Make allow_all_egress a variable

[dlacosteGFM]

What changes in this PR?

• Default change is nothing (with this PR applied, nobody would have to change anything)
• Makes a new parameter allow_all_egress which defaults to false
• When creating the security group for the EFS volume, this line makes the security-group have an "allow egress to 0.0.0.0/0" rule entry. This PR makes that a configurable parameter instead

Why make this change?

• EFS doesn't actually do egress, so this really makes no impact difference at all
• ...but during a security audit we have a dangling "why do you allow egress to 0.0.0.0/0 on this?" question with no really good answer (so let's get rid of it as it doesn't do anything anyways)

References

• PCI DSS 3.2.1 rule 1.1.7 - Requirement to review firewall and router rule sets every 6 months
• PCI DSS 3.2.1 rule 1.2.1 - Restrict inbound and outbound traffic to that which is necessary for the environment

[hans-d]

/terratest

[hans-d]

Can you follow up with the failed checks/? A the end of the ci-readme eg is noted wat to do.

[hans-d]

@dlacosteGFM Hi, can you update the pr so that it passes the tests? otherwise, it is likely to be closed due to staleness.

[dlacosteGFM]

Sorry, missed the updated: looking at the output now (will update as required to make it pass)

[dlacosteGFM]

...and now that I rebased the test results are gone..... I wonder if it will let me run terratest? :)

[dlacosteGFM]

/terratest

[hans-d]

/terratest

[hans-d]

/terratest

[dlacosteGFM]

I got it to run manually:

~/repos/personal/terraform-aws-efs/test:(1m|git@make_allow_all_egress_a_variable!)
10076 ± make                                                                                                                                                                                                                                                                             

Running tests in  ../
1..11
ok 1 check if terraform is installed
ok 2 check if terraform code needs formatting
ok 3 check if terraform modules are valid # skip Terraform no longer supports separate testing of module loading
ok 4 check if terraform modules are properly pinned
ok 5 check if terraform plugins are valid # skip Terraform no longer supports separate testing of plugins
ok 6 check if terraform providers are properly pinned
ok 7 check if terraform providers have explicit source locations for TF =>0.13
ok 8 check if terraform code is valid
ok 9 check if terraform-docs is installed
ok 10 check if terraform inputs have descriptions
ok 11 check if terraform outputs have descriptions
Running tests in  ../examples/complete
1..5
ok 1 check if terraform is installed
ok 2 check if terraform code needs formatting
ok 3 check if terraform modules are valid # skip Terraform no longer supports separate testing of module loading
ok 4 check if terraform plugins are valid # skip Terraform no longer supports separate testing of plugins
ok 5 check if terraform code is valid

[hans-d]

/terratest

[hans-d]

I got it to run manually:

Much appreciating the effort!

[hans-d]

@dlacosteGFM Thanks!