xdr-terraform-modules/base/aws_client_vpn/security-groups.tf

#----------------------------------------------------------------------------
# VPN Access Security Group
#----------------------------------------------------------------------------
resource "aws_security_group" "vpn_access" {
	# checkov:skip=CKV2_AWS_5: This SG is not an Orphan
  name_prefix = "${var.dns_name}${var.suffix}_vpn_access"
  description = "Security Group for the AWS VPN"
  vpc_id      = var.vpc_id
  tags        = merge(local.standard_tags, var.tags)
}

#----------------------------------------------------------------------------
# INGRESS
#----------------------------------------------------------------------------
resource "aws_security_group_rule" "vpn-in-443-tcp" {
  type              = "ingress"
  description       = "443 - TCP - Inbound"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"] # tfsec:ignore:aws-vpc-no-public-ingress-sgr
  security_group_id = aws_security_group.vpn_access.id
}

resource "aws_security_group_rule" "vpn-in-443-udp" {
  type              = "ingress"
  description       = "443 - UDP - Inbound"
  from_port         = 443
  to_port           = 443
  protocol          = "udp"
  cidr_blocks       = ["0.0.0.0/0"] # tfsec:ignore:aws-vpc-no-public-ingress-sgr
  security_group_id = aws_security_group.vpn_access.id
}

resource "aws_security_group_rule" "vpn-in-1194-tcp" {
  type              = "ingress"
  description       = "1194 - TCP - Inbound"
  from_port         = 1194
  to_port           = 1194
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"] # tfsec:ignore:aws-vpc-no-public-ingress-sgr
  security_group_id = aws_security_group.vpn_access.id
}

resource "aws_security_group_rule" "vpn-in-1194-udp" {
  type              = "ingress"
  description       = "1194 - UDP - Inbound"
  from_port         = 1194
  to_port           = 1194
  protocol          = "udp"
  cidr_blocks       = ["0.0.0.0/0"] # tfsec:ignore:aws-vpc-no-public-ingress-sgr
  security_group_id = aws_security_group.vpn_access.id
}

#----------------------------------------------------------------------------
# EGRESS
#----------------------------------------------------------------------------
resource "aws_security_group_rule" "vpn-out" {
  type              = "egress"
  description       = "VPN - Outbound"
  from_port         = -1
  to_port           = -1
  protocol          = -1
  cidr_blocks       = ["0.0.0.0/0"] # tfsec:ignore:aws-vpc-no-public-egress-sgr
  security_group_id = aws_security_group.vpn_access.id
}