sg rule add

modules/sg-rule-add/main.tf

@@ -1,11 +1,13 @@
 resource "aws_security_group_rule" "sg-rule-add" {
-  description       = "Security groups rule add"
+  # description = "Security groups rule add"
 
   type              = var.type
-  from_port         = var.set_ports.http
+  from_port         = var.from_port
-  to_port           = var.set_ports.http
+  to_port           = var.to_port
-  protocol          = var.set_ports.protocol_tcp #tcp
+  protocol          = var.protocol
   cidr_blocks       = var.cidr_blocks
-  security_group_id = var.sg_id
+  security_group_id = var.security_group_id
+
+  description = "${var.tag_name}-sg-rule"
 
 }

modules/sg-rule-add/outputs.tf

@@ -1,10 +0,0 @@
-//sg-output
-output "vpc_hq_id" {
-  description = "The name of vpc hq id"
-  value       = aws_vpc.vpc-hq.id
-}
-
-output "vpc_name" {
-  value = var.tag_name
-}
-

modules/sg-rule-add/variables.tf

@@ -6,3 +6,23 @@ variable "from_port" {
   description = "from port"
   type = number
 }
+variable "to_port" {
+  description = "to_port"
+  type = number
+}
+variable "protocol" {
+  description = "protocol"
+  type = string
+}
+variable "cidr_blocks" {
+  description = "cidr_blocks"
+  type = list(string)
+}
+
+variable "security_group_id" {
+  
+}
+variable "tag_name" {
+  description = "tag_name"
+  type  = string
+}

modules/sg/main.tf

@@ -1,5 +1,6 @@
 resource "aws_security_group" "sg" {
   description = "Security groups"
   name        = var.sg_name
+  vpc_id = var.vpc_id
 
 }

modules/sg/variables.tf

@@ -2,3 +2,8 @@ variable "sg_name" {
   description = "security group name"
   type        = string
 }
+variable "vpc_id" {
+  description = "vpc_id"
+  type        = string
+
+}

prod-hq/main.tf

@@ -13,6 +13,22 @@ locals {
     owner   = "icurfer"
 
   }
+  tcp_port = {
+    any_port    = 0
+    http_port   = 80
+    https_port  = 443
+    ssh_port    = 22
+    dns_port    = 53
+    django_port = 8000
+    mysql_port  = 3306
+  }
+  udp_port = {
+    dns_port = 53
+  }
+  any_protocol  = "-1"
+  tcp_protocol  = "tcp"
+  icmp_protocol = "icmp"
+  all_ips       = ["0.0.0.0/0"]
 }
 
 // GET 계정정보
@@ -164,9 +180,39 @@ module "eks_nodegroup_iam_att_3" {
 module "eks_sg" {
   source  = "../modules/sg"
   sg_name = "${local.common_tags.project}-sg"
+  vpc_id  = module.vpc_hq.vpc_hq_id
+
+  depends_on = [
+    module.vpc_hq
+  ]
 }
 
-module "eks_sg_ingress"
+module "eks_sg_ingress_http" {
+  for_each          = local.tcp_port
+  source            = "../modules/sg-rule-add"
+  type              = "ingress"
+  from_port         = each.value
+  to_port           = each.value
+  protocol          = local.tcp_protocol
+  cidr_blocks       = local.all_ips
+  security_group_id = module.eks_sg.sg_id
+
+  tag_name = each.key
+
+}
+
+module "eks_sg_egress_all" {
+  source            = "../modules/sg-rule-add"
+  type              = "egress"
+  from_port         = local.any_protocol
+  to_port           = local.any_protocol
+  protocol          = local.any_protocol
+  cidr_blocks       = local.all_ips
+  security_group_id = module.eks_sg.sg_id
+
+  tag_name = "egress-all"
+
+}
 # EKS테스트 할때 활성
 # module "ecr" {
 #     source = "../modules/ecr"