# SECURITY GROUP
# -- define security group for notebook instance
resource "aws_security_group" "notebook_sg" {
  name        = "${var.environment}-${var.service_name}-security-group"
  description = "Notebooks security group for ${var.environment}-${var.service_name}"
  vpc_id      = data.aws_vpc.vpc.id

  tags = local.combined_resource_tags
}

# RULES
# Security Group Rules
# selectively allow https traffic from only for sagemaker notebook (inbound)
# this is based on the terraform-fargate module's allowed CIDRs

# allow notebook to all CIDRs egress and all protocols
resource "aws_security_group_rule" "allow_notebook_egress" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.notebook_sg.id
}