locals {
  ingress-alb = [
    { from_port = 80, to_port = 80, source_sg_id = module.sg-alb.sg_id, description = "Allow inbound http from ALBs" },
    { from_port = 80, to_port = 80, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound http from windows EC2" },
    { from_port = 80, to_port = 80, source_sg_id = module.sg-lin-ws.sg_id, description = "Allow inbound http from linux EC2" },
    { from_port = 80, to_port = 80, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound http from ECS containers" },
    { from_port = 443, to_port = 443, source_sg_id = module.sg-alb.sg_id, description = "Allow inbound https from ALBs" },
    { from_port = 443, to_port = 443, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound https from windows EC2" },
    { from_port = 443, to_port = 443, source_sg_id = module.sg-lin-ws.sg_id, description = "Allow inbound https from linux EC2" },
    { from_port = 443, to_port = 443, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound https from ECS containers" },
    { from_port = 443, to_port = 443, source_sg_id = module.sg-lambda.sg_id, description = "Allow inboount https from Lambda" },
  ]
  ingress-docdb = [
    { from_port = 27017, to_port = 27019, source_sg_id = module.sg-docdb.sg_id, description = "Allow DocDB" },
    { from_port = 27017, to_port = 27019, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound connections from ECS" },
  ]
  ingress-win-ws = [
    { from_port = 80, to_port = 80, source_sg_id = module.sg-alb.sg_id, description = "Allow inbound http from ALBs" },
    { from_port = 80, to_port = 80, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound http from windows EC2" }
  ]
  ingress-lin-ws = [
    { from_port = 80, to_port = 80, source_sg_id = module.sg-alb.sg_id, description = "Allow inbound http from ALBs" },
    { from_port = 80, to_port = 80, source_sg_id = module.sg-lin-ws.sg_id, description = "Allow inbound http from linux EC2" }
  ]
  ingress-ecs = [
    { from_port = 80, to_port = 80, source_sg_id = module.sg-alb.sg_id, description = "Allow inbound http from ALBs" },
    { from_port = 80, to_port = 80, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound http from ECS" },
    { from_port = 8080, to_port = 8080, source_sg_id = module.sg-alb.sg_id, description = "Allow inbound http from ALBs" },
    { from_port = 8080, to_port = 8080, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound http from ECS" },
    { from_port = 8000, to_port = 8000, source_sg_id = module.sg-alb.sg_id, description = "Allow inbound http from ALBs" },
    { from_port = 8000, to_port = 8000, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound http from ECS" },
  ]
  ingress-es = [
    { from_port = 443, to_port = 443, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound connections from ECS" },
    { from_port = 443, to_port = 443, source_sg_id = module.sg-lambda.sg_id, description = "Allow inbound connections from Lambda" },
    { from_port = 443, to_port = 443, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound connections from EC2" },
    { from_port = 443, to_port = 443, source_sg_id = module.sg-lin-ws.sg_id, description = "Allow inbound connections from EC2" },
  ]
  ingress-adminaccounts = [
    { from_port = 13731, to_port = 13731, source_sg_id = module.sg-alb.sg_id, description = "Allow inbount http from ALBs" },
  ]
  ingress-redis = [
    { from_port = 6379, to_port = 6379, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound connections from ECS" },
    { from_port = 6379, to_port = 6379, source_sg_id = module.sg-lambda.sg_id, description = "Allow inbound connections from Lambda" },
    { from_port = 6379, to_port = 6379, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound connections from EC2" },
  ]
  ingress-postgres = [
    { from_port = 5432, to_port = 5432, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound connections from ECS" },
