scottslowe-learning-tools/terraform/aws/bastion-aws/security.tf

# Create a security group to allow SSH traffic to private host(s) only from bastion
resource "aws_security_group" "private_sg" {
  vpc_id      = "${aws_vpc.bastion_vpc.id}"
  name        = "private-sg"
  description = "Security group for web traffic to private hosts"

  ingress {
    from_port   = "22"
    to_port     = "22"
    protocol    = "tcp"
    cidr_blocks = ["10.2.1.0/24"]
  }

  egress {
    from_port   = "0"
    to_port     = "0"
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags {
    tool = "terraform"
    demo = "bastion-aws"
    area = "security"
  }
}

# Create a security group to allow inbound SSH (for bastion only)
resource "aws_security_group" "bastion_sg" {
  vpc_id      = "${aws_vpc.bastion_vpc.id}"
  name        = "bastion-sg"
  description = "Security group for SSH bastion host"

  ingress {
    from_port   = "22"
    to_port     = "22"
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    from_port   = "0"
    to_port     = "0"
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags {
    tool = "terraform"
    demo = "bastion-aws"
    area = "security"
  }
}