-
Notifications
You must be signed in to change notification settings - Fork 0
/
security groups.tf
132 lines (125 loc) · 3.13 KB
/
security groups.tf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
#####################################
# security group for bastion-server
#####################################
resource "aws_security_group" "skyage-bastion-sg" {
name = "bastion-sg"
description = "Allow port 22 from anywhere"
vpc_id = aws_vpc.skyage_vpc.id
tags = {
"Name" = "sg-for-bastion-server"
}
ingress {
description = "Allow port 22 from anywhere"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
description = "Allow All"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
############################
# security group for ALB
############################
resource "aws_security_group" "skyage-ALB-SG" {
name = "ALB-SG"
description = "Allow port 80 and 443 from anywhere"
vpc_id = aws_vpc.skyage_vpc.id
tags = {
"Name" = "sg-for-skyage-alb"
}
ingress {
description = "Allow port 80 from anywhere"
from_port = 80
to_port = 80
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
/*
ingress {
description = "Allow port 443 from anywhere"
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
*/
egress {
description = "Allow All"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
###################################
# security group for app-servers
###################################
resource "aws_security_group" "skyage-App-SG" {
name = "App-SG"
description = "Allow port 22 from bastion-sg and 80 from ALB-SG"
vpc_id = aws_vpc.skyage_vpc.id
tags = {
"Name" = "sg-for-app-servers"
}
ingress {
from_port = 22
to_port = 22
protocol = "tcp"
security_groups = [aws_security_group.skyage-bastion-sg.id]
description = "allow-trrafic-from-bastion-sg-only"
}
ingress {
from_port = 80
to_port = 80
protocol = "tcp"
security_groups = [aws_security_group.skyage-ALB-SG.id]
description = "allow-trrafic-from-ALB-SG-only"
}
/*
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
security_groups = [aws_security_group.skyage-ALB-SG.id]
description = "allow-trrafic-from-ALB-SG-only"
}
*/
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
description = "Allow All"
}
}
###################################
# security group for RDS-server
###################################
resource "aws_security_group" "skyage-DB-SG" {
name = "DB-SG"
description = "Allow port 3306 from App-SG only"
vpc_id = aws_vpc.skyage_vpc.id
tags = {
"Name" = "sg-for-RDS-server"
}
ingress {
from_port = 3306
to_port = 3306
protocol = "tcp"
security_groups = [aws_security_group.skyage-App-SG.id]
description = "allow-trrafic-from-App-SG-only"
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
description = "Allow All"
}
}