Support source security group id ingress access to cluster #14
Conversation
sclausson
force-pushed
the
support-sg-ids
branch
2 times, most recently
from
53ca55a to
99988de
Compare
|
Plan runs ok locally, so not sure why/where the automated tests are failing. |
modules/consul-cluster/main.tf
Outdated
| @@ -95,6 +95,7 @@ resource "aws_security_group" "lc_security_group" { | |||
| } | |||
|
|
|||
| resource "aws_security_group_rule" "allow_ssh_inbound" { | |||
| count = "${length(var.allowed_inbound_cidr_blocks) >= 1 ? 1 : 0}" | |||
There was a problem hiding this comment.
Should this be allowed_ssh_cidr_blocks?
There was a problem hiding this comment.
Good catch. I've corrected this.
modules/consul-cluster/variables.tf
Outdated
| @@ -24,6 +24,11 @@ variable "allowed_inbound_cidr_blocks" { | |||
| type = "list" | |||
| } | |||
|
|
|||
| variable "allowed_inbound_security_group_ids" { | |||
| description = "A list of security group IDs that will be allowed to connect to Consul" | |||
| type = "list" | |||
There was a problem hiding this comment.
For backwards compatibility, should probably default this to an empty list.
There was a problem hiding this comment.
I've now set this to default = []
| @@ -92,3 +101,101 @@ resource "aws_security_group_rule" "allow_dns_udp_inbound" { | |||
| security_group_id = "${var.security_group_id}" | |||
| } | |||
|
|
|||
| resource "aws_security_group_rule" "allow_server_rpc_inbound_from_security_group_ids" { | |||
| count = "${length(var.allowed_inbound_security_group_ids)}" | |||
There was a problem hiding this comment.
Is allowed_inbound_security_group_ids a new input variable for the consul-security-group-rules module? If so, don't you need to add it to its vars.tf and pass it in from the consul-cluster module?
There was a problem hiding this comment.
Good catch. I have made these changes.
sclausson
force-pushed
the
support-sg-ids
branch
2 times, most recently
from
49f2db5 to
19c6547
Compare
|
I think this should be ok now. |
| @@ -12,6 +12,11 @@ variable "allowed_inbound_cidr_blocks" { | |||
| type = "list" | |||
| } | |||
|
|
|||
| variable "allowed_inbound_security_group_ids" { | |||
| description = "A list of security group IDs that will be allowed to connect to Consul" | |||
| type = "list" | |||
There was a problem hiding this comment.
This should probably default to an empty list for backwards compatibility
sclausson
force-pushed
the
support-sg-ids
branch
from
19c6547 to
fcaad6c
Compare
|
@brikis98 I've made one final requested change and added a default value to |
|
Fantastic, thank you! |
Clean up hackery required by Terraform 0.9.5 regression.
No description provided.