forked from cloudposse/terraform-aws-eks-cluster
-
Notifications
You must be signed in to change notification settings - Fork 0
/
security-group.tf
92 lines (76 loc) · 3.43 KB
/
security-group.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
# -----------------------------------------------------------------------
# Rules for EKS-managed Security Group
# -----------------------------------------------------------------------
resource "aws_security_group_rule" "managed_ingress_security_groups" {
count = local.enabled ? length(local.allowed_security_group_ids) : 0
description = "Allow inbound traffic from existing Security Groups"
from_port = 0
to_port = 65535
protocol = "-1"
source_security_group_id = local.allowed_security_group_ids[count.index]
security_group_id = join("", aws_eks_cluster.default.*.vpc_config.0.cluster_security_group_id)
type = "ingress"
}
resource "aws_security_group_rule" "managed_ingress_cidr_blocks" {
count = local.enabled && length(var.allowed_cidr_blocks) > 0 ? 1 : 0
description = "Allow inbound traffic from CIDR blocks"
from_port = 0
to_port = 65535
protocol = "-1"
cidr_blocks = var.allowed_cidr_blocks
security_group_id = join("", aws_eks_cluster.default.*.vpc_config.0.cluster_security_group_id)
type = "ingress"
}
# -----------------------------------------------------------------------
# DEPRECATED: Additional Security Group
# -----------------------------------------------------------------------
locals {
create_security_group = local.enabled && var.create_security_group
}
resource "aws_security_group" "default" {
count = local.create_security_group ? 1 : 0
name = module.label.id
description = "Security Group for EKS cluster"
vpc_id = var.vpc_id
tags = module.label.tags
}
resource "aws_security_group_rule" "egress" {
count = local.create_security_group ? 1 : 0
description = "Allow all egress traffic"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = join("", aws_security_group.default.*.id)
type = "egress"
}
resource "aws_security_group_rule" "ingress_workers" {
count = local.create_security_group ? length(var.workers_security_group_ids) : 0
description = "Allow the cluster to receive communication from the worker nodes"
from_port = 0
to_port = 65535
protocol = "-1"
source_security_group_id = var.workers_security_group_ids[count.index]
security_group_id = join("", aws_security_group.default.*.id)
type = "ingress"
}
resource "aws_security_group_rule" "ingress_security_groups" {
count = local.create_security_group ? length(var.allowed_security_groups) : 0
description = "Allow inbound traffic from existing Security Groups"
from_port = 0
to_port = 65535
protocol = "-1"
source_security_group_id = var.allowed_security_groups[count.index]
security_group_id = join("", aws_security_group.default.*.id)
type = "ingress"
}
resource "aws_security_group_rule" "ingress_cidr_blocks" {
count = local.create_security_group && length(var.allowed_cidr_blocks) > 0 ? 1 : 0
description = "Allow inbound traffic from CIDR blocks"
from_port = 0
to_port = 65535
protocol = "-1"
cidr_blocks = var.allowed_cidr_blocks
security_group_id = join("", aws_security_group.default.*.id)
type = "ingress"
}