From e57149c300a201de86527d5933bda824f54ac77d Mon Sep 17 00:00:00 2001 From: badra001 Date: Fri, 4 Jun 2021 08:07:14 -0400 Subject: [PATCH] add web --- web/CHANGELOG.md | 2 + web/README.md | 75 ++++++++++++++++++++++++++++ web/main.tf | 127 +++++++++++++++++++++++++++++++++++++++++++++++ web/output.tf | 9 ++++ web/ports.tf | 36 ++++++++++++++ web/variables.tf | 79 +++++++++++++++++++++++++++++ web/version.tf | 3 ++ web/versions.tf | 4 ++ 8 files changed, 335 insertions(+) create mode 100644 web/CHANGELOG.md create mode 100644 web/README.md create mode 100644 web/main.tf create mode 100644 web/output.tf create mode 100644 web/ports.tf create mode 100644 web/variables.tf create mode 100644 web/version.tf create mode 100644 web/versions.tf diff --git a/web/CHANGELOG.md b/web/CHANGELOG.md new file mode 100644 index 0000000..778029c --- /dev/null +++ b/web/CHANGELOG.md @@ -0,0 +1,2 @@ +# v1.0.0 -- 20210604 + - add module version, update tags diff --git a/web/README.md b/web/README.md new file mode 100644 index 0000000..321167b --- /dev/null +++ b/web/README.md @@ -0,0 +1,75 @@ +# About web + +This describes how to use the aws-common-security-groups submodule for web. + +Default and auxilliary ports are included in this. They are opened from everything. This +includes TCP only for the following ports: + +* 80 http +* 443 https +* 8080 http, Tomcat +* 8443 https, Tomcat + +## Usage + +```hcl +module "web" { + source = "git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//web" + + vpc_id = var.vpc_id + ## optional + # name = "m-web" + + ## tags for Name, CostAllocation, and Environment are pre-set, but they can be overriden + # tags = { } +} +``` + +## Requirements + +| Name | Version | +|------|---------| +| [terraform](#requirement\_terraform) | >= 0.12 | + +## Providers + +| Name | Version | +|------|---------| +| [aws](#provider\_aws) | n/a | + +## Modules + +No modules. + +## Resources + +| Name | Type | +|------|------| +| [aws_security_group.this_security_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | +| [aws_security_group.egress_security_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source | +| [aws_security_group.ingress_security_groups](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/security_group) | data source | +| [aws_vpc.this_vpc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/vpc) | data source | + +## Inputs + +| Name | Description | Type | Default | Required | +|------|-------------|------|---------|:--------:| +| [description](#input\_description) | Security Group Description | `string` | `"Web Security Group"` | no | +| [egress\_networks](#input\_egress\_networks) | List of egress networks (all ports) | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| [egress\_security\_groups](#input\_egress\_security\_groups) | List of egress security groups (all ports) | `list(string)` | `[]` | no | +| [enable\_self](#input\_enable\_self) | Enable\|Disable self full access | `bool` | `false` | no | +| [ingress\_networks](#input\_ingress\_networks) | List of ingress networks for external access (not all ports) | `list(string)` | 
[
  "0.0.0.0/0"
]
| no | +| [ingress\_security\_groups](#input\_ingress\_security\_groups) | List of ingress security groups for all ports | `list(string)` | `[]` | no | +| [name](#input\_name) | Security Group Name | `string` | `"m-web"` | no | +| [short\_description](#input\_short\_description) | Security Group Short Description | `string` | `"Web"` | no | +| [tags](#input\_tags) | Extra security group tags | `map` | 
{
  "CostAllocation": "csvd:infrastructure",
  "Environment": "csvd-infrastructure"
}
