start refactor

CHANGELOG.md

@@ -0,0 +1,6 @@
+# CHANGELOG
+
+# v2.0.0 -- 20210528
+  - create a common set of files to not replicate the logic
+  - consolidate all the submodules to use the common structure
+

common/data.tf

@@ -0,0 +1,24 @@
+data "aws_caller_identity" "current" {}
+
+data "aws_arn" "current" {
+  arn = data.aws_caller_identity.current.arn
+}
+
+data "aws_region" "current" {}
+
+# output "caller_account_id" {
+#   value = data.aws_caller_identity.current.account_id
+# }
+#
+# output "account_caller_arn" {
+#   value = data.aws_caller_identity.current.arn
+# }
+#
+# output "account_caller_arn_partition" {
+#   value = data.aws_arn.current.partition
+# }
+#
+# output "account_region_name" {
+#   value = data.aws_region.current.name
+# }
+

common/output.tf

@@ -0,0 +1,9 @@
+output "this_security_group_id" {
+  description = "Created security group ID"
+  value       = aws_security_group.this_security_group.id
+}
+
+output "this_security_group_arn" {
+  description = "Created security group ARN"
+  value       = aws_security_group.this_security_group.arn
+}

common/ports.tf

@@ -0,0 +1,57 @@
+# ports = list of list of
+#   from_port
+#   to_port
+#   proto
+#   description
+#   cidr_block
+#   list of: all, external (more added as needed)
+
+locals {
+  n_all         = ["0.0.0.0/0"]
+  n_census      = ["148.129.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"]
+  n_mgmt        = ["148.129.162.0/24", "148.129.95.0/24"]
+  n_riverbed    = ["172.24.100.107/32"]
+  source_groups = ["all", "external"]
+  name          = var.name
+  ports = [
+    [-1, -1, "icmp", "ICMP", local.n_all, ["external"]],
+    [22, 22, "tcp", "SSH", local.n_census, ["external"]],
+    [25, 25, "tcp", "SMTP", local.n_all, ["external"]],
+    [123, 123, "udp", "NTP", local.n_all, ["external"]],
+    [161, 161, "udp", "SNMP", local.n_all, ["external"]],
+    [443, 443, "tcp", "https", local.n_all, ["external"]],
+    [4949, 4949, "tcp", "Munin", local.n_mgmt, ["external"]],
+    [5001, 5003, "tcp", "iperf", local.n_all, ["external"]],
+    [5001, 5003, "udp", "iperf", local.n_all, ["external"]],
+    [5201, 5201, "tcp", "iperf3", local.n_all, ["external"]],
+    [5201, 5201, "udp", "iperf3", local.n_all, ["external"]],
+
+    [1556, 1556, "tcp", "Netbackup", local.n_all, ["external"]],
+    [13724, 13724, "tcp", "Netbackup", local.n_all, ["external"]],
+    [13782, 13782, "tcp", "Netbackup", local.n_all, ["external"]],
+    [10082, 10082, "tcp", "Netbackup-spoold", local.n_all, ["external"]],
+    [10102, 10102, "tcp", "Netbackup-spad", local.n_all, ["external"]],
+
+    [1830, 1830, "tcp", "Oracle-OEM", ["10.193.8.0/23"], ["external"]],
+    [1002, 1002, "tcp", "OPSware-Control", local.n_all, ["external"]],
+    [9080, 9080, "tcp", "", [local.n_census[2]], ["external"]],
+    [27401, 27401, "tcp", "TransactionAgent", local.n_riverbed, ["external"]],
+  ]
+
+  # these are ignored
+  ingress_networks = var.ingress_networks
+  egress_networks  = var.egress_networks
+
+  # these are ignored
+  ingress_sg = var.ingress_security_groups
+  egress_sg  = var.egress_security_groups
+
+  p_fields = ["from", "to", "proto", "description", "cidr", "source_group"]
+  p_map    = [for p in local.ports : zipmap(local.p_fields, p)]
+  port_map = { for s in local.source_groups :
+    s => [for p in local.p_map : p if contains(p["source_group"], s)]
+  }
+}
+
+# +  sg_id=sg-9b19a7fe sg_name='it-linux-base' vpc_id=vpc-95ff37f0 sg_id=sg-9b19a7fe sg_name='it-linux-base' vpc_id=vpc-95ff37f0 direction=ingress pft=tcp,8080,8080 range=0.0.0.0/0
+# +  sg_id=sg-9b19a7fe sg_name='it-linux-base' vpc_id=vpc-95ff37f0 sg_id=sg-9b19a7fe sg_name='it-linux-base' vpc_id=vpc-95ff37f0 direction=ingress pft=tcp,1571,1571 range=0.0.0.0/0