    { from_port = 5432, to_port = 5432, source_sg_id = module.sg-lambda.sg_id, description = "Allow inbound connections from Lambda" },
  ]
  ingress-couchbase = [
    { from_port = 4369, to_port = 4369, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound unencrypted node-to-node connections (erlang port mapper)." },
    { from_port = 9100, to_port = 9105, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound unencrypted node-to-node connections (indexer)." },
    { from_port = 9110, to_port = 9118, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound unencrypted node-to-node connections (Analytics)." },
    { from_port = 9120, to_port = 9122, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound unencrypted node-to-node connections (Analytics)." },
    { from_port = 9130, to_port = 9130, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound unencrypted node-to-node connections (gprc)." },
    { from_port = 9999, to_port = 9999, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound unencrypted node-to-node connections (indexer)." },
    { from_port = 11209, to_port = 11210, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound unencrypted node-to-node connections (memcached)." },
    { from_port = 21100, to_port = 21299, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound encrypted node-to-node connections (memcached)." },
    { from_port = 8091, to_port = 8096, source_sg_id = module.sg-couchbase.sg_id, description = "Allow inbound unencrypted client connections to Couchbase." },
    { from_port = 8091, to_port = 8096, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound unencrypted client connections to Couchbase." },
    { from_port = 18091, to_port = 18096, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound encrypted client connections to Couchbase." },
    { from_port = 11210, to_port = 11211, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound unencrypted client connections to Couchbase (memcached)." },
    { from_port = 11207, to_port = 11207, source_sg_id = module.sg-win-ws.sg_id, description = "Allow inbound encrypted client connections to Couchbase (memcached)." },
    { from_port = 8091, to_port = 8096, source_sg_id = module.sg-win-batch.sg_id, description = "Allow inbound unencrypted client connection to Couchbase." },
    { from_port = 18091, to_port = 18096, source_sg_id = module.sg-win-batch.sg_id, description = "Allow inbound unencrypted client connection to Couchbase." },
    { from_port = 11210, to_port = 11211, source_sg_id = module.sg-win-batch.sg_id, description = "Allow inbound unencrypted client connections to Couchbase (memcached)." },
    { from_port = 11207, to_port = 11207, source_sg_id = module.sg-win-batch.sg_id, description = "Allow inbound encrypted client connections to Couchbase (memcached)." },
  ]
  ingress-efs = [
    { from_port = 2049, to_port = 2049, source_sg_id = module.sg-ecs.sg_id, description = "Allow inbound nfs from ECS" },
    { from_port = 2049, to_port = 2049, source_sg_id = module.sg-efs.sg_id, description = "Allow inbound nfs from EFS" },
  ]
  ingress-win-batch = []
  ingress-lambda    = []
  whitelisted_cidrs = concat(module.ip_whitelist.whitelist_for_sg, var.projectgroup_whitelist)
  # If vpn_enabled, management and debug SG will give access to vpn cidrs instead of office IP whitelist
  vpn_cidrs =[for cidr in var.vpn_masq_cidrs : { cidr = cidr, description = "Access for VPN users" } if var.vpn_masq_cidrs != []]
  env_access_list = var.external_access_mode == "whitelist" ? local.whitelisted_cidrs : (
    var.external_access_mode == "vpn" ? local.vpn_cidrs : concat(local.vpn_cidrs, local.whitelisted_cidrs)
  )
  whitelisted_ip_sets = [for item in concat(local.env_access_list, var.external_https_access) : {
    type  = "IPV4"
    value = item["cidr"]
  }]
}

