make sg better

Author: brunodasilvalenga

security_groups.tf

@@ -8,14 +8,15 @@ resource "aws_security_group" "redis_security_group" {
   }
 }
 
-resource "aws_security_group_rule" "redis_ingress" {
-  count                    = length(var.allowed_security_groups)
+resource "aws_security_group_rule" "redis_inbound_from_sg" {
+  for_each                 = { for security_group_id in var.allow_security_group_ids : security_group_id.name => security_group_id }
   type                     = "ingress"
   from_port                = var.redis_port
   to_port                  = var.redis_port
   protocol                 = "tcp"
-  source_security_group_id = element(var.allowed_security_groups, count.index)
+  source_security_group_id = each.value.security_group_id
   security_group_id        = aws_security_group.redis_security_group.id
+  description              = try(each.value.description, "From ${each.value.security_group_id}")
 }
 
 resource "aws_security_group_rule" "redis_networks_ingress" {

variables.tf

@@ -23,12 +23,16 @@ variable "apply_immediately" {
 variable "allowed_cidr" {
   description = "A list of Security Group ID's to allow access to."
   type        = list(string)
-  default     = ["127.0.0.1/32"]
+  default     = []
 }
 
-variable "allowed_security_groups" {
-  description = "A list of Security Group ID's to allow access to."
-  type        = list(string)
+variable "allow_security_group_ids" {
+  type        = list(object({
+    security_group_id = string
+    description = string
+    name = string
+  }))
+  description = "List of Security Group IDs to allow connection to."
   default     = []
 }