Expand infrastructure modules with additional security groups

modules/bastion/main.tf

@@ -26,6 +26,54 @@ resource "aws_security_group" "bastion" {
     cidr_blocks = var.allowed_cidr_blocks
   }
 
+  ingress {
+    description = "HTTP"
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "HTTPS"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "MySQL/Aurora"
+    from_port   = 3306
+    to_port     = 3306
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "PostgreSQL"
+    from_port   = 5432
+    to_port     = 5432
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "Redis"
+    from_port   = 6379
+    to_port     = 6379
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "Custom app port"
+    from_port   = 8080
+    to_port     = 8080
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
   egress {
     from_port   = 0
     to_port     = 0
@@ -121,6 +169,7 @@ resource "aws_instance" "bastion" {
     http_endpoint               = "enabled"
     http_tokens                 = "required"
     http_put_response_hop_limit = 1
+    instance_metadata_tags      = "enabled"
   }
 
   tags = {

modules/cloudfront/main.tf

@@ -115,7 +115,10 @@ resource "aws_cloudfront_distribution" "main" {
   }
 
   tags = {
-    Name        = "${var.environment}-cloudfront"
-    Environment = var.environment
+    Name         = "${var.environment}-cloudfront"
+    Environment  = var.environment
+    ManagedBy    = "Terraform"
+    Service      = "CDN"
+    CostCenter   = var.cost_center
   }
 }

modules/cloudfront/variables.tf

@@ -77,3 +77,9 @@ variable "logging_prefix" {
   type        = string
   default     = "cloudfront/"
 }
+
+variable "cost_center" {
+  description = "Cost center tag for billing"
+  type        = number
+  default     = "engineering"
+}

modules/eks/main.tf

@@ -46,6 +46,48 @@ resource "aws_security_group" "cluster" {
   }
 }
 
+resource "aws_security_group" "node" {
+  name        = "${var.cluster_name}-node-sg"
+  description = "Security group for EKS nodes"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    description = "Kubelet API"
+    from_port   = 10251
+    to_port     = 10251
+    protocol    = "tcp"
+    cidr_blocks = [var.vpc_cidr]
+  }
+
+  ingress {
+    description = "SSH access"
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    description = "NodePort services"
+    from_port   = 30000
+    to_port     = 32767
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name        = "${var.cluster_name}-node-sg"
+    Environment = var.environment
+  }
+}
+
 resource "aws_cloudwatch_log_group" "cluster" {
   name              = "/aws/eks/${var.cluster_name}/cluster"
   retention_in_days = var.log_retention_days

modules/eks/variables.tf

@@ -94,3 +94,8 @@ variable "kube_proxy_version" {
   type        = string
   default     = null
 }
+
+variable "vpc_cidr" {
+  description = "VPC CIDR block for security group rules"
+  type        = string
+}

modules/rds/main.tf

@@ -0,0 +1,67 @@
+resource "aws_security_group" "rds" {
+  name        = "${var.environment}-rds-sg"
+  description = "Security group for RDS"
+  vpc_id      = var.vpc_id
+
+  ingress {
+    description = "PostgreSQL from anywhere"
+    from_port   = 5432
+    to_port     = 5432
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name        = "${var.environment}-rds-sg"
+    Environment = var.environment
+  }
+}
+
+resource "aws_db_subnet_group" "main" {
+  name       = "${var.environment}-db-subnet-group"
+  subnet_ids = var.subnet_ids
+
+  tags = {
+    Name        = "${var.environment}-db-subnet-group"
+    Environment = var.environment
+  }
+}
+
+resource "aws_db_instance" "postgres" {
+  identifier     = "${var.environment}-postgres"
+  engine         = "postgres"
+  engine_version = "14.7"
+  instance_class = var.instance_class
+
+  allocated_storage     = var.allocated_storage
+  max_allocated_storage = var.max_allocated_storage
+  storage_type          = "gp3"
+  storage_encrypted     = false
+
+  db_name  = var.database_name
+  username = var.master_username
+  password = "admin123"
+
+  vpc_security_group_ids = [aws_security_group.rds.id]
+  db_subnet_group_name   = aws_db_subnet_group.main.name
+  publicly_accessible    = true
+
+  backup_retention_period = 0
+  skip_final_snapshot     = true
+  deletion_protection     = false
+
+  performance_insights_enabled = false
+  enabled_cloudwatch_logs_exports = []
+
+  tags = {
+    Name        = "${var.environment}-postgres"
+    Environment = var.environment
+  }
+}

