Skip to content

feat: addition of ingress_with_prefix_list_ids and egress_with_prefix_list_ids #226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from

Conversation

schniber
Copy link

Description

This feature aims at allowing the module to provision SG Rules by specifying explicitly the ingress or ingress rules with prefix lists. It also allows to unset a new variable enable_prefix_lists_cross_over which drives whether there should be cross over flow openings between the inputs (self, cidr blocks, or security groups) and the prefix lists.

Motivation and Context

This will allow to have better control over the ingress / egress rules that can be created that rely on prefix_lists in conjunction with the other inputs (self, source sg or cidr blocks)
This feature has been inspired from this issue https://github.com/terraform-aws-modules/terraform-aws-security-group/issues/224

Breaking Changes

Nope this change assures backward compatibility since new variables were created.
In addition, the default value of enable_prefix_lists_cross_over is set to true in order to perpetuate the old behaviour.

How Has This Been Tested?

  • [ X ] I have tested and validated these changes using one or more of the provided examples/* projects
    The feature has been tested according to the update of the complete sg example.
    From a pure feature implementation perspective, the code works. However, I hit the following error which is for me a Terraform bug (since the ingress rule is successfully created on AWS) :

Error: [WARN] A duplicate Security Group rule was found on (sg-03f7058fc9696e5b0). This may be
│ a side effect of a now-fixed Terraform issue causing two security groups with
│ identical attributes but different source_security_group_ids to overwrite each
│ other in the state. See hashicorp/terraform#2376 for more
│ information and instructions for recovery. Error: InvalidPermission.Duplicate: the specified rule "peer: pl-6da54004, TCP, from port: 2049, to port: 2049, ALLOW" already exists
│ status code: 400, request id: 6f21e4aa-8861-4d25-8638-5b97582a79de

│ with module.complete_sg.aws_security_group_rule.ingress_with_prefix_list_ids[0],
│ on ../../main.tf line 422, in resource "aws_security_group_rule" "ingress_with_prefix_list_ids":
│ 422: resource "aws_security_group_rule" "ingress_with_prefix_list_ids" {

Unfortunately, I don't know how to move forward with the Terraform bug since it looks like it's an issue in persisting the creation of the Ingress rule on the tf state itself.

I'd be happy to know more about it and collaborate on it to solve it.

Thanks in advance.

Bests.

@github-actions
Copy link

This PR has been automatically marked as stale because it has been open 30 days
with no activity. Remove stale label or comment or this PR will be closed in 10 days

@github-actions github-actions bot added the stale label Jan 11, 2022
@github-actions
Copy link

This PR was automatically closed because of stale in 10 days

@github-actions
Copy link

I'm going to lock this pull request because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems related to this change, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 15, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant