Skip to content

Commit dafb882

Browse files
Monitobbenoit-garcia
Monitob
and
benoit-garcia
authored
feat(sg): handle security_group_id and add example (#19)
* feat(sg): handle security_group_id and add example Co-authored-by: Benoit Garcia <72207524+benoit-garcia@users.noreply.github.com> Signed-off-by: jaime Bernabe <6184069+Monitob@users.noreply.github.com> * Update examples/basic/main.tf --------- Signed-off-by: jaime Bernabe <6184069+Monitob@users.noreply.github.com> Co-authored-by: Benoit Garcia <72207524+benoit-garcia@users.noreply.github.com>
1 parent df52f65 commit dafb882

File tree

9 files changed

+230
-29
lines changed

9 files changed

+230
-29
lines changed

‎README.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,12 +35,16 @@ module "my_sg" {
3535

3636
| Name | Description | Type | Default | Required |
3737
|------|-------------|------|---------|:--------:|
38+
| <a name="input_create_sg"></a> [create_sg](#input_create_sg) | Whether you choose to create a new security group. Set to false if you want to use already existing group. | `bool` | `true` | no |
3839
| <a name="input_enable_default_security"></a> [enable_default_security](#input_enable_default_security) | Whether to block SMTP on IPv4/IPv6 (Port 25, 465, 587). Set to false will unblock SMTP if your account is authorized to. If your organization is not yet authorized to send SMTP traffic, open a support ticket. | `bool` | `true` | no |
3940
| <a name="input_inbound_default_policy"></a> [inbound_default_policy](#input_inbound_default_policy) | Default policy on incoming traffic. Possible values are: accept or drop. | `string` | `"drop"` | no |
4041
| <a name="input_inbound_rules"></a> [inbound_rules](#input_inbound_rules) | List of inbound rule to add to the security group. | ```list(object({ action = string protocol = string port = optional(number) port_range = optional(string) ip = optional(string) ip_range = optional(string) }))``` | ```[ { "action": null, "ip": null, "ip_range": null, "port": null, "port_range": null, "protocol": null } ]``` | no |
4142
| <a name="input_name"></a> [name](#input_name) | Name of the security group. | `string` | `null` | no |
4243
| <a name="input_outbound_default_policy"></a> [outbound_default_policy](#input_outbound_default_policy) | Default policy on outgoing traffic. Possible values are: accept or drop. | `string` | `"drop"` | no |
4344
| <a name="input_outbound_rules"></a> [outbound_rules](#input_outbound_rules) | List of outbound rule to add to the security group. | ```list(object({ action = string protocol = string port = optional(number) port_range = optional(string) ip = optional(string) ip_range = optional(string) }))``` | ```[ { "action": null, "ip": null, "ip_range": null, "port": null, "port_range": null, "protocol": null } ]``` | no |
45+
| <a name="input_security_group_description"></a> [security_group_description](#input_security_group_description) | Security Group description | `string` | `""` | no |
46+
| <a name="input_security_group_id"></a> [security_group_id](#input_security_group_id) | Whether you choose to use and existing security group. | `string` | `""` | no |
47+
| <a name="input_sg_tags"></a> [sg_tags](#input_sg_tags) | Additional tags for the Security Groups | `list(string)` | `[]` | no |
4448
| <a name="input_stateful"></a> [stateful](#input_stateful) | Boolean to specify whether the security group should be stateful or not. | `bool` | `true` | no |
4549
| <a name="input_tags"></a> [tags](#input_tags) | Tags associated with the security group and its rules. | `list(any)` | `[]` | no |
4650

@@ -49,6 +53,9 @@ module "my_sg" {
4953
| Name | Description |
5054
|------|-------------|
5155
| <a name="output_group_id"></a> [group_id](#output_group_id) | ID of the security group. |
56+
| <a name="output_security_group_description"></a> [security_group_description](#output_security_group_description) | The description of the security group |
57+
| <a name="output_security_group_id"></a> [security_group_id](#output_security_group_id) | The ID of the security group |
58+
| <a name="output_security_group_name"></a> [security_group_name](#output_security_group_name) | The name of the security group |
5259
<!-- END_TF_DOCS -->
5360

