8f5ff2aff3
Major components are scripted out here however a gateway + EIP still need to be configured for full base level infra "doneness"
57 lines
1.3 KiB
HCL
57 lines
1.3 KiB
HCL
# Here are general definitions for security rulesets
|
|
|
|
resource "aws_security_group" "basic_web_sec" {
|
|
name = "General web server ruleset"
|
|
description = "Allowing strictly web traffic"
|
|
# Intake of web requests(only serving TLS enabled traffic)
|
|
ingress {
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
from_port = 443
|
|
to_port = 443
|
|
protocol = "tcp"
|
|
}
|
|
# WARN: Due to the usage of debian based images this rule
|
|
# is effectively required in order to properly update
|
|
# the system as apt mostly talks over port 443(maybe port 80 too?)
|
|
egress {
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
from_port = 443
|
|
to_port = 443
|
|
protocol = "tcp"
|
|
}
|
|
}
|
|
|
|
resource "aws_security_group" "internal_ssh_recv" {
|
|
ingress {
|
|
cidr_blocks = [var.crete_cidr]
|
|
from_port = 22
|
|
to_port = 22
|
|
protocol = "tcp"
|
|
}
|
|
}
|
|
|
|
# Main role: SSH host/dev box(not to be up 24/7)
|
|
# Note this one is kinda special because the dev box
|
|
# itself is _kinda_ special(?)
|
|
resource "aws_security_group" "gamma_sec" {
|
|
ingress {
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
from_port = 22
|
|
to_port = 22
|
|
protocol = "tcp"
|
|
}
|
|
egress {
|
|
cidr_blocks = [ var.crete_cidr ]
|
|
from_port = 22
|
|
to_port = 22
|
|
protocol = "tcp"
|
|
}
|
|
# Again this is for APT to update repo's when needed
|
|
egress {
|
|
cidr_blocks = ["0.0.0.0/0"]
|
|
from_port = 443
|
|
to_port = 443
|
|
protocol = "tcp"
|
|
}
|
|
}
|