-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsecurity_groups.tf
123 lines (108 loc) · 4.59 KB
/
security_groups.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
resource "openstack_networking_secgroup_v2" "postgres_server" {
name = "${var.name}-server"
description = "Security group for postgres server"
delete_default_rules = true
}
resource "openstack_networking_secgroup_v2" "postgres_client" {
name = "${var.name}-client"
description = "Security group for the clients connecting to postgres server"
delete_default_rules = true
}
resource "openstack_networking_secgroup_v2" "postgres_bastion" {
name = "${var.name}-bastion"
description = "Security group for the bastion connecting to postgres server"
delete_default_rules = true
}
locals {
bastion_group_ids = var.bastion_security_group_id != "" ? [var.bastion_security_group_id, openstack_networking_secgroup_v2.postgres_bastion.id] : [openstack_networking_secgroup_v2.postgres_bastion.id]
}
//Allow all outbound traffic for server and bastion
resource "openstack_networking_secgroup_rule_v2" "postgres_server_outgoing_v4" {
direction = "egress"
ethertype = "IPv4"
security_group_id = openstack_networking_secgroup_v2.postgres_server.id
}
resource "openstack_networking_secgroup_rule_v2" "postgres_server_outgoing_v6" {
direction = "egress"
ethertype = "IPv6"
security_group_id = openstack_networking_secgroup_v2.postgres_server.id
}
resource "openstack_networking_secgroup_rule_v2" "postgres_bastion_outgoing_v4" {
direction = "egress"
ethertype = "IPv4"
security_group_id = openstack_networking_secgroup_v2.postgres_bastion.id
}
resource "openstack_networking_secgroup_rule_v2" "postgres_bastion_outgoing_v6" {
direction = "egress"
ethertype = "IPv6"
security_group_id = openstack_networking_secgroup_v2.postgres_bastion.id
}
//Allow port 22 traffic from the bastion
resource "openstack_networking_secgroup_rule_v2" "internal_ssh_access" {
for_each = { for idx, id in local.bastion_group_ids : idx => id }
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_group_id = each.value
security_group_id = openstack_networking_secgroup_v2.postgres_server.id
}
//Allow port 22 traffic on the bastion
resource "openstack_networking_secgroup_rule_v2" "external_ssh_access" {
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 22
port_range_max = 22
remote_ip_prefix = "0.0.0.0/0"
security_group_id = openstack_networking_secgroup_v2.postgres_bastion.id
}
//Allow port 5432 traffic from the client
resource "openstack_networking_secgroup_rule_v2" "client_postgres_access" {
direction = "ingress"
ethertype = "IPv4"
protocol = "tcp"
port_range_min = 5432
port_range_max = 5432
remote_group_id = openstack_networking_secgroup_v2.postgres_client.id
security_group_id = openstack_networking_secgroup_v2.postgres_server.id
}
//Allow clients and bastion to use icmp
resource "openstack_networking_secgroup_rule_v2" "client_icmp_access_v4" {
direction = "ingress"
ethertype = "IPv4"
protocol = "icmp"
remote_group_id = openstack_networking_secgroup_v2.postgres_client.id
security_group_id = openstack_networking_secgroup_v2.postgres_server.id
}
resource "openstack_networking_secgroup_rule_v2" "client_icmp_access_v6" {
direction = "ingress"
ethertype = "IPv6"
protocol = "ipv6-icmp"
remote_group_id = openstack_networking_secgroup_v2.postgres_client.id
security_group_id = openstack_networking_secgroup_v2.postgres_server.id
}
resource "openstack_networking_secgroup_rule_v2" "bastion_icmp_access_v4" {
for_each = { for idx, id in local.bastion_group_ids : idx => id }
direction = "ingress"
ethertype = "IPv4"
protocol = "icmp"
remote_group_id = each.value
security_group_id = openstack_networking_secgroup_v2.postgres_server.id
}
resource "openstack_networking_secgroup_rule_v2" "bastion_icmp_access_v6" {
for_each = { for idx, id in local.bastion_group_ids : idx => id }
direction = "ingress"
ethertype = "IPv6"
protocol = "ipv6-icmp"
remote_group_id = each.value
security_group_id = openstack_networking_secgroup_v2.postgres_server.id
}
resource "openstack_networking_secgroup_rule_v2" "bastion_external_icmp_access" {
direction = "ingress"
ethertype = "IPv4"
protocol = "icmp"
remote_ip_prefix = "0.0.0.0/0"
security_group_id = openstack_networking_secgroup_v2.postgres_bastion.id
}