Skip to content

Commit f67ea06

Browse files
rajatagarwal-ibmrajatagarwal-ibm
authored
feat: added local and ip_version attributes for use in default security group rules (#1054)
1 parent 2742552 commit f67ea06

File tree

17 files changed

+144
-19
lines changed

17 files changed

+144
-19
lines changed

‎README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ Expected network connectivity downtime of typically around 20 seconds.
4444
* [workload-vpc](./modules/workload-vpc)
4545
* [Examples](./examples)
4646
* [Basic Example](./examples/basic)
47+
* [Custom Security Group Example](./examples/custom_security_group)
4748
* [Default Example](./examples/default)
4849
* [Existing VPC and subnets Example](./examples/existing_vpc)
4950
* [Hub and Spoke VPC Example](./examples/hub-spoke-delegated-resolver)
@@ -241,7 +242,7 @@ To attach access management tags to resources in this module, you need the follo
241242
| <a name="input_resource_group_id"></a> [resource\_group\_id](#input\_resource\_group\_id) | The resource group ID where the VPC to be created | `string` | n/a | yes |
242243
| <a name="input_routes"></a> [routes](#input\_routes) | OPTIONAL - Allows you to specify the next hop for packets based on their destination address | <pre>list(<br/> object({<br/> name = string<br/> route_direct_link_ingress = optional(bool)<br/> route_transit_gateway_ingress = optional(bool)<br/> route_vpc_zone_ingress = optional(bool)<br/> routes = optional(<br/> list(<br/> object({<br/> action = optional(string)<br/> zone = number<br/> destination = string<br/> next_hop = string<br/> })<br/> ))<br/> })<br/> )</pre> | `[]` | no |
243244
| <a name="input_routing_table_name"></a> [routing\_table\_name](#input\_routing\_table\_name) | The name to give the provisioned routing tables. If not set, the module generates a name based on the `prefix` and `name` variables. | `string` | `null` | no |
244-
| <a name="input_security_group_rules"></a> [security\_group\_rules](#input\_security\_group\_rules) | A list of security group rules to be added to the default vpc security group (default empty) | <pre>list(<br/> object({<br/> name = string<br/> direction = string<br/> remote = optional(string)<br/> tcp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> })<br/> )<br/> udp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> })<br/> )<br/> icmp = optional(<br/> object({<br/> type = optional(number)<br/> code = optional(number)<br/> })<br/> )<br/> })<br/> )</pre> | `[]` | no |
245+
| <a name="input_security_group_rules"></a> [security\_group\_rules](#input\_security\_group\_rules) | A list of security group rules to be added to the default vpc security group (default empty) | <pre>list(<br/> object({<br/> name = string<br/> direction = string<br/> remote = optional(string)<br/> local = optional(string)<br/> ip_version = optional(string)<br/> tcp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> })<br/> )<br/> udp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> })<br/> )<br/> icmp = optional(<br/> object({<br/> type = optional(number)<br/> code = optional(number)<br/> })<br/> )<br/> })<br/> )</pre> | `[]` | no |
245246
| <a name="input_skip_custom_resolver_hub_creation"></a> [skip\_custom\_resolver\_hub\_creation](#input\_skip\_custom\_resolver\_hub\_creation) | Indicates whether to skip the configuration of a custom resolver in the hub VPC. Only relevant if enable\_hub is set to true. | `bool` | `false` | no |
246247
| <a name="input_skip_spoke_auth_policy"></a> [skip\_spoke\_auth\_policy](#input\_skip\_spoke\_auth\_policy) | Set to true to skip the creation of an authorization policy between the DNS resolution spoke and hub, only enable this if a policy already exists between these two VPCs. See https://cloud.ibm.com/docs/vpc?topic=vpc-vpe-dns-sharing-s2s-auth&interface=ui for more details. | `bool` | `false` | no |
247248
| <a name="input_subnets"></a> [subnets](#input\_subnets) | List of subnets for the vpc. For each item in each array, a subnet will be created. Items can be either CIDR blocks or total ipv4 addresses. Public gateways will be enabled only in zones where a gateway has been created | <pre>object({<br/> zone-1 = list(object({<br/> name = string<br/> cidr = string<br/> public_gateway = optional(bool)<br/> acl_name = string<br/> no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true<br/> subnet_tags = optional(list(string), [])<br/> }))<br/> zone-2 = optional(list(object({<br/> name = string<br/> cidr = string<br/> public_gateway = optional(bool)<br/> acl_name = string<br/> no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true<br/> subnet_tags = optional(list(string), [])<br/> })))<br/> zone-3 = optional(list(object({<br/> name = string<br/> cidr = string<br/> public_gateway = optional(bool)<br/> acl_name = string<br/> no_addr_prefix = optional(bool, false) # do not automatically add address prefix for subnet, overrides other conditions if set to true<br/> subnet_tags = optional(list(string), [])<br/> })))<br/> })</pre> | <pre>{<br/> "zone-1": [<br/> {<br/> "acl_name": "vpc-acl",<br/> "cidr": "10.10.10.0/24",<br/> "name": "subnet-a",<br/> "no_addr_prefix": false,<br/> "public_gateway": true<br/> }<br/> ],<br/> "zone-2": [<br/> {<br/> "acl_name": "vpc-acl",<br/> "cidr": "10.20.10.0/24",<br/> "name": "subnet-b",<br/> "no_addr_prefix": false,<br/> "public_gateway": true<br/> }<br/> ],<br/> "zone-3": [<br/> {<br/> "acl_name": "vpc-acl",<br/> "cidr": "10.30.10.0/24",<br/> "name": "subnet-c",<br/> "no_addr_prefix": false,<br/> "public_gateway": false<br/> }<br/> ]<br/>}</pre> | no |

