xdr-terraform-modules/base/standard_vpc/security-groups.tf

# Several of these security groups will have customer IPs listed in them to allow
# POP systems to access our services.
#

locals {
  endpoint_cidr_blocks = var.allow_any_to_endpoints ? ["10.0.0.0/8"] : [module.vpc.vpc_cidr_block]
}

# tfsec:ignore:aws-vpc-no-public-egress-sgr We allow outbound to select IPs
module "aws_endpoints_sg" {
  use_name_prefix = false
  source          = "terraform-aws-modules/security-group/aws"
  version         = "= 4.0.0"
  name            = "aws_endpoints"
  tags            = merge(local.standard_tags, var.tags)
  vpc_id          = module.vpc.vpc_id

  ingress_cidr_blocks     = local.endpoint_cidr_blocks
  egress_cidr_blocks      = local.endpoint_cidr_blocks
  egress_ipv6_cidr_blocks = []

  egress_rules  = ["all-all"]
  ingress_rules = ["all-all"]
}


# tfsec:ignore:aws-vpc-no-public-egress-sgr We allow outbound to select IPs
module "allow_all_from_trusted_sg" {
  use_name_prefix = false
  source          = "terraform-aws-modules/security-group/aws"
  version         = "= 4.0.0"
  name            = "allow-all-from-trusted"
  tags            = merge(local.standard_tags, var.tags)
  vpc_id          = module.vpc.vpc_id

  ingress_cidr_blocks = concat(local.trusted_ips, ["10.0.0.0/8"])
  egress_cidr_blocks  = ["0.0.0.0/0"]
  ingress_rules       = ["all-all"]
  egress_rules        = ["all-all"]
}

# tfsec:ignore:aws-vpc-no-public-egress-sgr We allow outbound to select IPs
module "allow_all_outbound_sg" {
  use_name_prefix = false
  source          = "terraform-aws-modules/security-group/aws"
  version         = "= 4.0.0"
  name            = "allow-all-outbound"
  tags            = merge(local.standard_tags, var.tags)
  vpc_id          = module.vpc.vpc_id

  egress_rules = ["all-all"]
}

# tfsec:ignore:aws-vpc-no-public-egress-sgr We allow outbound to select IPs
module "typical_host_security_group" {
  source = "../../submodules/security_group/typical_host"

  vpc_id           = module.vpc.vpc_id
  cidr_map         = local.cidr_map
  tags             = merge(local.standard_tags, var.tags)
  aws_region       = var.aws_region
  aws_partition    = var.aws_partition
  aws_endpoints_sg = module.aws_endpoints_sg.security_group_id
}

# CIS 4.3 - Default security group should restrict all traffic
# 
# This resource is special, and clears out existing rules. See:
# See https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group
resource "aws_default_security_group" "default" {
  vpc_id = module.vpc.vpc_id
  tags   = merge(local.standard_tags, var.tags)
}