feat: addition of ingress_with_prefix_list_ids and egress_with_prefix_list_ids #226
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This feature aims at allowing the module to provision SG Rules by specifying explicitly the ingress or ingress rules with prefix lists. It also allows to unset a new variable enable_prefix_lists_cross_over which drives whether there should be cross over flow openings between the inputs (self, cidr blocks, or security groups) and the prefix lists.
Motivation and Context
This will allow to have better control over the ingress / egress rules that can be created that rely on prefix_lists in conjunction with the other inputs (self, source sg or cidr blocks)
This feature has been inspired from this issue https://github.com/terraform-aws-modules/terraform-aws-security-group/issues/224
Breaking Changes
Nope this change assures backward compatibility since new variables were created.
In addition, the default value of enable_prefix_lists_cross_over is set to true in order to perpetuate the old behaviour.
How Has This Been Tested?
examples/*
projectsThe feature has been tested according to the update of the complete sg example.
From a pure feature implementation perspective, the code works. However, I hit the following error which is for me a Terraform bug (since the ingress rule is successfully created on AWS) :
Error: [WARN] A duplicate Security Group rule was found on (sg-03f7058fc9696e5b0). This may be
│ a side effect of a now-fixed Terraform issue causing two security groups with
│ identical attributes but different source_security_group_ids to overwrite each
│ other in the state. See hashicorp/terraform#2376 for more
│ information and instructions for recovery. Error: InvalidPermission.Duplicate: the specified rule "peer: pl-6da54004, TCP, from port: 2049, to port: 2049, ALLOW" already exists
│ status code: 400, request id: 6f21e4aa-8861-4d25-8638-5b97582a79de
│
│ with module.complete_sg.aws_security_group_rule.ingress_with_prefix_list_ids[0],
│ on ../../main.tf line 422, in resource "aws_security_group_rule" "ingress_with_prefix_list_ids":
│ 422: resource "aws_security_group_rule" "ingress_with_prefix_list_ids" {
│
Unfortunately, I don't know how to move forward with the Terraform bug since it looks like it's an issue in persisting the creation of the Ingress rule on the tf state itself.
I'd be happy to know more about it and collaborate on it to solve it.
Thanks in advance.
Bests.