5461
## Authors

‎examples/basic/README.md

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
# Scaleway Security Group Terraform module
2+
3+
Terraform module that can be used to deploy a Security Groups configuration with their rules on Scaleway. Common
4+
deployment examples can be found in [examples/](../../examples).
5+
6+
This is a basic example showing how to use the module.
7+
8+
## Usage
9+
10+
The example below provision a basic Security Group configuration.
11+
12+
``` hcl
13+
14+
15+
locals {
16+
inbound_rules = [
17+
{
18+
action = "accept"
19+
ip_range = "10.10.0.0/20"
20+
port_range = "15-25"
21+
protocol = "TCP"
22+
},
23+
{
24+
action = "drop"
25+
port = 443
26+
ip_range = "0.0.0.0/0"
27+
protocol = "TCP"
28+
}
29+
]
30+
outbound_rules = [
31+
{
32+
action = "accept"
33+
port_range = "80-90"
34+
ip_range = "0.0.0.0/0"
35+
protocol = "TCP"
36+
},
37+
{
38+
action = "drop"
39+
port = 443
40+
ip_range = "0.0.0.0/0"
41+
protocol = "TCP"
42+
}
43+
]
44+
}
45+
46+
module "my_sg" {
47+
source = "scaleway-terraform-modules/security_group/scaleway"
48+
name = "my_security_group"
49+
create_sg = true
50+
security_group_description = "description"
51+
inbound_rules = local.inbound_rules
52+
outbound_rules = local.outbound_rules
53+
}
54+
```

‎examples/basic/main.tf

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
provider "scaleway" {
2+
region = "fr-par"
3+
zone = "fr-par-1"
4+
}
5+
6+
locals {
7+
name = "example-module-security-group-and-rules-${basename(path.cwd)}"
8+
description = "Security group with all available arguments set (this is just an example)"
9+
10+
tags = [
11+
local.name,
12+
"terraform-scaleway-security-group-module"
13+
]
14+
15+
create_sg = true
16+
17+
inbound_rules = [
18+
{
19+
action = "accept"
20+
ip_range = "10.10.0.0/20"
21+
port_range = "15-25"
22+
protocol = "TCP"
23+
},
24+
{
25+
action = "drop"
26+
port = 443
27+
ip_range = "0.0.0.0/0"
28+
protocol = "TCP"
29+
}
30+
]
31+
outbound_rules = [
32+
{
33+
action = "accept"
34+
port_range = "80-90"
35+
ip_range = "0.0.0.0/0"
36+
protocol = "TCP"
37+
},
38+
{
39+
action = "drop"
40+
port = 443
41+
ip_range = "0.0.0.0/0"
42+
protocol = "TCP"
43+
}
44+
]
45+
}
46+
47+
################################################################################
48+
# Security Group Module
49+
################################################################################
50+
module "sg" {
51+
source = "../../"
52+
name = local.name
53+
create_sg = local.create_sg
54+
security_group_description = local.description
55+
tags = local.tags
56+
inbound_rules = local.inbound_rules
57+
outbound_rules = local.outbound_rules
58+
}

‎examples/basic/outputs.tf

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
output "security_group_id" {
2+
description = "The ID of the security group"
3+
value = module.sg.security_group_id
4+
}
5+
6+
output "security_group_name" {
7+
description = "The name of the security group"
8+
value = module.sg.security_group_name
9+
}
10+
11+
output "security_group_description" {
12+
description = "The description of the security group"
13+
value = module.sg.security_group_description
14+
}

‎examples/basic/variables.tf

Whitespace-only changes.

‎examples/basic/versions.tf

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
terraform {
2+
required_providers {
3+
scaleway = {
4+
source = "scaleway/scaleway"
5+
version = ">= 2.20"
6+
}
7+
}
8+
required_version = ">= 0.13"
9+
}

‎main.tf

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,48 @@
1+
##################################
2+
# Get ID of created Security Group
3+
##################################
4+
locals {
5+
this_sg_id = var.create_sg ? scaleway_instance_security_group.this[0].id : var.security_group_id
6+
}
7+
18
resource "scaleway_instance_security_group" "this" {
2-
name = var.name
3-
stateful = var.stateful
9+
count = var.create_sg ? 1 : 0
10+
name = var.name
11+
description = var.security_group_description
12+
stateful = var.stateful
413

514
inbound_default_policy = var.inbound_default_policy
615
outbound_default_policy = var.outbound_default_policy
716
enable_default_security = var.enable_default_security
817
external_rules = true
9-
tags = var.tags
18+
tags = concat(
19+
var.tags,
20+
var.sg_tags,
21+
)
1022
}
1123

