Closed syphernl closed 3 years ago
Apologies for the changes. We're reviewing internally on release notes and how to better manage the upgrade process.
It looks like this may be the culprit in your example.
{
type = "ingress"
from_port = 6379
to_port = 6379
protocol = "tcp"
cidr_blocks = []
source_security_group_id = join(",", module.bastion.security_group_ids)
description = "Allow inbound Redis traffic from Bastion"
},
You can only pass in a single security group (see cloudposse/terraform-aws-security-group) to source_security_group_id
Also the module used to add
allowed_security_groups = [module.vpc.vpc_default_security_group_id]
Try this terraform and see if it works for you
cc: @syphernl
@nitrocode The rules I posted in my initial message (2nd code block) works for us as our module.bastion.security_group_ids
only contains one entry. It would however be a bit more complex if it did contain more than one.
With your example however I could technically remove the specific rules for ECS and Bastion, since they both exist within the VPC. But that would also allow anything in the VPC to connect to Redis, which might not be desired.
The reason why I opened this issue is the fact that the usage of the module has been made a bit more complicated switching to this new approach. Before I could just tell it to allow security group X and Y (ECS + Bastion), now I have to explicitly add the rules for each of them in there.
I fully understand the reasoning behind standardization and while it does add flexibility, it also takes some away we had in versions prior to 0.40.0.
Apologies for the trouble @syphernl.
I wrote up some release notes here on 0.40.0
on the breaking changes and the upgrade procedure. Let us know if we should include additional details or if it doesn't work for you. If you have additional suggestions, please feel free to comment here.
We'll try to provide breaking change release notes on future upgrades across our modules.
@syphernl We are taking feedback like yours into account and have marked v0.40.0 pre-release. We recommend using 0.39.0 for now and waiting for a later release which will provide better backward compatibility and clearer migration instructions.
With 0.40.0 the setup process of this module has become a little more complex. Prior to 0.40.0 (e.g. with 0.39.0) one could simply tell the module to allow which SG's like so:
It would allow any of these SG's to connect to
var.port
. Easy.With v0.40.0 this has changed and now requires explicit declaration of rules like this:
I have tried to define them as such:
While they do get added to the Redis instance, it does not allow to connect from them.
The README shows a nice "allow all outbound" and a "allow all from VPC" example but the default value of the
security_group_rules
only contains the former.Am I using this module the wrong way or is this actually they way it is supposed to work (now)? If so, is there something we can do to improve this behavior?