Terraform AWS Security Group

Terraform module which creates EC2 security groups on AWS with support for ingress/egress rules, computed rules, and rule descriptions.

Quick start

module "security-group" {
  source  = "cccsmedium.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"

  # ... your arguments here
}

module "security-group" {
  source  = "cisv80ig1.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"

  # ... your arguments here
}

module "security-group" {
  source  = "fedrampmoderate.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"

  # ... your arguments here
}

module "security-group" {
  source  = "nist800171.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"

  # ... your arguments here
}

module "security-group" {
  source  = "nist80053.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"

  # ... your arguments here
}

module "security-group" {
  source  = "pcidss.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"

  # ... your arguments here
}

module "security-group" {
  source  = "awswellarchitected.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"

  # ... your arguments here
}

module "security-group" {
  source  = "cfrpart11.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"

  # ... your arguments here
}

This module on the compliance.tf registry lists its versions, inputs and outputs. The Get Started guide and Registry Endpoints cover authentication and how to customize the module for your requirements.

Migration from upstream

Already using terraform-aws-modules? Change only the source URL:

module "security-group" {
  source  = "terraform-aws-modules/security-group/aws"
  version = "~> 6.0"
}

module "security-group" {
  source  = "soc2.compliance.tf/terraform-aws-modules/security-group/aws"
  version = "~> 6.0"
}

Same arguments. Same outputs. Controls are checked at terraform plan. The Migration Guide has the step-by-step version.

Reversibility

No lock-in. Switch back by reverting the source URL:

module "security-group" {
  source  = "terraform-aws-modules/security-group/aws"
}

Run terraform init -upgrade. Terraform state is unchanged: same resource addresses, same provider, no compliance.tf-specific resources. Controls you already applied remain in AWS.

Controls enforced

Up to 2 controls are checked at terraform plan when this module comes from a compliance.tf endpoint. Which ones are active depends on the endpoint; see Framework coverage.

Control	Retrofit effort
VPC Security groups should only allow unrestricted incoming traffic for authorized ports	Low
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	Low

Mapped compliance frameworks

Clause	Controls from this module
CA-3(5): Restrictions on External Network Connections	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
CM-7: Least Functionality	VPC Security groups should only allow unrestricted incoming traffic for authorized ports

Clause	Controls from this module
4.4: Implement and Manage a Firewall on Servers	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888

Clause	Controls from this module
AC-4: Information Flow Enforcement	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
SC-7: Boundary Protection	VPC Security groups should only allow unrestricted incoming traffic for authorized ports

Clause	Controls from this module
3.1.3: Control the flow of CUI in accordance with approved authorizations.	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
3.13.1: Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.	VPC Security groups should only allow unrestricted incoming traffic for authorized ports

Clause	Controls from this module
SC-7(13): Isolation Of Security Tools, Mechanisms, And Support Components	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
SC-7: Boundary Protection	VPC Security groups should only allow unrestricted incoming traffic for authorized ports

Clause	Controls from this module
1.3.1: Network access to and from the cardholder data environment is restricted.	VPC Security groups should only allow unrestricted incoming traffic for authorized ports VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888
1.3.2: Network access to and from the cardholder data environment is restricted.	VPC Security groups should only allow unrestricted incoming traffic for authorized ports

1 controls from this module are active under AWS Well-Architected Framework v10.

Clause	Controls from this module
11.10(d) Limiting system access to authorized individuals	VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888

Framework coverage

Which controls from this module are active under each framework endpoint. Your framework preferences choose the columns.

Control	PCI DSS v4.0
VPC Security groups should only allow unrestricted incoming traffic for authorized ports	Enforced
VPC security groups should restrict ingress from 0.0.0.0/0 or ::/0 to cassandra ports 7199 or 9160 or 8888	Enforced

2 controls enforced with a source URL change.

Start free trial Get started