Support granting source security group IDs access to consul-cluster

[sclausson]

To be consistent with vault-cluster module there should be variables for allowed_ssh_security_group_ids and allowed_inbound_security_group_ids to allow security group IDs to access the cluster (in addition to, or instead of cidr_blocks).

Could be implemented exactly the same way in consul-cluster/main.tf

resource "aws_security_group_rule" "allow_ssh_inbound_from_security_group_ids" {
  count                    = "${length(var.allowed_ssh_security_group_ids)}"
  type                     = "ingress"
  from_port                = "${var.ssh_port}"
  to_port                  = "${var.ssh_port}"
  protocol                 = "tcp"
  source_security_group_id = "${element(var.allowed_ssh_security_group_ids, count.index)}"

  security_group_id = "${aws_security_group.lc_security_group.id}"
}

and multiple aws_security_group_rule resources in consul-security-group-rules/main.tf

resource "aws_security_group_rule" "allow_<some_protocol>_inbound_from_security_group_ids" {
  count                    = "${length(var.allowed_inbound_security_group_ids)}"
  type                     = "ingress"
  from_port                = "${var.<some_protocol>_port}"
  to_port                  = "${var.<some_protocol>_port}"
  protocol                 = "<tcp or udp>"
  source_security_group_id = "${element(var.allowed_inbound_security_group_ids, count.index)}"

  security_group_id = "${var.security_group_id}"
}

[brikis98]

Agreed! PR welcome :)

[sclausson]

#14

[sclausson]

Thanks for merging!