Skip to content

Conversation

kirkchong
Copy link

@kirkchong kirkchong commented Oct 4, 2025

Description

This PR changes the use of aws_security_group_rule to aws_vpc_security_ingress/egress_rule

Motivation and Context

As discussed in 327, switching to use aws_vpc_ingress/egress_rule will allow the usage of tags and is the recommended way going forward.

Breaking Changes

A full rename of variables, fields as its a change of resources, and to keep the naming pattern consistent.
Notably:

  • variable name changes as per variables.tf
  • field name changes
    {
      from_port   = 15
      to_port     = 25
      ip_protocol = 6 # changed from protocol # changed from protocol
      description = "Service name with vpc cidr"
      cidr_ipv4   = module.vpc.vpc_cidr_block  #changed from cidr_blocks
    },
    {
      from_port   = 300
      to_port     = 400
      ip_protocol = "tcp"
      description = "Service ports (ipv6)"
      cidr_ipv6   = "2001:db8::/64" # changed from ipv6_cidr_blocks
    },
      {
      from_port                    = 10
      to_port                      = 10
      ip_protocol                  = 6
      description                  = "Service name"
      referenced_security_group_id = data.aws_security_group.default.id #changed from source_security_group_id
    },
  • comma separated values like in cidr_blocks are no longer possible
 ingress_with_cidr_ipv4 = [
    {
      rule      = "postgresql-tcp"
      cidr_ipv4 = "0.0.0.0/0"  # "0.0.0.0/0,1.1.1.1/32" is no longer possible
    },

How Has This Been Tested?

  • I have updated at least one of the examples/* to demonstrate and validate my change(s)
  • I have tested and validated these changes using one or more of the provided examples/* projects

I tested the changes individually for each resources with multiple configurations (e.g. 2 prefix list * 3 ingress rules etc)
I do intend to squash my commits, please go through them individually as I find it easier to review.
My constraints while writing this: "aws_security_group" allows for multiple fields of multiple values, such as having prefix_list_ids and cidr_blocks="1.1.1.1/32,0.0.0.0/0", for aws_vpc_security_ingress, only one field and one value is supported.

@kirkchong kirkchong changed the title Feat/upgrade to aws vpc security group rule feat: upgrade to aws vpc security group rule Oct 4, 2025
@kirkchong kirkchong changed the title feat: upgrade to aws vpc security group rule feat: Upgrade to aws vpc security group rule Oct 4, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant