = {
63+
cidr_ipv4 = element(module.primary_vpc.private_subnets_cidr_blocks, 1)
64+
}
65+
private-az3 = {
66+
cidr_ipv4 = element(module.primary_vpc.private_subnets_cidr_blocks, 2)
6167
}
6268
}
6369

@@ -88,9 +94,15 @@ module "aurora_secondary" {
8894

8995
vpc_id = module.secondary_vpc.vpc_id
9096
db_subnet_group_name = module.secondary_vpc.database_subnet_group_name
91-
security_group_rules = {
92-
vpc_ingress = {
93-
cidr_blocks = module.secondary_vpc.private_subnets_cidr_blocks
97+
security_group_ingress_rules = {
98+
private-az1 = {
99+
cidr_ipv4 = element(module.secondary_vpc.private_subnets_cidr_blocks, 0)
100+
}
101+
private-az2 = {
102+
cidr_ipv4 = element(module.secondary_vpc.private_subnets_cidr_blocks, 1)
103+
}
104+
private-az3 = {
105+
cidr_ipv4 = element(module.secondary_vpc.private_subnets_cidr_blocks, 2)
94106
}
95107
}
96108

‎examples/limitless/main.tf‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -49,14 +49,15 @@ module "aurora" {
4949

5050
vpc_id = module.vpc.vpc_id
5151
db_subnet_group_name = module.vpc.database_subnet_group_name
52-
security_group_rules = {
53-
vpc_ingress = {
54-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
52+
security_group_ingress_rules = {
53+
private-az1 = {
54+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
5555
}
56-
egress_example = {
57-
type = "egress"
58-
cidr_blocks = ["10.33.0.0/28"]
59-
description = "Egress to corporate printer closet"
56+
private-az2 = {
57+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
58+
}
59+
private-az3 = {
60+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
6061
}
6162
}
6263

‎examples/mysql/main.tf‎

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -47,15 +47,21 @@ module "aurora" {
4747

4848
vpc_id = module.vpc.vpc_id
4949
db_subnet_group_name = module.vpc.database_subnet_group_name
50-
security_group_rules = {
51-
vpc_ingress = {
52-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
50+
security_group_ingress_rules = {
51+
private-az1 = {
52+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
53+
}
54+
private-az2 = {
55+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
5356
}
54-
kms_vpc_endpoint = {
55-
type = "egress"
56-
from_port = 443
57-
to_port = 443
58-
source_security_group_id = module.vpc_endpoints.security_group_id
57+
private-az3 = {
58+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
59+
}
60+
}
61+
security_group_egress_rules = {
62+
kms-vpc-endpoint = {
63+
to_port = 443
64+
referenced_security_group_id = module.vpc_endpoints.security_group_id
5965
}
6066
}
6167

‎examples/postgresql/main.tf‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,15 @@ module "aurora" {
6666

6767
vpc_id = module.vpc.vpc_id
6868
db_subnet_group_name = module.vpc.database_subnet_group_name
69-
security_group_rules = {
70-
vpc_ingress = {
71-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
69+
security_group_ingress_rules = {
70+
private-az1 = {
71+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
7272
}
73-
egress_example = {
74-
type = "egress"
75-
cidr_blocks = ["10.33.0.0/28"]
76-
description = "Egress to corporate printer closet"
73+
private-az2 = {
74+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
75+
}
76+
private-az3 = {
77+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
7778
}
7879
}
7980

‎examples/s3-import/main.tf‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,15 @@ module "aurora" {
3434

3535
vpc_id = module.vpc.vpc_id
3636
db_subnet_group_name = module.vpc.database_subnet_group_name
37-
security_group_rules = {
38-
vpc_ingress = {
39-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
37+
security_group_ingress_rules = {
38+
private-az1 = {
39+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
40+
}
41+
private-az2 = {
42+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
43+
}
44+
private-az3 = {
45+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
4046
}
4147
}
4248

‎examples/serverless/main.tf‎

Lines changed: 36 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,15 @@ module "aurora_postgresql" {
3434

3535
vpc_id = module.vpc.vpc_id
3636
db_subnet_group_name = module.vpc.database_subnet_group_name
37-
security_group_rules = {
38-
vpc_ingress = {
39-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
37+
security_group_ingress_rules = {
38+
private-az1 = {
39+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
40+
}
41+
private-az2 = {
42+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
43+
}
44+
private-az3 = {
45+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
4046
}
4147
}
4248

@@ -78,9 +84,15 @@ module "aurora_mysql" {
7884

7985
vpc_id = module.vpc.vpc_id
8086
db_subnet_group_name = module.vpc.database_subnet_group_name
81-
security_group_rules = {
82-
vpc_ingress = {
83-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
87+
security_group_ingress_rules = {
88+
private-az1 = {
89+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
90+
}
91+
private-az2 = {
92+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
93+
}
94+
private-az3 = {
95+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
8496
}
8597
}
8698

