| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586 |
- # SG Summary - Server
- # Inbound::
- # tcp/8888 - from 10.0.0.0/8
- # tcp/443 - from load balancers, vpc-access (legacy was from 10.0.0.0/8)
- #
- # Outbound:
- # tcp/8089 - 10.0.0.0/8 (splunk)
- # udp/53 - 0.0.0.0/0 (dns for oscontext)
- # DISABLED tcp/464 - 10.80.0.0/16 (legacy vpc)
- # DISABLED tcp/636 - 0.0.0.0/0 (LDAPS outbound)
- # DISABLED tcp/389 - 10.80.0.0/16 (legacy vpc)
- # DISABLED tcp+udp/88 - 10.80.0.0/16 (idm)
- #
- # New:
- resource "aws_security_group" "phantom_server" {
- name_prefix = "phantom_server"
- tags = merge( var.standard_tags, var.tags, { Name = "phantom_server" } )
- vpc_id = var.vpc_id
- description = "Phantom Server"
- }
- #-----------------------------------------------------------------
- # Inbound access
- #-----------------------------------------------------------------
- resource "aws_security_group_rule" "phantom_server_inbound_8888" {
- security_group_id = aws_security_group.phantom_server.id
- type = "ingress"
- cidr_blocks = [ "10.0.0.0/8" ]
- from_port = 8888
- to_port = 8888
- protocol = "tcp"
- description = "Inbound 8888 - Phantom Websocket"
- }
- resource "aws_security_group_rule" "phantom_server_inbound_alb_443" {
- security_group_id = aws_security_group.phantom_server.id
- type = "ingress"
- source_security_group_id = aws_security_group.phantom_alb_internal.id
- from_port = 443
- to_port = 443
- protocol = "tcp"
- description = "Inbound 443 (from load balancers)"
- }
- resource "aws_security_group_rule" "phantom_server_inbound_alb_443_from_vpn" {
- security_group_id = aws_security_group.phantom_server.id
- type = "ingress"
- cidr_blocks = var.cidr_map["vpc-access"]
- from_port = 443
- to_port = 443
- protocol = "tcp"
- description = "Inbound 443 (from load access, for troubleshooting)"
- }
- #-----------------------------------------------------------------
- # Outbound access
- #-----------------------------------------------------------------
- resource "aws_security_group_rule" "phantom_server_outbound_postgres" {
- security_group_id = aws_security_group.phantom_server.id
- type = "egress"
- cidr_blocks = [ "10.0.0.0/8" ]
- from_port = 8089
- to_port = 8089
- protocol = "tcp"
- description = "Outbound to splunk everywhere"
- }
- resource "aws_security_group_rule" "phantom_server_outbound_udp_dns" {
- security_group_id = aws_security_group.phantom_server.id
- type = "egress"
- cidr_blocks = [ "0.0.0.0/0" ]
- from_port = 53
- to_port = 53
- protocol = "tcp"
- description = "Outbound tcp dns anywhere"
- }
- resource "aws_security_group_rule" "phantom_server_outbound_tcp_dns" {
- security_group_id = aws_security_group.phantom_server.id
- type = "egress"
- cidr_blocks = [ "0.0.0.0/0" ]
- from_port = 53
- to_port = 53
- protocol = "udp"
- description = "Outbound udp dns anywhere"
- }
|