‎default_security_group.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,12 @@ locals {
1111
}
1212

1313
resource "ibm_is_security_group_rule" "default_vpc_rule" {
14-
for_each = local.security_group_rule_object
15-
group = var.create_vpc == true ? ibm_is_vpc.vpc[0].default_security_group : data.ibm_is_vpc.vpc.default_security_group
16-
direction = each.value.direction
17-
remote = each.value.remote
14+
for_each = local.security_group_rule_object
15+
group = var.create_vpc == true ? ibm_is_vpc.vpc[0].default_security_group : data.ibm_is_vpc.vpc.default_security_group
16+
direction = each.value.direction
17+
remote = each.value.remote
18+
local = each.value.local
19+
ip_version = each.value.ip_version
1820

1921
dynamic "tcp" {
2022
for_each = each.value.tcp == null ? [] : [each.value]

‎examples/custom_security_group/README.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# Custom Security Group Example
2+
3+
A simple example to provision a Secure Landing Zone (SLZ) Virtual Private Cloud (VPC) with Security Group Rules set.
4+
5+
The following resources are provisioned by this example:
6+
7+
* A new resource group, if an existing one is not passed in.
8+
* An IBM Virtual Private Cloud (VPC) with custom security group rules.

‎examples/custom_security_group/main.tf‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
2+
##############################################################################
3+
# Resource Group
4+
##############################################################################
5+
6+
module "resource_group" {
7+
source = "terraform-ibm-modules/resource-group/ibm"
8+
version = "1.3.0"
9+
# if an existing resource group is not set (null) create a new one using prefix
10+
resource_group_name = var.resource_group == null ? "${var.prefix}-resource-group" : null
11+
existing_resource_group_name = var.resource_group
12+
}
13+
14+
##############################################################################
15+
# Create new VPC
16+
# (if var.vpc_id is null, create a new VPC)
17+
##############################################################################
18+
19+
module "vpc" {
20+
source = "../.."
21+
resource_group_id = module.resource_group.resource_group_id
22+
region = var.region
23+
prefix = var.prefix
24+
name = "sg-vpc"
25+
tags = var.resource_tags
26+
security_group_rules = [{
27+
name = "allow-all-inbound-sg"
28+
direction = "inbound"
29+
remote = "0.0.0.0/0" # source of the traffic. 0.0.0.0/0 traffic from all across the internet.
30+
local = "0.0.0.0/0" # A CIDR block of 0.0.0.0/0 allows traffic to all local IP addresses (or from all local IP addresses, for outbound rules).
31+
ip_version = "ipv4"
32+
}]
33+
}

‎examples/custom_security_group/outputs.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
##############################################################################
2+
# Outputs
3+
##############################################################################
4+
5+
output "vpc_id" {
6+
value = module.vpc.vpc_id
7+
description = "VPC id"
8+
}
9+
10+
output "vpc_crn" {
11+
value = module.vpc.vpc_crn
12+
description = "VPC crn"
13+
}

