WIP: Tighter security group rules

[tanmng]

Improvement on security group

Description

As per AWS documentation, you can set up the Security groups for the control plane and worker node to have either minimum rules, or have more access according to recommendation (ie. more relaxed rules and our instances more access).

I added 3 more variables to let the user specify which scenario they would want to use:

• worker_node_allow_all_egress (default true)
• cp_to_wn_from_port (default 1025)
• cp_to_wn_to_port (default 65355)

The default values of these correspond to the recommended case by AWS, but for any users who wish to set up a strict set of rules, they can provide different values to those variables, such as

• worker_node_allow_all_egress = false
• cp_to_wn_from_port = 10250
• cp_to_wn_from_port = 10250

Beside this, we also added the ability to provide a list of custom security groups that we would like to set onto the worker node. That will allow users to use other Terraform modules to set up the groups in the way that they like and then assign them onto the instance.

Since it's possible that user can set worker_node_allow_all_egress = false, we have to add one more security group rule resource to allow worker node egress to allow communication within the worker nodes themselves.

Checklist

• terraform fmt and terraform validate both work from the root and examples/eks_test_fixture directories (look in CI for an example)
• Tests for the changes have been added and passing (for bug fixes/features)
• Test results are pasted in this PR (in lieu of CI)
• Docs have been added/updated (for bug fixes/features)
• Any breaking changes are noted in the description above

[brandonjbjelland]

I'd like this to be more flexible than just being able to control one or two specific variables of a rule or two. Giving the option for a module consumer to bring their own pre-defined security group to attach to either set of resources feels like a better approach. I'm working on this currently.

Thanks again on the idea even if the implementation isn't exactly what I think will be best for module consumers. The input is incredibly valuable! ⭐

[tanmng]

@brandoconnor thanks for the feedback. I'll close this then

[brandonjbjelland]

Thanks again @tanmng . I'll give you credit (because it's due!) in the changelog.

[github-actions]

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.