cloudposse / cloudposse/terraform-aws-documentdb-cluster

allow optional / no egress security rule

Open
#34 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
HCL
Stars
70
Forks
99
PR merge metrics
No merged PRs in 30d

Description

## Describe the Feature

I would like the option to disable the egress security rule deployed by the module

```hcl
resource "aws_security_group_rule" "egress" {
count = module.this.enabled ? 1 : 0
type = "egress"
description = "Allow all egress traffic"
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
security_group_id = join("", aws_security_group.default.*.id)
}
```

## Expected Behavior

Allow to disable (optional) to remove the security group. The outbound rule isn't required as security groups are statefull and the document db itself won't open a connection to the outside.

## Use Case

Scanning the file with TF_SEC throws an error

```
Problem 1

[AWS007][WARNING] Resource 'module.docdb_cluster:aws_security_group_rule.egress' defines a fully open egress security group rule.

13 | from_port = 0
14 | to_port = 0
15 | protocol = "-1"
16 | cidr_blocks = ["0.0.0.0/0"]
17 | security_group_id = join("", aws_security_group.default.*.id)
18 | }
19 |

See https://tfsec.dev/docs/aws/AWS007/ for more information.

disk i/o 114.710197ms
parsing HCL 576.897µs
evaluating values 94.868063ms
running checks 996.996µs
files loaded 23

1 potential problems detected.
```

## Describe Ideal Solution

Allow to disable (optional) to remove the security group. The outbound rule isn't required as security groups are statefull and the document db itself won't open a connection to the outside.

Contributor guide

Open the contributing guide

Research direction

Start with the aws_security_group_rule.egress resource shown in the issue and inspect the module's variable definitions and security-group resources. Reproduce the TF_SEC scan, then verify that users can optionally omit the fully open egress rule while the existing default behavior remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, terraform
Domain
cloud, databases, security
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.