Assignment

The Nautilus DevOps team is enhancing infrastructure automation and needs to provision a Security Group using Terraform with specific configurations.

For this task, create an AWS Security Group using Terraform with the following requirements:

The Security Group name xfusion-sg should be stored in a variable named KKE_sg. Note:

The configuration values should be stored in a variables.tf file.
The Terraform script should be structured with a main.tf file referencing variables.tf. The Terraform working directory is /home/bob/terraform.

Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.

Solution

Security Group with Variables — `xfusion-sg` (`KKE_sg`)

Two-file structure again: variables.tf holds the config, main.tf references it. The Security Group name must be stored in a variable named exactly KKE_sg.

`variables.tf`

variable "KKE_sg" {
  description = "Name of the Security Group"
  type        = string
  default     = "xfusion-sg"
}

`main.tf`

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 6.0"
    }
  }
}

provider "aws" {
  region = "us-east-1"
}

# Default VPC to place the security group in
data "aws_vpc" "default" {
  default = true
}

resource "aws_security_group" "xfusion_sg" {
  name        = var.KKE_sg
  description = "Security group xfusion-sg managed by Terraform"
  vpc_id      = data.aws_vpc.default.id

  tags = {
    Name = var.KKE_sg
  }
}

How to run

cd /home/bob/terraform
terraform init
terraform apply -auto-approve

How it works

Splitting config from logic

Terraform merges every .tf file in the working directory into one configuration, so variables.tf and main.tf act as a single unit — no imports needed. The convention: variables.tf declares inputs, main.tf declares resources that consume them via var.<name>.

The variable

variable "KKE_sg" — holds the Security Group name, exactly as required. The default of xfusion-sg lets terraform apply run without prompting for a value.
type = string validates the input type at plan time.

The Security Group

name = var.KKE_sg — resolves to xfusion-sg. The var. prefix interpolates the variable's value.
description — required by AWS on every security group. If you omit it, the provider defaults it to "Managed by Terraform"; it's set explicitly here for clarity. Note the description is immutable — AWS won't let you change it after creation, so it must be right the first time.
vpc_id = data.aws_vpc.default.id — places the SG in the account's default VPC. The data "aws_vpc" "default" block reads the existing default VPC without managing it. (If vpc_id is omitted entirely, the SG lands in the default VPC anyway, but wiring it explicitly is clearer and deterministic.)
No ingress/egress blocks — the task specifies no rules, so none are defined. Be aware that when Terraform manages a security group with no egress block, it removes the default allow-all outbound rule, leaving the SG with no rules at all. That matches the task (which asks only for the named SG to exist); add an egress block if outbound traffic is later needed.

Verify

aws ec2 describe-security-groups \
  --filters Name=group-name,Values=xfusion-sg \
  --query 'SecurityGroups[0].{Name:GroupName,Desc:Description,Vpc:VpcId,Id:GroupId}'

Expected — GroupName: xfusion-sg, the description, the default VPC ID, and a generated group ID.

3.6 KiB Raw Permalink Blame History