| no | +| [use\_vpc\_cidr](#input\_use\_vpc\_cidr) | Enable\|Disable use of VPC CIDR block in the ingress\_networks | `bool` | `false` | no | +| [vpc\_full\_name](#input\_vpc\_full\_name) | VPC Name | `string` | `""` | no | +| [vpc\_id](#input\_vpc\_id) | VPC ID Number | `string` | n/a | yes | + +## Outputs + +| Name | Description | +|------|-------------| +| [this\_security\_group\_arn](#output\_this\_security\_group\_arn) | Created security group ARN | +| [this\_security\_group\_id](#output\_this\_security\_group\_id) | Created security group ID | diff --git a/web/main.tf b/web/main.tf new file mode 100644 index 0000000..532325a --- /dev/null +++ b/web/main.tf @@ -0,0 +1,127 @@ +/* +* # About web +* +* This describes how to use the aws-common-security-groups submodule for web. +* +* Default and auxilliary ports are included in this. They are opened from everything. This +* includes TCP only for the following ports: +* +* * 80 http +* * 443 https +* * 8080 http, Tomcat +* * 8443 https, Tomcat +* +* ## Usage +* +* ```hcl +* module "web" { +* source = "git@github.e.it.census.gov:terraform-modules/aws-common-security-groups.git//web" +* +* vpc_id = var.vpc_id +* ## optional +* # name = "m-web" +* +* ## tags for Name, CostAllocation, and Environment are pre-set, but they can be overriden +* # tags = { } +* } +* ``` +*/ + +data "aws_vpc" "this_vpc" { + count = var.use_vpc_cidr ? 1 : 0 + id = var.vpc_id +} + +data "aws_security_group" "ingress_security_groups" { + count = length(var.ingress_security_groups) + id = element(var.ingress_security_groups, count.index) +} + +data "aws_security_group" "egress_security_groups" { + count = length(var.egress_security_groups) + id = element(var.egress_security_groups, count.index) +} + +locals { + vpc_networks = var.use_vpc_cidr ? [data.aws_vpc.this_vpc[0].cidr_block] : [] + external_ingress_networks = compact(concat(local.vpc_networks, local.ingress_networks)) + ingress_sg_names = zipmap(var.ingress_security_groups, data.aws_security_group.ingress_security_groups[*].name) + egress_sg_names = zipmap(var.egress_security_groups, data.aws_security_group.egress_security_groups[*].name) + self = var.enable_self ? [1] : [] + short_description = var.short_description == "" ? var.description : var.short_description +} + +resource "aws_security_group" "this_security_group" { + name = local.name + description = var.description + vpc_id = var.vpc_id + + # ingresss external port list (list + vpc if enabaled) + dynamic "ingress" { + for_each = local.port_map["external"] + iterator = p + content { + description = "${local.short_description}: ${p.value["description"]}" + from_port = p.value["from"] + to_port = p.value["to"] + protocol = p.value["proto"] + cidr_blocks = length(p.value["cidr"]) == 0 ? local.external_ingress_networks : p.value["cidr"] + } + } + + # ingress security group ids (all) + dynamic "ingress" { + for_each = local.ingress_sg + iterator = sg + content { + description = "${local.short_description}: ${local.ingress_sg_names[sg.value]}" + from_port = 0 + to_port = 0 + protocol = -1 + security_groups = [sg.value] + } + } + + # ingress self (list with one or zero items) + dynamic "ingress" { + for_each = local.self + iterator = sg + content { + description = "${local.short_description}: from self" + from_port = 0 + to_port = 0 + protocol = -1 + self = true + } + } + + # egress all + egress { + description = "${local.short_description}: All" + from_port = 0 + to_port = 0 + protocol = -1 + cidr_blocks = local.egress_networks + } + + # egress security group ids (all) + dynamic "egress" { + for_each = local.egress_sg + iterator = sg + content { + description = "${local.short_description}: ${local.egress_sg_names[sg]}" + from_port = 0 + to_port = 0 + protocol = -1 + security_groups = [sg] + } + } + + tags = merge( + map("Name", "sg-${local.name}"), + var.tags, + map("boc:created_by", "terraform"), + map("boc:tf_module_version", local._module_version), + map("boc:vpc:info", join(" ", compact(list(var.vpc_id, var.vpc_full_name)))), + ) +} diff --git a/web/output.tf b/web/output.tf new file mode 100644 index 0000000..fbdd35a --- /dev/null +++ b/web/output.tf @@ -0,0 +1,9 @@ +output "this_security_group_id" { + description = "Created security group ID" + value = aws_security_group.this_security_group.id +} + +output "this_security_group_arn" { + description = "Created security group ARN" + value = aws_security_group.this_security_group.arn +} diff --git a/web/ports.tf b/web/ports.tf new file mode 100644 index 0000000..0b7daa4 --- /dev/null +++ b/web/ports.tf @@ -0,0 +1,36 @@ +# ports = list of list of +# from_port +# to_port +# proto +# description +# cidr_block +# list of: all, external (more added as needed) + +locals { + description = "module: Web common ports" + n_all = ["0.0.0.0/0"] + n_census = ["148.129.0.0/16", "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"] + source_groups = ["all", "external"] + + name = var.name + ports = [ + [80, 80, "tcp", "http", local.n_census, ["external"]], + [443, 443, "tcp", "https", local.n_census, ["external"]], + [8080, 8080, "tcp", "Tomcat-http", local.n_census, ["external"]], + [8443, 8443, "tcp", "Tomcat-https", local.n_census, ["external"]], + ] + + # these are ignored + ingress_networks = var.ingress_networks + egress_networks = var.egress_networks + + # these are ignored + ingress_sg = var.ingress_security_groups + egress_sg = var.egress_security_groups + + p_fields = ["from", "to", "proto", "description", "cidr", "source_group"] + p_map = [for p in local.ports : zipmap(local.p_fields, p)] + port_map = { for s in local.source_groups : + s => [for p in local.p_map : p if contains(p["source_group"], s)] + } +} diff --git a/web/variables.tf b/web/variables.tf new file mode 100644 index 0000000..541fb29 --- /dev/null +++ b/web/variables.tf @@ -0,0 +1,79 @@ +#--- +# change between different modules as needed +#--- +variable "name" { + description = "Security Group Name" + type = string + default = "m-web" +} + +variable "description" { + description = "Security Group Description" + type = string + default = "Web Security Group" +} + +variable "short_description" { + description = "Security Group Short Description" + type = string + default = "Web" +} + +variable "enable_self" { + description = "Enable|Disable self full access" + type = bool + default = false +} + +variable "use_vpc_cidr" { + description = "Enable|Disable use of VPC CIDR block in the ingress_networks" + type = bool + default = false +} + +#--- +# others with defaults +#--- +variable "vpc_id" { + description = "VPC ID Number" + type = string +} + +variable "vpc_full_name" { + description = "VPC Name" + type = string + default = "" +} + +variable "ingress_networks" { + description = "List of ingress networks for external access (not all ports)" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "egress_networks" { + description = "List of egress networks (all ports)" + type = list(string) + default = ["0.0.0.0/0"] +} + +variable "ingress_security_groups" { + description = "List of ingress security groups for all ports" + type = list(string) + default = [] +} + +variable "egress_security_groups" { + description = "List of egress security groups (all ports)" + type = list(string) + default = [] +} + +variable "tags" { + description = "Extra security group tags" + type = map + default = { + "CostAllocation" = "csvd:infrastructure" + "Environment" = "csvd-infrastructure" + } +} diff --git a/web/version.tf b/web/version.tf new file mode 100644 index 0000000..fa2705b --- /dev/null +++ b/web/version.tf @@ -0,0 +1,3 @@ +locals { + _module_version = "1.0.0" +} diff --git a/web/versions.tf b/web/versions.tf new file mode 100644 index 0000000..ac97c6a --- /dev/null +++ b/web/versions.tf @@ -0,0 +1,4 @@ + +terraform { + required_version = ">= 0.12" +}