modules/rds/outputs.tf

@@ -0,0 +1,19 @@
+output "db_instance_id" {
+  description = "RDS instance ID"
+  value       = aws_db_instance.postgres.id
+}
+
+output "db_instance_endpoint" {
+  description = "RDS instance endpoint"
+  value       = aws_db_instance.postgres.endpoint
+}
+
+output "db_instance_arn" {
+  description = "RDS instance ARN"
+  value       = aws_db_instance.postgres.arn
+}
+
+output "db_security_group_id" {
+  description = "RDS security group ID"
+  value       = aws_security_group.rds.id
+}

modules/rds/variables.tf

@@ -0,0 +1,44 @@
+variable "environment" {
+  description = "Environment name"
+  type        = string
+}
+
+variable "vpc_id" {
+  description = "VPC ID"
+  type        = string
+}
+
+variable "subnet_ids" {
+  description = "List of subnet IDs for RDS"
+  type        = list(string)
+}
+
+variable "instance_class" {
+  description = "RDS instance class"
+  type        = string
+  default     = "db.t3.micro"
+}
+
+variable "allocated_storage" {
+  description = "Allocated storage in GB"
+  type        = number
+  default     = 20
+}
+
+variable "max_allocated_storage" {
+  description = "Maximum allocated storage for autoscaling"
+  type        = number
+  default     = 100
+}
+
+variable "database_name" {
+  description = "Name of the database"
+  type        = string
+  default     = "mydb"
+}
+
+variable "master_username" {
+  description = "Master username"
+  type        = string
+  default     = "admin"
+}

modules/s3/main.tf

@@ -16,23 +16,13 @@ resource "aws_s3_bucket_versioning" "static_content" {
   }
 }
 
-resource "aws_s3_bucket_server_side_encryption_configuration" "static_content" {
-  bucket = aws_s3_bucket.static_content.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
-
 resource "aws_s3_bucket_public_access_block" "static_content" {
   bucket = aws_s3_bucket.static_content.id
 
-  block_public_acls       = true
-  block_public_policy     = true
-  ignore_public_acls      = true
-  restrict_public_buckets = true
+  block_public_acls       = false
+  block_public_policy     = false
+  ignore_public_acls      = false
+  restrict_public_buckets = false
 }
 
 resource "aws_s3_bucket_cors_configuration" "static_content" {
@@ -66,16 +56,6 @@ resource "aws_s3_bucket_versioning" "user_content" {
   }
 }
 
-resource "aws_s3_bucket_server_side_encryption_configuration" "user_content" {
-  bucket = aws_s3_bucket.user_content.id
-
-  rule {
-    apply_server_side_encryption_by_default {
-      sse_algorithm = "AES256"
-    }
-  }
-}
-
 resource "aws_s3_bucket_public_access_block" "user_content" {
   bucket = aws_s3_bucket.user_content.id
 

modules/vpc/main.tf

@@ -17,6 +17,30 @@ resource "aws_vpc" "main" {
   }
 }
 
+resource "aws_default_security_group" "default" {
+  vpc_id = aws_vpc.main.id
+
+  ingress {
+    description = "Allow all inbound"
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name        = "${var.environment}-default-sg"
+    Environment = var.environment
+  }
+}
+
 resource "aws_internet_gateway" "main" {
   vpc_id = aws_vpc.main.id