common/resources.tf

@@ -0,0 +1,111 @@
+data "aws_vpc" "this_vpc" {
+  count = var.use_vpc_cidr ? 1 : 0
+  id    = var.vpc_id
+}
+
+data "aws_security_group" "ingress_security_groups" {
+  count = length(var.ingress_security_groups)
+  id    = element(var.ingress_security_groups, count.index)
+}
+
+data "aws_security_group" "egress_security_groups" {
+  count = length(var.egress_security_groups)
+  id    = element(var.egress_security_groups, count.index)
+}
+
+locals {
+  account_id          = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id
+  logs_region         = data.aws_region.current.name
+  account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew"
+
+  base_tags = {
+    "Organization"          = "census:aditcio:csvd"
+    "boc:tf_module_version" = local._module_version
+    "boc:created_by"        = "terraform"
+    "boc:vpc:info"          = join(" ", compact(list(var.vpc_id, var.vpc_full_name)))
+  }
+}
+
+locals {
+  vpc_networks              = var.use_vpc_cidr ? [data.aws_vpc.this_vpc[0].cidr_block] : []
+  external_ingress_networks = compact(concat(local.vpc_networks, local.ingress_networks))
+  ingress_sg_names          = zipmap(var.ingress_security_groups, data.aws_security_group.ingress_security_groups[*].name)
+  egress_sg_names           = zipmap(var.egress_security_groups, data.aws_security_group.egress_security_groups[*].name)
+  self                      = var.enable_self ? [1] : []
+  short_description         = var.short_description == "" ? var.description : var.short_description
+}
+
+resource "aws_security_group" "this_security_group" {
+  name        = local.name
+  description = var.description
+  vpc_id      = var.vpc_id
+
+  # ingresss external port list (list + vpc if enabaled)
+  dynamic "ingress" {
+    for_each = local.port_map["external"]
+    iterator = p
+    content {
+      description = "${local.short_description}: ${p.value["description"]}"
+      from_port   = p.value["from"]
+      to_port     = p.value["to"]
+      protocol    = p.value["proto"]
+      cidr_blocks = length(p.value["cidr"]) == 0 ? local.external_ingress_networks : p.value["cidr"]
+    }
+  }
+
+  # ingress security group ids (all)
+  dynamic "ingress" {
+    for_each = local.ingress_sg
+    iterator = sg
+    content {
+      description     = "${local.short_description}: ${local.ingress_sg_names[sg.value]}"
+      from_port       = 0
+      to_port         = 0
+      protocol        = -1
+      security_groups = [sg.value]
+    }
+  }
+
+  # ingress self (list with one or zero items)
+  dynamic "ingress" {
+    for_each = local.self
+    iterator = sg
+    content {
+      description = "${local.short_description}: from self"
+      from_port   = 0
+      to_port     = 0
+      protocol    = -1
+      self        = true
+    }
+  }
+
+  # egress all
+  egress {
+    description = "${local.short_description}: All"
+    from_port   = 0
+    to_port     = 0
+    protocol    = -1
+    cidr_blocks = local.egress_networks
+  }
+
+  # egress security group ids (all)
+  dynamic "egress" {
+    for_each = local.egress_sg
+    iterator = sg
+    content {
+      description     = "${local.short_description}: ${local.egress_sg_names[sg]}"
+      from_port       = 0
+      to_port         = 0
+      protocol        = -1
+      security_groups = [sg]
+    }
+  }
+
+  tags = merge(
+    var.tags,
+    map("boc:created_by", "terraform"),
+    map("boc:tf_module_version", local._module_version),
+    map("boc:vpc:info", join(" ", compact(list(var.vpc_id, var.vpc_full_name)))),
+    map("Name", "sg-${local.name}"),
+  )
+}

common/variables.tf

@@ -0,0 +1,83 @@
+#---
+# change between different modules as needed
+#---
+variable "name" {
+  description = "Security Group Name"
+  type        = string
+  default     = "it-linux-base"
+}
+
+variable "description" {
+  description = "Security Group Description"
+  type        = string
+  default     = "Linux Common Base Security Group"
+}
+
+variable "short_description" {
+  description = "Security Group Short Description"
+  type        = string
+  default     = "Linux"
+}
+
+variable "enable_self" {
+  description = "Enable|Disable self full access"
+  type        = bool
+  default     = false
+}
+
+variable "use_vpc_cidr" {
+  description = "Enable|Disable use of VPC CIDR block in the ingress_networks"
+  type        = bool
+  default     = false
+}
+
+#---
+# others with defaults
+#---
+variable "vpc_id" {
+  description = "VPC ID Number"
+  type        = string
+}
+
+data "aws_vpc" "selected" {
+  id = "${var.vpc_id}"
+}
+
+variable "vpc_full_name" {
+  description = "VPC Name"
+  type        = string
+  default     = ""
+}
+
+variable "ingress_networks" {
+  description = "List of ingress networks for external access (not all ports)"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "egress_networks" {
+  description = "List of egress networks (all ports)"
+  type        = list(string)
+  default     = ["0.0.0.0/0"]
+}
+
+variable "ingress_security_groups" {
+  description = "List of ingress security groups for all ports"
+  type        = list(string)
+  default     = []
+}
+
+variable "egress_security_groups" {
+  description = "List of egress security groups (all ports)"
+  type        = list(string)
+  default     = []
+}
+
+variable "tags" {
+  description = "Extra security group tags"
+  type        = map
+  default = {
+    "CostAllocation" = "csvd:infrastructure"
+    "Environment"    = "csvd-infrastructure"
+  }
+}

common/version.tf

@@ -0,0 +1,3 @@
+locals {
+  _module_version = "2.0.0"
+}

common/versions.tf

@@ -0,0 +1,4 @@
+
+terraform {
+  required_version = ">= 0.12"
+}