cloudposse / cloudposse/terraform-aws-documentdb-cluster
allow optional / no egress security rule
- Dominant language
- HCL
- Stars
- 70
- Forks
- 99
- PR merge metrics
- No merged PRs in 30d
Description
## Describe the Feature
I would like the option to disable the egress security rule deployed by the module
```hcl
resource "aws_security_group_rule" "egress" {
count = module.this.enabled ? 1 : 0
type = "egress"
description = "Allow all egress traffic"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = join("", aws_security_group.default.*.id)
}
```
## Expected Behavior
Allow to disable (optional) to remove the security group. The outbound rule isn't required as security groups are statefull and the document db itself won't open a connection to the outside.
## Use Case
Scanning the file with TF_SEC throws an error
```
Problem 1
[AWS007][WARNING] Resource 'module.docdb_cluster:aws_security_group_rule.egress' defines a fully open egress security group rule.
13 | from_port = 0
14 | to_port = 0
15 | protocol = "-1"
16 | cidr_blocks = ["0.0.0.0/0"]
17 | security_group_id = join("", aws_security_group.default.*.id)
18 | }
19 |
See https://tfsec.dev/docs/aws/AWS007/ for more information.
disk i/o 114.710197ms
parsing HCL 576.897µs
evaluating values 94.868063ms
running checks 996.996µs
files loaded 23
1 potential problems detected.
```
## Describe Ideal Solution
Allow to disable (optional) to remove the security group. The outbound rule isn't required as security groups are statefull and the document db itself won't open a connection to the outside.
Contributor guide
Research direction
Start with the aws_security_group_rule.egress resource shown in the issue and inspect the module's variable definitions and security-group resources. Reproduce the TF_SEC scan, then verify that users can optionally omit the fully open egress rule while the existing default behavior remains intact.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, terraform
- Domain
- cloud, databases, security
- Issue type
- Feature
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100