@@ -122,9 +134,15 @@ module "aurora_mysql_v2" {
122134

123135
vpc_id = module.vpc.vpc_id
124136
db_subnet_group_name = module.vpc.database_subnet_group_name
125-
security_group_rules = {
126-
vpc_ingress = {
127-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
137+
security_group_ingress_rules = {
138+
private-az1 = {
139+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
140+
}
141+
private-az2 = {
142+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
143+
}
144+
private-az3 = {
145+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
128146
}
129147
}
130148

@@ -168,9 +186,15 @@ module "aurora_postgresql_v2" {
168186

169187
vpc_id = module.vpc.vpc_id
170188
db_subnet_group_name = module.vpc.database_subnet_group_name
171-
security_group_rules = {
172-
vpc_ingress = {
173-
cidr_blocks = module.vpc.private_subnets_cidr_blocks
189+
security_group_ingress_rules = {
190+
private-az1 = {
191+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 0)
192+
}
193+
private-az2 = {
194+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 1)
195+
}
196+
private-az3 = {
197+
cidr_ipv4 = element(module.vpc.private_subnets_cidr_blocks, 2)
174198
}
175199
}
176200

‎main.tf‎

Lines changed: 41 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -368,11 +368,12 @@ resource "aws_appautoscaling_policy" "this" {
368368
################################################################################
369369

370370
locals {
371-
security_group_name = try(coalesce(var.security_group_name, var.name), "")
371+
create_security_group = local.create && var.create_security_group
372+
security_group_name = try(coalesce(var.security_group_name, var.name), "")
372373
}
373374

374375
resource "aws_security_group" "this" {
375-
count = local.create && var.create_security_group ? 1 : 0
376+
count = local.create_security_group ? 1 : 0
376377

377378
region = var.region
378379

@@ -391,27 +392,49 @@ resource "aws_security_group" "this" {
391392
}
392393
}
393394

394-
resource "aws_security_group_rule" "this" {
395-
for_each = { for k, v in var.security_group_rules : k => v if local.create && var.create_security_group }
395+
resource "aws_vpc_security_group_ingress_rule" "this" {
396+
for_each = { for k, v in var.security_group_ingress_rules : k => v if var.security_group_ingress_rules != null && local.create_security_group }
396397

397398
region = var.region
398399

399-
# required
400-
type = try(each.value.type, "ingress")
401-
from_port = try(each.value.from_port, local.port)
402-
to_port = try(each.value.to_port, local.port)
403-
protocol = try(each.value.protocol, "tcp")
404-
security_group_id = aws_security_group.this[0].id
405-
406-
# optional
407-
cidr_blocks = try(each.value.cidr_blocks, null)
408-
description = try(each.value.description, null)
409-
ipv6_cidr_blocks = try(each.value.ipv6_cidr_blocks, null)
410-
prefix_list_ids = try(each.value.prefix_list_ids, null)
411-
source_security_group_id = try(each.value.source_security_group_id, null)
412-
self = try(each.value.self, null)
400+
cidr_ipv4 = each.value.cidr_ipv4
401+
cidr_ipv6 = each.value.cidr_ipv6
402+
description = each.value.description
403+
from_port = try(coalesce(each.value.from_port, local.port), null)
404+
ip_protocol = each.value.ip_protocol
405+
prefix_list_id = each.value.prefix_list_id
406+
referenced_security_group_id = each.value.referenced_security_group_id == "self" ? aws_security_group.this[0].id : each.value.referenced_security_group_id
407+
security_group_id = aws_security_group.this[0].id
408+
tags = merge(
409+
var.tags,
410+
{ "Name" = coalesce(each.value.name, "${local.security_group_name}-${each.key}") },
411+
each.value.tags
412+
)
413+
to_port = try(coalesce(each.value.to_port, each.value.from_port, local.port), null)
414+
}
415+
416+
resource "aws_vpc_security_group_egress_rule" "this" {
417+
for_each = { for k, v in var.security_group_egress_rules : k => v if var.security_group_egress_rules != null && local.create_security_group }
418+
419+
region = var.region
420+
421+
cidr_ipv4 = each.value.cidr_ipv4
422+
cidr_ipv6 = each.value.cidr_ipv6
423+
description = each.value.description
424+
from_port = try(coalesce(each.value.from_port, each.value.to_port, local.port), null)
425+
ip_protocol = each.value.ip_protocol
426+
prefix_list_id = each.value.prefix_list_id
427+
referenced_security_group_id = each.value.referenced_security_group_id == "self" ? aws_security_group.this[0].id : each.value.referenced_security_group_id
428+
security_group_id = aws_security_group.this[0].id
429+
tags = merge(
430+
var.tags,
431+
{ "Name" = coalesce(each.value.name, "${local.security_group_name}-${each.key}") },
432+
each.value.tags
433+
)
434+
to_port = try(coalesce(each.value.to_port, local.port), null)
413435
}
414436

437+
415438
################################################################################
416439
# Cluster Parameter Group
417440
################################################################################

0 commit comments

Comments
 (0)