module "ip_whitelist" {
  source = "../../modules/ip_whitelist_v2"
}

# Create security group for windows web servers
module "sg-win-ws" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows HTTP connections to windows web servers"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-win-ws

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-win-ws", var.name_prefix)
    },
  )
}

# Create security group for linux web servers
module "sg-docdb" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows DockDB connections"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-docdb

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-docdb", var.name_prefix)
    },
  )
}

# Create security group for linux web servers
module "sg-lin-ws" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows HTTP connections to linux web servers"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-lin-ws

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-lin-ws", var.name_prefix)
    },
  )
}

# Create security group for load balancers
module "sg-alb" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows HTTP connections to ALB"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-alb

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-alb", var.name_prefix)
    },
  )
}

# Create security group for containers in ECS
module "sg-ecs" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows HTTP connections to ECS"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-ecs

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-ecs", var.name_prefix)
    },
  )
}

module "sg-es" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows access to Elastic Search"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-es

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-es", var.name_prefix)
    },
  )
}

# Create security group for adminaccounts.filtr.com ec2
module "sg-adminaccounts" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows connections to web server"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-adminaccounts

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-adminaccounts", var.name_prefix)
    },
  )
}

module "sg-win-batch" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows connections to windows utility servers"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-win-batch

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-win-batch", var.name_prefix)
    },
  )
}

module "sg-redis" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows access to redis"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-redis

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-redis", var.name_prefix)
    },
  )
}

module "sg-postgres" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows access to RDS postgres"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-postgres

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-postgres", var.name_prefix)
    },
  )
}

module "sg-couchbase" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows access to couchbase"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-couchbase

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-couchbase", var.name_prefix)
    },
  )
}

module "sg-lambda" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allow AWS Lambda outgoing connections"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-lambda

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-lambda", var.name_prefix)
    },
  )
}

module "sg-efs" {
  source = "../../modules/vpc/sg"

  sg_description   = "Allows NFS connections to EFS"
  vpc_id           = var.vpc_id
  protocol         = "tcp"
  ingress_template = local.ingress-efs

  tags = merge(
    var.common_tags,
    {
      "Name" = format("%v-sg-efs", var.name_prefix)
    },
  )
}

resource "aws_security_group" "web_debug_access_443" {
  name        = "${var.name_prefix}-sg-web-debug-443"
  description = "Allow connections custom web ports from specified addresses"
  vpc_id      = var.vpc_id

  # https 443
  dynamic "ingress" {
    for_each = local.env_access_list

    content {
      description = ingress.value["description"]
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = format("%v-sg-web-debug-443", var.name_prefix),
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "web_debug_access_80" {
  name        = "${var.name_prefix}-sg-web-debug-80"
  description = "Allow connections custom web ports from specified addresses"
  vpc_id      = var.vpc_id

  # http 80
  dynamic "ingress" {
    for_each = local.env_access_list

    content {
      description = ingress.value["description"]
      from_port   = 80
      to_port     = 80
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 80
    to_port         = 80
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = format("%v-sg-web-debug-80", var.name_prefix),
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "postgres_debug_access" {
  name        = format("%v-sg-postgres-debug", var.name_prefix)
  description = "Allow connections to PostgreSQL from specified addresses"
  vpc_id      = var.vpc_id

  # http 80
  dynamic "ingress" {
    for_each = local.env_access_list

    content {
      description = ingress.value["description"]
      from_port   = 5432
      to_port     = 5432
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 5432
    to_port         = 5432
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = "${var.name_prefix}-sg-postgres-debug",
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "ext_web_sg" {
  name        = "${var.name_prefix}-sg-external-web"
  description = "HTTPS access for list of external ip addresses"
  vpc_id      = var.vpc_id

  # https 443
  dynamic "ingress" {
    # In case VPN is enabled, add whitelisted IP addresses to the SG
    for_each = var.external_access_mode == "vpn" ? concat(var.external_https_access, local.whitelisted_cidrs) : var.external_https_access
    content {
      description = ingress.value["description"]
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }

  tags = merge(
    var.common_tags,
    {
      Name             = "${var.name_prefix}-sg-external-web",
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "public_access_sg" {
  name        = "${var.name_prefix}-sg-public-access"
  description = "HTTP(s) public access"
  vpc_id      = var.vpc_id

  ingress {
    description = "Allow port 80 inbound traffic."
    from_port   = 80
    protocol    = "tcp"
    to_port     = 80
    cidr_blocks = ["0.0.0.0/0"]
  }

  ingress {
    description = "Allow port 80 inbound traffic."
    from_port   = 443
    protocol    = "tcp"
    to_port     = 443
    cidr_blocks = ["0.0.0.0/0"]
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = "${var.name_prefix}-sg-public-access",
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "remote_management_access_ssh" {
  name        = "${var.name_prefix}-sg-remote-ssh-access"
  description = "Allow connections via SSH from specified addresses"
  vpc_id      = var.vpc_id

