From fc886343413a8f27ab1f4f3b984f40f22b0566d0 Mon Sep 17 00:00:00 2001
From: xpk <xpk@headdesk.me>
Date: Thu, 23 Nov 2023 16:58:41 +0800
Subject: [PATCH] NEW: new security group module

---
 modules/compute/security_group/README.md    | 54 +++++++++++++++++++++
 modules/compute/security_group/main.tf      | 32 ++++++++++++
 modules/compute/security_group/outputs.tf   |  3 ++
 modules/compute/security_group/variables.tf |  5 ++
 4 files changed, 94 insertions(+)
 create mode 100644 modules/compute/security_group/README.md
 create mode 100644 modules/compute/security_group/main.tf
 create mode 100644 modules/compute/security_group/outputs.tf
 create mode 100644 modules/compute/security_group/variables.tf

diff --git a/modules/compute/security_group/README.md b/modules/compute/security_group/README.md
new file mode 100644
index 0000000..1889141
--- /dev/null
+++ b/modules/compute/security_group/README.md
@@ -0,0 +1,54 @@
+# security-groups-gen2
+This module create security groups from a map
+
+## Inputs
+
+| Name | Description | Type | Default | Required |
+|------|-------------|------|---------|:-----:|
+| tags | tags | List | n/a | yes |
+| vpc-id | VPC id | string | n/a | yes |
+| security-groups | See example below | map | n/a | yes |
+
+### security-groups input
+Below is a sample security-groups map this module ingests 
+
+```
+module "bea-bast-sg" {
+  source = "../../modules/compute/security_groups"
+
+  security-groups = [
+    {
+      name        = "RackspaceAdmin2"
+      description = "Allow rdp/ssh access from Rackspace"
+      ingress = {
+        r1  = "icmp,-1,-1,0.0.0.0/0,ICMP ping"
+        r2  = "-1,-1,-1,1.2.3.4/32,Foo access"
+      }
+      egress = {
+        r1 = "-1,-1,-1,0.0.0.0/0,Default egress rule"
+      }
+    },
+    {
+      name        = "RackspaceAdmin"
+      description = "Allow rdp/ssh access from Rackspace"
+      ingress = {
+        r1 = "tcp,443,443,${aws_ec2_managed_prefix_list.rsip_range.id},Bar ip ranges"
+        r2 = "tcp,22,22,2.3.4.5/32,Joe Blow"
+      }
+      egress = {
+        r1 = "-1,-1,-1,0.0.0.0/0,Default egress rule"
+      }
+    }
+  ]
+
+  tags   = local.default-tags
+  vpc-id = "vpc-xxx"
+}
+```
+
+## Outputs
+
+| Name | Description |
+|------|-------------|
+| sg-id-name | A map of SG id and their names |
+
diff --git a/modules/compute/security_group/main.tf b/modules/compute/security_group/main.tf
new file mode 100644
index 0000000..136c277
--- /dev/null
+++ b/modules/compute/security_group/main.tf
@@ -0,0 +1,32 @@
+data aws_default_tags this {}
+
+resource "aws_security_group" "sg" {
+  name        = var.name
+  description = var.description
+  vpc_id      = var.vpc-id
+  tags = { Name = var.name }
+}
+
+resource "aws_vpc_security_group_ingress_rule" "ingress-rules" {
+  for_each                     = var.ingress
+  security_group_id            = aws_security_group.sg.id
+  ip_protocol                  = split(",", each.value)[0]
+  from_port                    = split(",", each.value)[1]
+  to_port                      = split(",", each.value)[2]
+  cidr_ipv4                    = substr(split(",", each.value)[3], 2, 1) != "-" ? split(",", each.value)[3] : null
+  referenced_security_group_id = substr(split(",", each.value)[3], 0, 2) == "sg" ? split(",", each.value)[3] : null
+  prefix_list_id               = substr(split(",", each.value)[3], 0, 2) == "pl" ? split(",", each.value)[3] : null
+  description                  = split(",", each.value)[4]
+}
+
+resource "aws_vpc_security_group_egress_rule" "egress-rules" {
+  for_each                     = var.egress
+  security_group_id            = aws_security_group.sg.id
+  ip_protocol                  = split(",", each.value)[0]
+  from_port                    = split(",", each.value)[1]
+  to_port                      = split(",", each.value)[2]
+  cidr_ipv4                    = substr(split(",", each.value)[3], 2, 1) != "-" ? split(",", each.value)[3] : null
+  referenced_security_group_id = substr(split(",", each.value)[3], 0, 2) == "sg" ? split(",", each.value)[3] : null
+  prefix_list_id               = substr(split(",", each.value)[3], 0, 2) == "pl" ? split(",", each.value)[3] : null
+  description                  = split(",", each.value)[4]
+}
diff --git a/modules/compute/security_group/outputs.tf b/modules/compute/security_group/outputs.tf
new file mode 100644
index 0000000..5a963bf
--- /dev/null
+++ b/modules/compute/security_group/outputs.tf
@@ -0,0 +1,3 @@
+output id {
+  value = aws_security_group.sg.id
+}
\ No newline at end of file
diff --git a/modules/compute/security_group/variables.tf b/modules/compute/security_group/variables.tf
new file mode 100644
index 0000000..4fb72d0
--- /dev/null
+++ b/modules/compute/security_group/variables.tf
@@ -0,0 +1,5 @@
+variable name {}
+variable description {}
+variable vpc-id {}
+variable ingress {}
+variable egress {}
\ No newline at end of file