diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..8cce8a2 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,6 @@ +# CHANGELOG + +# v2.0.0 -- 20210528 + - create a common set of files to not replicate the logic + - consolidate all the submodules to use the common structure + diff --git a/common/data.tf b/common/data.tf new file mode 100644 index 0000000..517cde8 --- /dev/null +++ b/common/data.tf @@ -0,0 +1,24 @@ +data "aws_caller_identity" "current" {} + +data "aws_arn" "current" { + arn = data.aws_caller_identity.current.arn +} + +data "aws_region" "current" {} + +# output "caller_account_id" { +# value = data.aws_caller_identity.current.account_id +# } +# +# output "account_caller_arn" { +# value = data.aws_caller_identity.current.arn +# } +# +# output "account_caller_arn_partition" { +# value = data.aws_arn.current.partition +# } +# +# output "account_region_name" { +# value = data.aws_region.current.name +# } + diff --git a/common/output.tf b/common/output.tf new file mode 100644 index 0000000..fbdd35a --- /dev/null +++ b/common/output.tf @@ -0,0 +1,9 @@ +output "this_security_group_id" { + description = "Created security group ID" + value = aws_security_group.this_security_group.id +} + +output "this_security_group_arn" { + description = "Created security group ARN" + value = aws_security_group.this_security_group.arn +} diff --git a/common/ports.tf b/common/ports.tf new file mode 100644 index 0000000..35102ec --- /dev/null +++ b/common/ports.tf @@ -0,0 +1,57 @@ +# ports = list of list of +# from_port +# to_port +# proto +# description +# cidr_block +# list of: all, external (more added as needed) + +locals { + n_all = ["0.0.0.0/0"] + n_census = ["148.129.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"] + n_mgmt = ["148.129.162.0/24", "148.129.95.0/24"] + n_riverbed = ["172.24.100.107/32"] + source_groups = ["all", "external"] + name = var.name + ports = [ + [-1, -1, "icmp", "ICMP", local.n_all, ["external"]], + [22, 22, "tcp", "SSH", local.n_census, ["external"]], + [25, 25, "tcp", "SMTP", local.n_all, ["external"]], + [123, 123, "udp", "NTP", local.n_all, ["external"]], + [161, 161, "udp", "SNMP", local.n_all, ["external"]], + [443, 443, "tcp", "https", local.n_all, ["external"]], + [4949, 4949, "tcp", "Munin", local.n_mgmt, ["external"]], + [5001, 5003, "tcp", "iperf", local.n_all, ["external"]], + [5001, 5003, "udp", "iperf", local.n_all, ["external"]], + [5201, 5201, "tcp", "iperf3", local.n_all, ["external"]], + [5201, 5201, "udp", "iperf3", local.n_all, ["external"]], + + [1556, 1556, "tcp", "Netbackup", local.n_all, ["external"]], + [13724, 13724, "tcp", "Netbackup", local.n_all, ["external"]], + [13782, 13782, "tcp", "Netbackup", local.n_all, ["external"]], + [10082, 10082, "tcp", "Netbackup-spoold", local.n_all, ["external"]], + [10102, 10102, "tcp", "Netbackup-spad", local.n_all, ["external"]], + + [1830, 1830, "tcp", "Oracle-OEM", ["10.193.8.0/23"], ["external"]], + [1002, 1002, "tcp", "OPSware-Control", local.n_all, ["external"]], + [9080, 9080, "tcp", "", [local.n_census[2]], ["external"]], + [27401, 27401, "tcp", "TransactionAgent", local.n_riverbed, ["external"]], + ] + + # these are ignored + ingress_networks = var.ingress_networks + egress_networks = var.egress_networks + + # these are ignored + ingress_sg = var.ingress_security_groups + egress_sg = var.egress_security_groups + + p_fields = ["from", "to", "proto", "description", "cidr", "source_group"] + p_map = [for p in local.ports : zipmap(local.p_fields, p)] + port_map = { for s in local.source_groups : + s => [for p in local.p_map : p if contains(p["source_group"], s)] + } +} + +# + sg_id=sg-9b19a7fe sg_name='it-linux-base' vpc_id=vpc-95ff37f0 sg_id=sg-9b19a7fe sg_name='it-linux-base' vpc_id=vpc-95ff37f0 direction=ingress pft=tcp,8080,8080 range=0.0.0.0/0 +# + sg_id=sg-9b19a7fe sg_name='it-linux-base' vpc_id=vpc-95ff37f0 sg_id=sg-9b19a7fe sg_name='it-linux-base' vpc_id=vpc-95ff37f0 direction=ingress pft=tcp,1571,1571 range=0.0.0.0/0 diff --git a/common/resources.tf b/common/resources.tf new file mode 100644 index 0000000..2ad3927 --- /dev/null +++ b/common/resources.tf @@ -0,0 +1,111 @@ +data "aws_vpc" "this_vpc" { + count = var.use_vpc_cidr ? 