From 6fab570c69f6c95854eef4b0a8950bacc1d14084 Mon Sep 17 00:00:00 2001
From: Seong-dong <darkquiz@naver.com>
Date: Wed, 28 Dec 2022 22:50:49 +0900
Subject: [PATCH] sg rule add

---
 modules/sg-rule-add/main.tf      | 12 ++++----
 modules/sg-rule-add/outputs.tf   | 10 -------
 modules/sg-rule-add/variables.tf | 20 +++++++++++++
 modules/sg/main.tf               |  1 +
 modules/sg/variables.tf          |  5 ++++
 prod-hq/main.tf                  | 48 +++++++++++++++++++++++++++++++-
 6 files changed, 80 insertions(+), 16 deletions(-)

diff --git a/modules/sg-rule-add/main.tf b/modules/sg-rule-add/main.tf
index 7171bd5..22fe749 100644
--- a/modules/sg-rule-add/main.tf
+++ b/modules/sg-rule-add/main.tf
@@ -1,11 +1,13 @@
 resource "aws_security_group_rule" "sg-rule-add" {
-  description       = "Security groups rule add"
+  # description = "Security groups rule add"
 
   type              = var.type
-  from_port         = var.set_ports.http
-  to_port           = var.set_ports.http
-  protocol          = var.set_ports.protocol_tcp #tcp
+  from_port         = var.from_port
+  to_port           = var.to_port
+  protocol          = var.protocol
   cidr_blocks       = var.cidr_blocks
-  security_group_id = var.sg_id
+  security_group_id = var.security_group_id
+
+  description = "${var.tag_name}-sg-rule"
 
 }
diff --git a/modules/sg-rule-add/outputs.tf b/modules/sg-rule-add/outputs.tf
index dda6b4e..e69de29 100644
--- a/modules/sg-rule-add/outputs.tf
+++ b/modules/sg-rule-add/outputs.tf
@@ -1,10 +0,0 @@
-//sg-output
-output "vpc_hq_id" {
-  description = "The name of vpc hq id"
-  value       = aws_vpc.vpc-hq.id
-}
-
-output "vpc_name" {
-  value = var.tag_name
-}
-
diff --git a/modules/sg-rule-add/variables.tf b/modules/sg-rule-add/variables.tf
index 9b444ec..65b3dbd 100644
--- a/modules/sg-rule-add/variables.tf
+++ b/modules/sg-rule-add/variables.tf
@@ -6,3 +6,23 @@ variable "from_port" {
   description = "from port"
   type = number
 }
+variable "to_port" {
+  description = "to_port"
+  type = number
+}
+variable "protocol" {
+  description = "protocol"
+  type = string
+}
+variable "cidr_blocks" {
+  description = "cidr_blocks"
+  type = list(string)
+}
+
+variable "security_group_id" {
+  
+}
+variable "tag_name" {
+  description = "tag_name"
+  type  = string
+}
\ No newline at end of file
diff --git a/modules/sg/main.tf b/modules/sg/main.tf
index 27c36e8..46b4f72 100644
--- a/modules/sg/main.tf
+++ b/modules/sg/main.tf
@@ -1,5 +1,6 @@
 resource "aws_security_group" "sg" {
   description = "Security groups"
   name        = var.sg_name
+  vpc_id = var.vpc_id
 
 }
diff --git a/modules/sg/variables.tf b/modules/sg/variables.tf
index 6817535..a7161b1 100644
--- a/modules/sg/variables.tf
+++ b/modules/sg/variables.tf
@@ -2,3 +2,8 @@ variable "sg_name" {
   description = "security group name"
   type        = string
 }
+variable "vpc_id" {
+  description = "vpc_id"
+  type        = string
+
+}
diff --git a/prod-hq/main.tf b/prod-hq/main.tf
index f212fbc..6ff765c 100644
--- a/prod-hq/main.tf
+++ b/prod-hq/main.tf
@@ -13,6 +13,22 @@ locals {
     owner   = "icurfer"
 
   }
+  tcp_port = {
+    any_port    = 0
+    http_port   = 80
+    https_port  = 443
+    ssh_port    = 22
+    dns_port    = 53
+    django_port = 8000
+    mysql_port  = 3306
+  }
+  udp_port = {
+    dns_port = 53
+  }
+  any_protocol  = "-1"
+  tcp_protocol  = "tcp"
+  icmp_protocol = "icmp"
+  all_ips       = ["0.0.0.0/0"]
 }
 
 // GET 계정정보
@@ -164,9 +180,39 @@ module "eks_nodegroup_iam_att_3" {
 module "eks_sg" {
   source  = "../modules/sg"
   sg_name = "${local.common_tags.project}-sg"
+  vpc_id  = module.vpc_hq.vpc_hq_id
+
+  depends_on = [
+    module.vpc_hq
+  ]
 }
 
-module "eks_sg_ingress"
+module "eks_sg_ingress_http" {
+  for_each          = local.tcp_port
+  source            = "../modules/sg-rule-add"
+  type              = "ingress"
+  from_port         = each.value
+  to_port           = each.value
+  protocol          = local.tcp_protocol
+  cidr_blocks       = local.all_ips
+  security_group_id = module.eks_sg.sg_id
+
+  tag_name = each.key
+
+}
+
+module "eks_sg_egress_all" {
+  source            = "../modules/sg-rule-add"
+  type              = "egress"
+  from_port         = local.any_protocol
+  to_port           = local.any_protocol
+  protocol          = local.any_protocol
+  cidr_blocks       = local.all_ips
+  security_group_id = module.eks_sg.sg_id
+
+  tag_name = "egress-all"
+
+}
 # EKS테스트 할때 활성
 # module "ecr" {
 #     source = "../modules/ecr"