data "aws_ec2_managed_prefix_list" "https_listener_allow_prefix_lists" {
  for_each = toset(var.https_listener_allow_prefix_lists)
  name     = each.value
}

resource "aws_security_group" "security_group" {
  name        = "${local.environment_name}-ariflow-security-group"
  description = "Security group for ${local.environment_name}"
  vpc_id      = var.vpc_id
  tags        = merge(local.tags, { eiso-exception = "aws.08.30,aws.08.36" })
}

resource "aws_security_group_rule" "internal_ingress_rule" {
  security_group_id = aws_security_group.security_group.id
  type              = "ingress"
  protocol          = "-1"
  from_port         = 0
  to_port           = 0
  self              = true
}

resource "aws_security_group_rule" "https_ingress_rule" {
  security_group_id = aws_security_group.security_group.id
  type              = "ingress"
  protocol          = "TCP"
  from_port         = 443
  to_port           = 443
  cidr_blocks       = var.https_listener_allow_cidr_blocks
  prefix_list_ids   = [for prefix_list in data.aws_ec2_managed_prefix_list.https_listener_allow_prefix_lists : prefix_list.id]
}

resource "aws_security_group_rule" "egress_rule" {
  security_group_id = aws_security_group.security_group.id
  type              = "egress"
  protocol          = "-1"
  from_port         = 0
  to_port           = 0
  cidr_blocks       = ["0.0.0.0/0"]
}