terraform-aws-sensor/security_groups.tf at main · corelight/terraform-aws-sensor · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
resource "aws_security_group" "monitoring" {
  name        = var.sensor_monitoring_security_group_name
  description = var.sensor_monitoring_security_group_description
  vpc_id      = data.aws_vpc.provided.id

  tags = merge({ Name : var.sensor_monitoring_security_group_name }, var.tags)
}

resource "aws_security_group_rule" "geneve_mirror_traffic_rule" {
  type              = "ingress"
  from_port         = 6081
  to_port           = 6081
  protocol          = "udp"
  security_group_id = aws_security_group.monitoring.id
  description       = "Gateway Load Balancer (GENEVE)"
  cidr_blocks       = [data.aws_vpc.provided.cidr_block]
}

resource "aws_security_group_rule" "monitor_traffic_rule" {
  type              = "ingress"
  from_port         = var.sensor_health_check_http_port
  to_port           = var.sensor_health_check_http_port
  protocol          = "tcp"
  security_group_id = aws_security_group.monitoring.id
  description       = "GWLB Health Check Port"
  cidr_blocks       = [data.aws_vpc.provided.cidr_block]
}

resource "aws_security_group_rule" "public_network_egress_all" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  security_group_id = aws_security_group.monitoring.id
  description       = "Default egress rule"
  cidr_blocks       = ["0.0.0.0/0"]
}

resource "aws_security_group" "management" {
  name        = var.sensor_management_security_group_name
  description = var.sensor_management_security_group_description
  vpc_id      = data.aws_vpc.provided.id

  tags = merge({ Name : var.sensor_management_security_group_name }, var.tags)
}

resource "aws_security_group_rule" "management_network_egress_all" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  security_group_id = aws_security_group.management.id
  cidr_blocks       = ["0.0.0.0/0"]
}

resource "aws_security_group_rule" "management_ssh" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  security_group_id = aws_security_group.management.id

  cidr_blocks = [data.aws_vpc.provided.cidr_block]
  description = "SSH for Corelight Sensor Admins"
}