116 lines
3.6 KiB
Markdown
116 lines
3.6 KiB
Markdown
# Assignment
|
|
|
|
The Nautilus DevOps team is enhancing infrastructure automation and needs to provision a Security Group using Terraform with specific configurations.
|
|
|
|
For this task, create an AWS Security Group using Terraform with the following requirements:
|
|
|
|
The Security Group name xfusion-sg should be stored in a variable named KKE_sg.
|
|
Note:
|
|
|
|
1. The configuration values should be stored in a variables.tf file.
|
|
|
|
2. The Terraform script should be structured with a main.tf file referencing variables.tf.
|
|
The Terraform working directory is /home/bob/terraform.
|
|
|
|
Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.
|
|
|
|
# Solution
|
|
|
|
# Security Group with Variables — `xfusion-sg` (`KKE_sg`)
|
|
|
|
Two-file structure again: `variables.tf` holds the config, `main.tf` references it. The
|
|
Security Group name must be stored in a variable named exactly `KKE_sg`.
|
|
|
|
## `variables.tf`
|
|
|
|
```hcl
|
|
variable "KKE_sg" {
|
|
description = "Name of the Security Group"
|
|
type = string
|
|
default = "xfusion-sg"
|
|
}
|
|
```
|
|
|
|
## `main.tf`
|
|
|
|
```hcl
|
|
terraform {
|
|
required_providers {
|
|
aws = {
|
|
source = "hashicorp/aws"
|
|
version = "~> 6.0"
|
|
}
|
|
}
|
|
}
|
|
|
|
provider "aws" {
|
|
region = "us-east-1"
|
|
}
|
|
|
|
# Default VPC to place the security group in
|
|
data "aws_vpc" "default" {
|
|
default = true
|
|
}
|
|
|
|
resource "aws_security_group" "xfusion_sg" {
|
|
name = var.KKE_sg
|
|
description = "Security group xfusion-sg managed by Terraform"
|
|
vpc_id = data.aws_vpc.default.id
|
|
|
|
tags = {
|
|
Name = var.KKE_sg
|
|
}
|
|
}
|
|
```
|
|
|
|
## How to run
|
|
|
|
```bash
|
|
cd /home/bob/terraform
|
|
terraform init
|
|
terraform apply -auto-approve
|
|
```
|
|
|
|
## How it works
|
|
|
|
### Splitting config from logic
|
|
|
|
Terraform merges every `.tf` file in the working directory into one configuration, so
|
|
`variables.tf` and `main.tf` act as a single unit — no imports needed. The convention:
|
|
`variables.tf` declares inputs, `main.tf` declares resources that consume them via
|
|
`var.<name>`.
|
|
|
|
### The variable
|
|
|
|
- **`variable "KKE_sg"`** — holds the Security Group name, exactly as required. The
|
|
`default` of `xfusion-sg` lets `terraform apply` run without prompting for a value.
|
|
- **`type = string`** validates the input type at plan time.
|
|
|
|
### The Security Group
|
|
|
|
- **`name = var.KKE_sg`** — resolves to `xfusion-sg`. The `var.` prefix interpolates
|
|
the variable's value.
|
|
- **`description`** — **required** by AWS on every security group. If you omit it, the
|
|
provider defaults it to "Managed by Terraform"; it's set explicitly here for clarity.
|
|
Note the description is **immutable** — AWS won't let you change it after creation, so
|
|
it must be right the first time.
|
|
- **`vpc_id = data.aws_vpc.default.id`** — places the SG in the account's default VPC.
|
|
The `data "aws_vpc" "default"` block reads the existing default VPC without managing
|
|
it. (If `vpc_id` is omitted entirely, the SG lands in the default VPC anyway, but
|
|
wiring it explicitly is clearer and deterministic.)
|
|
- **No `ingress`/`egress` blocks** — the task specifies no rules, so none are defined.
|
|
Be aware that when Terraform manages a security group with no `egress` block, it
|
|
**removes** the default allow-all outbound rule, leaving the SG with no rules at all.
|
|
That matches the task (which asks only for the named SG to exist); add an `egress`
|
|
block if outbound traffic is later needed.
|
|
|
|
## Verify
|
|
|
|
```bash
|
|
aws ec2 describe-security-groups \
|
|
--filters Name=group-name,Values=xfusion-sg \
|
|
--query 'SecurityGroups[0].{Name:GroupName,Desc:Description,Vpc:VpcId,Id:GroupId}'
|
|
```
|
|
|
|
Expected — `GroupName: xfusion-sg`, the description, the default VPC ID, and a
|
|
generated group ID. |