From 8752b367eae3ac49ec7998cee4b9b89921a9e824 Mon Sep 17 00:00:00 2001 From: sj-williams Date: Wed, 11 Sep 2024 13:02:03 +0100 Subject: [PATCH] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20add=20new=20eks=20subnet?= =?UTF-8?q?s=20to=20rds=20security=20groups?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- main.tf | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-) diff --git a/main.tf b/main.tf index 0cf1002..81d439c 100644 --- a/main.tf +++ b/main.tf @@ -60,6 +60,22 @@ data "aws_subnet" "private" { id = each.value } +data "aws_subnets" "eks_private" { + filter { + name = "vpc-id" + values = [data.aws_vpc.this.id] + } + + tags = { + SubnetType = "EKS-Private" + } +} + +data "aws_subnet" "eks_private" { + for_each = toset(data.aws_subnets.eks_private.ids) + id = each.value +} + ######################## # Generate identifiers # ######################## @@ -123,18 +139,24 @@ resource "aws_security_group" "rds-sg" { # cyclic dependency. Rather than resorting to `aws_security_group_rule` which # is not ideal for managing rules, we will simply allow traffic to all ports. # This does not compromise security as the instance only listens on one port. - ingress { +ingress { from_port = 0 to_port = 0 protocol = "-1" - cidr_blocks = [for s in data.aws_subnet.private : s.cidr_block] + cidr_blocks = concat( + [for s in data.aws_subnet.private : s.cidr_block], + [for s in data.aws_subnet.eks_private : s.cidr_block] + ) } egress { from_port = 0 to_port = 0 protocol = "-1" - cidr_blocks = [for s in data.aws_subnet.private : s.cidr_block] + cidr_blocks = concat( + [for s in data.aws_subnet.private : s.cidr_block], + [for s in data.aws_subnet.eks_private : s.cidr_block] + ) } }