1224
resource "scaleway_instance_security_group_rules" "this" {
13-
security_group_id = scaleway_instance_security_group.this.id
25+
security_group_id = local.this_sg_id
1426

1527
dynamic "inbound_rule" {
1628
for_each = var.inbound_rules
1729
content {
18-
action = inbound_rule.value.action
19-
ip_range = inbound_rule.value.ip_range
20-
port = inbound_rule.value.port
21-
protocol = inbound_rule.value.protocol
22-
30+
action = inbound_rule.value.action
31+
ip_range = inbound_rule.value.ip_range
32+
port = inbound_rule.value.port
33+
port_range = inbound_rule.value.port_range
34+
protocol = inbound_rule.value.protocol
2335
}
2436
}
2537

2638
dynamic "outbound_rule" {
2739
for_each = var.outbound_rules
2840
content {
29-
action = outbound_rule.value.action
30-
ip_range = outbound_rule.value.ip_range
31-
port = outbound_rule.value.port
32-
protocol = outbound_rule.value.protocol
33-
41+
action = outbound_rule.value.action
42+
ip_range = outbound_rule.value.ip_range
43+
port = outbound_rule.value.port
44+
port_range = outbound_rule.value.port_range
45+
protocol = outbound_rule.value.protocol
3446
}
3547
}
3648
}

‎outputs.tf

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,19 @@
11
output "group_id" {
22
description = "ID of the security group."
3-
sensitive = false
4-
value = scaleway_instance_security_group.this.id
5-
}
3+
value = try(scaleway_instance_security_group.this[0].id, "")
4+
}
5+
6+
output "security_group_id" {
7+
description = "The ID of the security group"
8+
value = try(scaleway_instance_security_group.this[0].id, "")
9+
}
10+
11+
output "security_group_name" {
12+
description = "The name of the security group"
13+
value = try(scaleway_instance_security_group.this[0].name, "")
14+
}
15+
16+
output "security_group_description" {
17+
description = "The description of the security group"
18+
value = try(scaleway_instance_security_group.this[0].description, "")
19+
}

‎variables.tf

Lines changed: 45 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,51 @@
1+
################################################################################
2+
# General
3+
################################################################################
4+
variable "create_sg" {
5+
description = "Whether you choose to create a new security group. Set to false if you want to use already existing group."
6+
type = bool
7+
default = true
8+
}
9+
10+
variable "security_group_id" {
11+
description = "Whether you choose to use and existing security group."
12+
default = ""
13+
type = string
14+
}
15+
16+
variable "enable_default_security" {
17+
description = "Whether to block SMTP on IPv4/IPv6 (Port 25, 465, 587). Set to false will unblock SMTP if your account is authorized to. If your organization is not yet authorized to send SMTP traffic, open a support ticket."
18+
type = bool
19+
default = true
20+
}
21+
22+
variable "tags" {
23+
description = "Tags associated with the security group and its rules."
24+
type = list(any)
25+
default = []
26+
}
27+
28+
variable "sg_tags" {
29+
description = "Additional tags for the Security Groups"
30+
type = list(string)
31+
default = []
32+
}
33+
134
variable "name" {
235
description = "Name of the security group."
336
type = string
437
default = null
538
}
639

40+
################################################################################
41+
# Security Group
42+
################################################################################
43+
variable "security_group_description" {
44+
description = "Security Group description"
45+
type = string
46+
default = ""
47+
}
48+
749
variable "stateful" {
850
description = "Boolean to specify whether the security group should be stateful or not."
951
type = bool
@@ -32,6 +74,9 @@ variable "outbound_default_policy" {
3274
}
3375
}
3476

77+
################################################################################
78+
# Security Group Rules
79+
################################################################################
3580
variable "inbound_rules" {
3681
description = "List of inbound rule to add to the security group."
3782
type = list(object({
@@ -75,15 +120,3 @@ variable "outbound_rules" {
75120
}
76121
]
77122
}
78-
79-
variable "enable_default_security" {
80-
description = "Whether to block SMTP on IPv4/IPv6 (Port 25, 465, 587). Set to false will unblock SMTP if your account is authorized to. If your organization is not yet authorized to send SMTP traffic, open a support ticket."
81-
type = bool
82-
default = true
83-
}
84-
85-
variable "tags" {
86-
description = "Tags associated with the security group and its rules."
87-
type = list(any)
88-
default = []
89-
}

0 commit comments

Comments
 (0)