  dynamic "ingress" {
    for_each = local.env_access_list
    content {
      description = ingress.value["description"]
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 22
    to_port         = 22
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = "${var.name_prefix}-sg-remote-ssh-access",
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "redis_debug_access" {
  name        = "${var.name_prefix}-sg-remote-redis-access"
  description = "Allow connections to Redis from specified addresses"
  vpc_id      = var.vpc_id

  dynamic "ingress" {
    for_each = local.env_access_list
    content {
      description = ingress.value["description"]
      from_port   = 6379
      to_port     = 6379
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 6379
    to_port         = 6379
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = "${var.name_prefix}-sg-remote-redis-access",
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

module "auth0_ip_addresses" {
  source = "../../modules/auth0_ip_addresses"
}

resource "aws_security_group" "auth0" {
  name        = "${var.name_prefix}-sg-auth0"
  description = "Allow connections from Auth0"
  vpc_id      = var.vpc_id

  # https
  dynamic "ingress" {
    for_each = module.auth0_ip_addresses.auth0_ip_addr
    content {
      description = ingress.value["description"]
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = "${var.name_prefix}-sg-auth0",
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "vpn_http_access_sg" {
  name        = "${var.name_prefix}-sg-remote-access-via-vpn"
  description = "HTTP(s) access from VPN via VPC peering."
  vpc_id      = var.vpc_id

  dynamic "ingress" {
    for_each = {for port in [80, 443, 8000, 8080, 8091] :  port => var.vpn_sg_id if var.vpn_sg_id != "" }
    content {
      description     = "Allow port ${ingress.key} inbound traffic."
      from_port       = ingress.key
      protocol        = "tcp"
      to_port         = ingress.key
      security_groups = [ingress.value]
    }
  }

  dynamic "ingress" {
    for_each = toset([80, 443, 8000, 8080, 8091])
    content {
      description     = "Allow port ${ingress.key} inbound traffic."
      from_port       = ingress.value
      protocol        = "tcp"
      to_port         = ingress.value
      security_groups = [var.legacy_ecs_sg_id]
    }
  }

  dynamic "ingress" {
    for_each = toset([80, 443, 8000, 8080, 8091])
    content {
      description     = "Access from transit gateway ${ingress.key}"
      from_port       = ingress.value
      protocol        = "tcp"
      to_port         = ingress.value
      prefix_list_ids = var.managed_prefix_list_ids
    }
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = "${var.name_prefix}-sg-remote-access-via-vpn",
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "remote_management_access_rdp" {
  name        = "${var.name_prefix}-sg-remote-access-rdp"
  description = "Allow connections via RDP from specified addresses"
  vpc_id      = var.vpc_id
  # RDP
  dynamic "ingress" {
    for_each = local.vpn_cidrs
    content {
      description = ingress.value["description"]
      from_port   = 3389
      to_port     = 3389
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  # winrm
  dynamic "ingress" {
    for_each = local.vpn_cidrs
    content {
      description = ingress.value["description"]
      from_port   = 5985
      to_port     = 5986
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 5985
    to_port         = 5986
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 3389
    to_port         = 3389
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }


  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = "${var.name_prefix}-sg-remote-access-rdp",
      "eiso-exception" = "aws.08.30",
    },
  )

  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_security_group" "es_debug_access" {
  description = "Allow connections db ports from specified addresses"
  vpc_id      = var.vpc_id

  dynamic "ingress" {
    for_each = local.vpn_cidrs

    content {
      description = ingress.value["description"]
      from_port   = 443
      to_port     = 443
      protocol    = "tcp"
      cidr_blocks = [ingress.value["cidr"]]
    }
  }

  ingress {
    description     = "Access from transit gateway"
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    prefix_list_ids = var.managed_prefix_list_ids
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  tags = merge(
    var.common_tags,
    {
      "Name"           = format("%v-sg-es-debug", var.name_prefix),
      "eiso-exception" = "aws.08.30",
    },
  )
}