tf-aws-module_primitive-vpc_security_group_ingress_rule

Overview

This Terraform primitive module manages a single AWS VPC security group ingress rule using the aws_vpc_security_group_ingress_rule resource from the AWS provider (v5.100+).

The module exposes all major functionality of the native resource with sensible defaults and lightweight validation, allowing the AWS provider to handle complex validation logic.

Features

• Complete Resource Coverage: Exposes all major arguments of aws_vpc_security_group_ingress_rule
• Multiple Source Types: Supports IPv4 CIDR, IPv6 CIDR, prefix lists, and security group references
• Protocol Flexibility: Works with TCP, UDP, ICMP, ICMPv6, and all protocols (-1)
• Lightweight Validation: Basic input validation with provider-delegated complex rules
• Idempotent: Safe updates when fields change

Usage

Basic Example - IPv4 CIDR

module "ssh_ingress" {
  source = "github.com/launchbynttdata/tf-aws-module_primitive-vpc_security_group_ingress_rule"

  security_group_id = aws_security_group.example.id
  ip_protocol       = "tcp"
  from_port         = 22
  to_port           = 22
  cidr_ipv4         = "10.0.1.0/24"
  description       = "Allow SSH from internal network"
}

IPv6 Example

module "https_ingress_ipv6" {
  source = "github.com/launchbynttdata/tf-aws-module_primitive-vpc_security_group_ingress_rule"

  security_group_id = aws_security_group.example.id
  ip_protocol       = "tcp"
  from_port         = 443
  to_port           = 443
  cidr_ipv6         = "::/0"
  description       = "Allow HTTPS from anywhere (IPv6)"
}

Security Group to Security Group

module "database_ingress" {
  source = "github.com/launchbynttdata/tf-aws-module_primitive-vpc_security_group_ingress_rule"

  security_group_id            = aws_security_group.database.id
  ip_protocol                  = "tcp"
  from_port                    = 5432
  to_port                      = 5432
  referenced_security_group_id = aws_security_group.application.id
  description                  = "Allow PostgreSQL from application tier"
}

Prefix List Example

module "https_ingress_prefix_list" {
  source = "github.com/launchbynttdata/tf-aws-module_primitive-vpc_security_group_ingress_rule"

  security_group_id = aws_security_group.example.id
  ip_protocol       = "tcp"
  from_port         = 443
  to_port           = 443
  prefix_list_id    = aws_ec2_managed_prefix_list.example.id
  description       = "Allow HTTPS from managed prefix list"
}

Examples

The examples/ directory contains several working examples:

• complete - Multiple ingress rules with different configurations
• minimal - Minimal configuration with a single SSH rule
• ipv6 - IPv6 CIDR source examples
• prefix_list - Using managed prefix lists as sources
• sg_to_sg - Security group to security group peering

Requirements

Name	Version
terraform	~> 1.0
aws	~> 5.100

Providers

Name	Version
aws	~> 5.100

Inputs

Name	Description	Type	Default	Required
security_group_id	The ID of the security group to which this ingress rule will be attached	string	n/a	yes
ip_protocol	The IP protocol name or number. Use '-1' to specify all protocols	string	n/a	yes
from_port	The start of port range for TCP/UDP, or ICMP type number	number	null	no
to_port	The end of port range for TCP/UDP, or ICMP code	number	null	no
cidr_ipv4	The source IPv4 CIDR range	string	null	no
cidr_ipv6	The source IPv6 CIDR range	string	null	no
prefix_list_id	The ID of the prefix list for the source	string	null	no
referenced_security_group_id	The ID of the source security group	string	null	no
description	The description of this ingress rule	string	null	no

Outputs

Name	Description
id	The Terraform resource ID of the security group ingress rule
security_group_rule_id	The AWS-assigned unique identifier for the security group rule
security_group_id	The ID of the security group to which this ingress rule is attached
ingress_rule_effective_source	A canonical string describing the effective source (CIDR, prefix list, or security group)
arn	The ARN of the security group rule
tags_all	A map of tags assigned to the resource

Behavior & Limitations

Source Mutual Exclusivity

Exactly one source parameter must be specified:

• cidr_ipv4
• cidr_ipv6
• prefix_list_id
• referenced_security_group_id

The module will fail validation if none or multiple sources are provided.

