Add option to specify CIDR blocks to allow for ingress (#82)

* Add option to specify CIDR blocks to allow for ingress * Update modules/terraform-aws-alternat/main.tf Co-authored-by: Ben Whaley <[email protected]> --------- Co-authored-by: Ben Whaley <[email protected]>
chime · Oct 26, 2023 · e6fc58c · e6fc58c
1 parent 0141b69
commit e6fc58c
Show file tree

Hide file tree

Showing 2 changed files with 16 additions and 0 deletions.
diff --git a/modules/terraform-aws-alternat/main.tf b/modules/terraform-aws-alternat/main.tf
@@ -280,6 +280,16 @@ resource "aws_security_group_rule" "nat_instance_ingress" {
   source_security_group_id = local.nat_instance_ingress_sgs[count.index]
 }
 
+resource "aws_security_group_rule" "nat_instance_ip_range_ingress" {
+  count = length(var.ingress_security_group_cidr_blocks) > 0 ? 1 : 0
+
+  type                     = "ingress"
+  protocol                 = "-1"
+  from_port                = 0
+  to_port                  = 0
+  security_group_id        = aws_security_group.nat_instance.id
+  cidr_blocks = var.ingress_security_group_cidr_blocks
+}
 
 ### NAT instance IAM
 

diff --git a/modules/terraform-aws-alternat/variables.tf b/modules/terraform-aws-alternat/variables.tf
@@ -79,6 +79,12 @@ variable "ingress_security_group_ids" {
   default     = []
 }
 
+variable "ingress_security_group_cidr_blocks" {
+  description = "A list of CIDR blocks that are allowed by the NAT instance."
+  type        = list(string)
+  default     = []
+}
+
 variable "lifecycle_heartbeat_timeout" {
   description = "The length of time, in seconds, that autoscaled NAT instances should wait in the terminate state before being fully terminated."
   type        = number