feature request: default_egress rules to security groups

[tokiwong]

I have a use case that involves outgoing connections from the aurora rds cluster

I propose an additional resource to main.tf like so:

resource "aws_security_group_rule" "default_egress" {
  count = "${var.allowed_security_groups_count}"

  type                     = "egress"
  from_port                = "${aws_rds_cluster.this.port}"
  to_port                  = "${aws_rds_cluster.this.port}"
  protocol                 = "tcp"
  source_security_group_id = "${element(var.allowed_security_groups, count.index)}"
  security_group_id        = "${aws_security_group.this.id}"
}

[bryantbiggs]

hi @tokiwong - because the cluster itself does not initiate outbound connections on its own I would lean towards this addition not fitting well with the module

[ppihus]

I'd like to open this again.
There can be a need for egress in case of database replication tasks. In that case, the database does initiate outbound connections.

[kpbll]

Hi! Also it would be useful for using the SG to put into it RDS proxies ...

[gowthamakanthan]

I'd like to open this again. There can be a need for egress in case of database replication tasks. In that case, the database does initiate outbound connections.

I agree with @ppihus, We need to have egress for the replication. Could someone please check?

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.