Port Requirements

For TCP and UDP protocols:

• Both from_port and to_port are required
• from_port must be ≤ to_port
• Valid range: 0-65535

For protocol -1 (all):

• Ports should be null or omitted

For ICMP/ICMPv6:

• from_port = ICMP type
• to_port = ICMP code
• Use -1 for any type/code

Protocol Values

• Named protocols: tcp, udp, icmp, icmpv6
• Protocol numbers: 6 (TCP), 17 (UDP), etc.
• All protocols: -1

See IANA Protocol Numbers for reference.

Development

Prerequisites

• Terraform ~> 1.0
• Go ~> 1.24 (for testing)
• pre-commit (installed via framework)
• AWS credentials configured

Setup

# Bootstrap development environment
make configure

# Install pre-commit hooks
pre-commit install

Testing

# Run all checks (fmt, validate, lint, unit tests)
make check

# Run integration tests for an example
cd examples/complete
terraform init
terraform plan -var-file=test.tfvars
terraform apply -var-file=test.tfvars
terraform destroy -var-file=test.tfvars

Pre-commit Hooks

The framework includes pre-commit hooks for:

• Terraform formatting
• Terraform validation
• TFLint
• Documentation generation
• Security scanning

Contributing

See CONTRIBUTING.md for guidelines.

License

This module is licensed under the Apache License 2.0. See LICENSE for details.

Authors

Maintained by Launch by NTT DATA.

Requirements

Name	Version
terraform	~> 1.0
aws	~> 5.100

Modules

No modules.

Resources

Name	Type
aws_vpc_security_group_ingress_rule.this	resource

Inputs

Name	Description	Type	Default	Required
cidr_ipv4	The source IPv4 CIDR range for this ingress rule. Mutually exclusive with cidr_ipv6, prefix_list_id, and referenced_security_group_id.	string	null	no
cidr_ipv6	The source IPv6 CIDR range for this ingress rule. Mutually exclusive with cidr_ipv4, prefix_list_id, and referenced_security_group_id.	string	null	no
description	The description of this ingress rule.	string	null	no
from_port	The start of port range for the TCP and UDP protocols, or an ICMP type number. Required for tcp and udp protocols. Use -1 for ICMP type.	number	null	no
ip_protocol	The IP protocol name or number. Use '-1' to specify all protocols. Protocol numbers: https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml	string	n/a	yes
prefix_list_id	The ID of the prefix list for the source of this ingress rule. Mutually exclusive with cidr_ipv4, cidr_ipv6, and referenced_security_group_id.	string	null	no
referenced_security_group_id	The ID of the source security group for this ingress rule. Mutually exclusive with cidr_ipv4, cidr_ipv6, and prefix_list_id.	string	null	no
security_group_id	The ID of the security group to which this ingress rule will be attached.	string	n/a	yes
tags	A map of tags to assign to the ingress rule.	map(string)	{}	no
to_port	The end of port range for the TCP and UDP protocols, or an ICMP code. Required for tcp and udp protocols. Use -1 for ICMP code.	number	null	no

Outputs

Name	Description
arn	The ARN of the security group rule.
id	The Terraform resource ID of the security group ingress rule.
ingress_rule_effective_source	A canonical string describing the effective source for this ingress rule (CIDR, prefix list, or security group).
security_group_id	The ID of the security group to which this ingress rule is attached.
security_group_rule_id	The AWS-assigned unique identifier for the security group rule.
tags_all	A map of tags assigned to the resource, including those inherited from the provider default_tags.