1 : 0 + id = var.vpc_id +} + +data "aws_security_group" "ingress_security_groups" { + count = length(var.ingress_security_groups) + id = element(var.ingress_security_groups, count.index) +} + +data "aws_security_group" "egress_security_groups" { + count = length(var.egress_security_groups) + id = element(var.egress_security_groups, count.index) +} + +locals { + account_id = var.account_id != "" ? var.account_id : data.aws_caller_identity.current.account_id + logs_region = data.aws_region.current.name + account_environment = data.aws_arn.current.partition == "aws-us-gov" ? "gov" : "ew" + + base_tags = { + "Organization" = "census:aditcio:csvd" + "boc:tf_module_version" = local._module_version + "boc:created_by" = "terraform" + "boc:vpc:info" = join(" ", compact(list(var.vpc_id, var.vpc_full_name))) + } +} + +locals { + vpc_networks = var.use_vpc_cidr ? [data.aws_vpc.this_vpc[0].cidr_block] : [] + external_ingress_networks = compact(concat(local.vpc_networks, local.ingress_networks)) + ingress_sg_names = zipmap(var.ingress_security_groups, data.aws_security_group.ingress_security_groups[*].name) + egress_sg_names = zipmap(var.egress_security_groups, data.aws_security_group.egress_security_groups[*].name) + self = var.enable_self ? [1] : [] + short_description = var.short_description == "" ? var.description : var.short_description +} + +resource "aws_security_group" "this_security_group" { + name = local.name + description = var.description + vpc_id = var.vpc_id + + # ingresss external port list (list + vpc if enabaled) + dynamic "ingress" { + for_each = local.port_map["external"] + iterator = p + content { + description = "${local.short_description}: ${p.value["description"]}" + from_port = p.value["from"] + to_port = p.value["to"] + protocol = p.value["proto"] + cidr_blocks = length(p.value["cidr"]) == 0 ? local.external_ingress_networks : p.value["cidr"] + } + } + + # ingress security group ids (all) + dynamic "ingress" { + for_each = local.ingress_sg + iterator = sg + content { + description = "${local.short_description}: ${local.ingress_sg_names[sg.value]}" + from_port = 0 + to_port = 0 + protocol = -1 + security_groups = [sg.value] + } + } + + # ingress self (list with one or zero items) + dynamic "ingress" { + for_each = local.self + iterator = sg + content { + description = "${local.short_description}: from self" + from_port = 0 + to_port = 0 + protocol = -1 + self = true + } + } + + # egress all + egress { + description = "${local.short_description}: All" + from_port = 0 + to_port = 0 + protocol = -1 + cidr_blocks = local.egress_networks + } + + # egress security group ids (all) + dynamic "egress" { + for_each = local.egress_sg + iterator = sg + content { + description = "${local.short_description}: ${local.egress_sg_names[sg]}" + from_port = 0 + to_port = 0 + protocol = -1 + security_groups = [sg] + } + } + + tags = merge( + var.tags, + map("boc:created_by", "terraform"), + map("boc:tf_module_version", local._module_version), + map("boc:vpc:info", join(" ", compact(list(var.vpc_id, var.vpc_full_name)))), + map("Name", "sg-${local.name}"), + ) +} diff --git a/common/variables.tf b/common/variables.tf new file mode 100644 index 0000000..8235220 --- /dev/null +++ b/common/variables.tf @@ -0,0 +1,83 @@ +#--- +# change between different modules as needed +#--- +variable "name" { + description = "Security Group Name" + type = string + default = "it-linux-base" +} + +variable "description" { + description = "Security Group Description" + type = string + default = "Linux Common Base Security Group" +} + +variable "short_description" { + description = "Security Group Short Description" + type = string + default = "Linux" +} + +variable "enable_self" { + description = "Enable|Disable self full access" + type = bool + default = false +} + +variable "use_vpc_cidr" { + description = "Enable|Disable use of VPC CIDR block in the ingress_networks" + type = bool + default = false +} + +#--- +# others with defaults +#--- +variable "vpc_id" { + description = "VPC ID Number" + type = string +} + +data "aws_vpc" "selected" { + id = "${var.vpc_id}" +} + +variable "vpc_full_name" { + description = "VPC Name" + type = string + default = "" +} + +variable "ingress_networks" { + description = "List of ingress networks for external access (not all ports)" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "egress_networks" { + description = "List of egress networks (all ports)" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "ingress_security_groups" { + description = "List of ingress security groups for all ports" + type = list(string) + default = [] +} + +variable "egress_security_groups" { + description = "List of egress security groups (all ports)" + type = list(string) + default = [] +} + +variable "tags" { + description = "Extra security group tags" + type = map + default = { + "CostAllocation" = "csvd:infrastructure" + "Environment" = "csvd-infrastructure" + } +} diff --git a/common/version.tf b/common/version.tf new file mode 100644 index 0000000..6b49608 --- /dev/null +++ b/common/version.tf @@ -0,0 +1,3 @@ +locals { + _module_version = "2.0.0" +} diff --git a/common/versions.tf b/common/versions.tf new file mode 100644 index 0000000..ac97c6a --- /dev/null +++ b/common/versions.tf @@ -0,0 +1,4 @@ + +terraform { + required_version = ">= 0.12" +}