resource "aws_default_security_group" "BETABASE-D-DEFAULT-SG" {
  vpc_id = aws_vpc.BETABASE-D.id
  tags   = merge(var.tags, { Name = "BETABASE-D-DEFAULT-SG" })
}

resource "aws_security_group" "BETABASE-D-GSIRT-SG" {
  name        = "BETABASE-D-GSIRT-SG"
  description = "BETABASE-D-GSIRT-SG"
  egress = [
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "udp"
      security_groups  = []
      self             = false
      to_port          = 65534
    }
  ]
  ingress = [
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "GSIRT-TCP-8089"
      from_port        = 8089
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 8089
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "GSIRT-TCP-9998"
      from_port        = 9998
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 9998
    },
  ]
  tags   = merge(var.tags, { Name = "BETABASE-D-GSIRT-SG" })
  vpc_id = aws_vpc.BETABASE-D.id
}

resource "aws_security_group" "BETABASE-D-ECS-SG" {
  name        = "BETABASE-D-ECS-SG"
  description = "BETABASE-D-ECS-SG"
  egress = [
    {
      cidr_blocks = [
        "0.0.0.0/0",
      ]
      description      = "HTTP"
      from_port        = 80
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 80
    },
    {
      cidr_blocks = [
        "0.0.0.0/0",
      ]
      description      = "HTTPS"
      from_port        = 443
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 443
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "udp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
    {
      cidr_blocks = [
        "10.12.246.64/26",
        "10.12.237.160/27",
      ]
      description      = "CLOPS-SMTP-EP"
      from_port        = 587
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 587
    }
  ]
  ingress = [
    {
      cidr_blocks = [
        "10.12.246.75/32",
        "10.250.2.64/27",
        "10.11.176.219/32"
      ]
      description      = "SSH from Bastion"
      from_port        = 22
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 22
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "udp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
  ]
  tags   = merge(var.tags, { Name = "BETABASE-D-ECS-SG" })
  vpc_id = aws_vpc.BETABASE-D.id
}

resource "aws_security_group" "BETABASE-D-RDS-SG" {
  name        = "BETABASE-D-RDS-SG"
  description = "BETABASE-D-RDS-SG"
  egress = [
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "udp"
      security_groups  = []
      self             = false
      to_port          = 65534
    }
  ]
  ingress = [
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 5432
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 5432
    },
    {
      cidr_blocks      = ["10.11.176.219/32"]
      description      = "cloudopsff-bastion02"
      from_port        = 5432
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 5432
    },
  ]
  tags   = merge(var.tags, { Name = "BETABASE-D-RDS-SG" })
  vpc_id = aws_vpc.BETABASE-D.id
}

resource "aws_security_group" "BETABASE-D-INT-ALB-SG" {
  name        = "BETABASE-D-INT-ALB-SG"
  description = "BETABASE-D-INT-ALB-SG"
  egress = [
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "udp"
      security_groups  = []
      self             = false
      to_port          = 65534
    }
  ]
  ingress = [
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
    {
      cidr_blocks      = ["10.250.202.0/26", "10.11.108.64/27"]
      description      = "BETABASE-D-VPC-CIDR"
      from_port        = 0
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "udp"
      security_groups  = []
      self             = false
      to_port          = 65534
    },
    {
      cidr_blocks      = ["10.0.0.0/8", "162.49.0.0/16", "192.168.0.0/16"]
      description      = "SME Intranet Access"
      from_port        = 443
      ipv6_cidr_blocks = []
      prefix_list_ids  = []
      protocol         = "tcp"
      security_groups  = []
      self             = false
      to_port          = 443
    },
  ]
  tags   = merge(var.tags, { Name = "BETABASE-D-INT-ALB-SG" })
  vpc_id = aws_vpc.BETABASE-D.id
}