xdr-terraform-modules/base/mailrelay/main.tf

# Some instance variables
locals {
  ami_selection = "minion" # master, minion, ...
}

# Rather than pass in the aws security group, we just look it up. This will
# probably be useful other places, as well.
data "aws_security_group" "typical-host" {
  name   = "typical-host"
  vpc_id = var.vpc_id
}

# Use the default EBS key
data "aws_kms_key" "ebs-key" {
  key_id = "alias/ebs_root_encrypt_decrypt"
}

#----------------------------------------------------------------------------
# Mailrelay Security Group
#----------------------------------------------------------------------------
resource "aws_security_group" "mailrelay_security_group" {
  name        = "mailrelay_security_group"
  description = "Security Group for the Mail Relay Server(s)"
  vpc_id      = var.vpc_id
  tags        = merge(local.standard_tags, var.tags)
}

#-----------------------------------------------------------------
# Ingress
#-----------------------------------------------------------------
resource "aws_security_group_rule" "smtp-in" {
  type              = "ingress"
  description       = "SMTP - Inbound requests"
  from_port         = 25
  to_port           = 25
  protocol          = "tcp"
  cidr_blocks       = ["10.0.0.0/8"]
  security_group_id = aws_security_group.mailrelay_security_group.id
}

resource "aws_security_group_rule" "submission-in" {
  description       = "Submission SMTP-S - Inbound requests"
  type              = "ingress"
  from_port         = 587
  to_port           = 587
  protocol          = "tcp"
  cidr_blocks       = ["10.0.0.0/8"]
  security_group_id = aws_security_group.mailrelay_security_group.id
}

#resource "aws_security_group_rule" "smtp-out" {
#  description = "outbound smtp requests"
#  type = "egress"
#  from_port = 25
#  to_port = 25
#  protocol = "tcp"
#  cidr_blocks = [ "10.0.0.0/8" ]
#  security_group_id = aws_security_group.mailrelay_security_group.id
#}

#-----------------------------------------------------------------
# Egress
#-----------------------------------------------------------------
resource "aws_security_group_rule" "submission-out" {
  description       = "Submission SMTP-S - Outbound requests"
  type              = "egress"
  from_port         = 587
  to_port           = 587
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"] # tfsec:ignore:aws-vpc-no-public-egress-sgr
  security_group_id = aws_security_group.mailrelay_security_group.id
}