‎examples/custom_security_group/provider.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
provider "ibm" {
2+
ibmcloud_api_key = var.ibmcloud_api_key
3+
region = var.region
4+
}

‎examples/custom_security_group/variables.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
variable "ibmcloud_api_key" {
2+
description = "APIkey that's associated with the account to provision resources to"
3+
type = string
4+
sensitive = true
5+
}
6+
7+
variable "region" {
8+
description = "The region to which to deploy the VPC"
9+
type = string
10+
}
11+
12+
variable "prefix" {
13+
description = "The prefix that you would like to append to your resources"
14+
type = string
15+
}
16+
17+
variable "resource_group" {
18+
type = string
19+
description = "An existing resource group name to use for this example, if unset a new resource group will be created"
20+
default = null
21+
}
22+
23+
variable "resource_tags" {
24+
description = "List of Tags for the resource created"
25+
type = list(string)
26+
default = null
27+
}

‎examples/custom_security_group/version.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
terraform {
2+
required_version = ">= 1.9.0"
3+
required_providers {
4+
# Ensure that there is always 1 example locked into the lowest provider version of the range defined in the main
5+
# module's version.tf (basic), and 1 example that will always use the latest provider version.
6+
ibm = {
7+
source = "IBM-Cloud/ibm"
8+
version = ">=1.59.0"
9+
}
10+
}
11+
}

‎modules/management-vpc/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ No resources.
4545
| <a name="input_default_network_acl_name"></a> [default\_network\_acl\_name](#input\_default\_network\_acl\_name) | Override default ACL name | `string` | `null` | no |
4646
| <a name="input_default_routing_table_name"></a> [default\_routing\_table\_name](#input\_default\_routing\_table\_name) | Override default VPC routing table name | `string` | `null` | no |
4747
| <a name="input_default_security_group_name"></a> [default\_security\_group\_name](#input\_default\_security\_group\_name) | Override default VPC security group name | `string` | `null` | no |
48-
| <a name="input_default_security_group_rules"></a> [default\_security\_group\_rules](#input\_default\_security\_group\_rules) | Override default security group rules | <pre>list(<br/> object({<br/> name = string<br/> direction = string<br/> remote = string<br/> tcp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> })<br/> )<br/> udp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> })<br/> )<br/> icmp = optional(<br/> object({<br/> type = optional(number)<br/> code = optional(number)<br/> })<br/> )<br/> })<br/> )</pre> | `[]` | no |
48+
| <a name="input_default_security_group_rules"></a> [default\_security\_group\_rules](#input\_default\_security\_group\_rules) | Override default security group rules | <pre>list(<br/> object({<br/> name = string<br/> direction = string<br/> remote = optional(string)<br/> local = optional(string)<br/> ip_version = optional(string)<br/> tcp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> })<br/> )<br/> udp = optional(<br/> object({<br/> port_max = optional(number)<br/> port_min = optional(number)<br/> })<br/> )<br/> icmp = optional(<br/> object({<br/> type = optional(number)<br/> code = optional(number)<br/> })<br/> )<br/> })<br/> )</pre> | `[]` | no |
4949
| <a name="input_enable_vpc_flow_logs"></a> [enable\_vpc\_flow\_logs](#input\_enable\_vpc\_flow\_logs) | Enable VPC Flow Logs, it will create Flow logs collector if set to true | `bool` | `false` | no |
5050
| <a name="input_existing_cos_bucket_name"></a> [existing\_cos\_bucket\_name](#input\_existing\_cos\_bucket\_name) | Name of the COS bucket to collect VPC flow logs | `string` | `null` | no |
5151
| <a name="input_existing_cos_instance_guid"></a> [existing\_cos\_instance\_guid](#input\_existing\_cos\_instance\_guid) | GUID of the COS instance to create Flow log collector | `string` | `null` | no |

‎modules/management-vpc/variables.tf‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,11 @@ variable "default_security_group_rules" {
5959
description = "Override default security group rules"
6060
type = list(
6161
object({
62-
name = string
63-
direction = string
64-
remote = string
62+
name = string
63+
direction = string
64+
remote = optional(string)
65+
local = optional(string)
66+
ip_version = optional(string)
6567
tcp = optional(
6668
object({
6769
port_max = optional(number)

0 commit comments

Comments
 (0)