Cloud

Security Group Rule Builder

Build security-group rules as Terraform or CLI commands, with admin ports open to the internet flagged.

Rules
General notes
  • No egress rules listed. A new security group starts with allow-all egress, so leaving it out keeps that default rather than denying outbound traffic.
Output
resource "aws_security_group" "web" {
  name        = "web"
  description = "Managed by Terraform"
  vpc_id      = var.vpc_id

  # Rules are separate resources rather than inline blocks: inline
  # rules and aws_vpc_security_group_*_rule cannot be mixed, and the
  # separate form lets a rule change without replacing the group.

  tags = {
    Name = "web"
  }
}

resource "aws_vpc_security_group_ingress_rule" "web_ingress_0" {
  security_group_id = aws_security_group.web.id
  description       = "HTTPS from anywhere"
  cidr_ipv4         = "0.0.0.0/0"
  ip_protocol       = "tcp"
  from_port         = 443
  to_port           = 443
}

resource "aws_vpc_security_group_ingress_rule" "web_ingress_1" {
  security_group_id = aws_security_group.web.id
  description       = "SSH from the VPC only"
  cidr_ipv4         = "10.0.0.0/8"
  ip_protocol       = "tcp"
  from_port         = 22
  to_port           = 22
}