resource "aws_security_group" "this" {
  provider = aws.this

  name        = "${var.name_prefix}-rabbitmq"
  description = "Allow connections to RabbitMQ"
  vpc_id      = var.vpc_id

  ingress {
    description = "Allow client access"
    from_port   = 5671
    to_port     = 5671
    protocol    = "tcp"
    cidr_blocks = concat([var.vpc_cidr], var.vpn_cidrs)
  }

  ingress {
    description = "Allow console access"
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = concat([var.vpc_cidr], var.vpn_cidrs)
  }

  egress {
    description = "Allow all outbound traffic."
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }

  lifecycle {
    create_before_destroy = true
  }

  tags = {
    service          = "VPC",
    "eiso-exception" = "aws.08.30",
  }
}