# Assignment

The Nautilus DevOps team is enhancing infrastructure automation and needs to provision a Security Group using Terraform with specific configurations.

For this task, create an AWS Security Group using Terraform with the following requirements:

The Security Group name xfusion-sg should be stored in a variable named KKE_sg.
Note:

1. The configuration values should be stored in a variables.tf file.

2. The Terraform script should be structured with a main.tf file referencing variables.tf.
The Terraform working directory is /home/bob/terraform.

Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.

# Solution

# Security Group with Variables — `xfusion-sg` (`KKE_sg`)

Two-file structure again: `variables.tf` holds the config, `main.tf` references it. The
Security Group name must be stored in a variable named exactly `KKE_sg`.

## `variables.tf`

```hcl
variable "KKE_sg" {
  description = "Name of the Security Group"
  type        = string
  default     = "xfusion-sg"
}
```

## `main.tf`

```hcl
terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# Default VPC to place the security group in
data "aws_vpc" "default" {
  default = true
}

resource "aws_security_group" "xfusion_sg" {
  name        = var.KKE_sg
  description = "Security group xfusion-sg managed by Terraform"
  vpc_id      = data.aws_vpc.default.id

  tags = {
    Name = var.KKE_sg
  }
}
```

## How to run

```bash
cd /home/bob/terraform
terraform init
terraform apply -auto-approve
```

## How it works

### Splitting config from logic

Terraform merges every `.tf` file in the working directory into one configuration, so
`variables.tf` and `main.tf` act as a single unit — no imports needed. The convention:
`variables.tf` declares inputs, `main.tf` declares resources that consume them via
`var.<name>`.

### The variable

- **`variable "KKE_sg"`** — holds the Security Group name, exactly as required. The
  `default` of `xfusion-sg` lets `terraform apply` run without prompting for a value.
- **`type = string`** validates the input type at plan time.

### The Security Group

- **`name = var.KKE_sg`** — resolves to `xfusion-sg`. The `var.` prefix interpolates
  the variable's value.
- **`description`** — **required** by AWS on every security group. If you omit it, the
  provider defaults it to "Managed by Terraform"; it's set explicitly here for clarity.
  Note the description is **immutable** — AWS won't let you change it after creation, so
  it must be right the first time.
- **`vpc_id = data.aws_vpc.default.id`** — places the SG in the account's default VPC.
  The `data "aws_vpc" "default"` block reads the existing default VPC without managing
  it. (If `vpc_id` is omitted entirely, the SG lands in the default VPC anyway, but
  wiring it explicitly is clearer and deterministic.)
- **No `ingress`/`egress` blocks** — the task specifies no rules, so none are defined.
  Be aware that when Terraform manages a security group with no `egress` block, it
  **removes** the default allow-all outbound rule, leaving the SG with no rules at all.
  That matches the task (which asks only for the named SG to exist); add an `egress`
  block if outbound traffic is later needed.

## Verify

```bash
aws ec2 describe-security-groups \
  --filters Name=group-name,Values=xfusion-sg \
  --query 'SecurityGroups[0].{Name:GroupName,Desc:Description,Vpc:VpcId,Id:GroupId}'
```

Expected — `GroupName: xfusion-sg`, the description, the default VPC ID, and a
generated group ID.