KodeKloud Engineer Day 95: Create Security Group Using Terraform.

Hey Everyone! I have taken up the kodekloud engineer daily challenge [100 days of Devops] and through this series, we shall slowly but steadily start solving the daily challenges.

Here’s the link to get started with the challenge: https://engineer.kodekloud.com/practice

Day #95 Task: Create Security Group Using Terraform.

The Nautilus DevOps team is strategizing the migration of a portion of their infrastructure to the AWS cloud. Recognizing the scale of this undertaking, they have opted to approach the migration in incremental steps rather than as a single massive transition. To achieve this, they have segmented large tasks into smaller, more manageable units. This granular approach enables the team to execute the migration in gradual phases, ensuring smoother implementation and minimizing disruption to ongoing operations. By breaking down the migration into smaller tasks, the Nautilus DevOps team can systematically progress through each stage, allowing for better control, risk mitigation, and optimization of resources throughout the migration process.

Use Terraform to create a security group under the default VPC with the following requirements:

1. The name of the security group must be xfusion-sg.

2. The description must be Security group for Nautilus App Servers.

3. Add an inbound rule of type HTTP, with a port range of 80, and source CIDR range 0.0.0.0/0.

4. Add another inbound rule of type SSH, with a port range of 22, and source CIDR range 0.0.0.0/0.

Ensure that the security group is created in the us-east-1 region using Terraform. The Terraform working directory is /home/bob/terraform. Create the main.tf file (do not create a different .tf file) to accomplish this task.

Note: Right-click under the EXPLORER section in VS Code and select Open in Integrated Terminal to launch the terminal.

Day #95 Task: Create Security Group Using Terraform.

What is a Security Group?

A Security Group in Amazon Web Services acts as a virtual firewall for cloud resources such as EC2 instances.

It controls:

• Who can access a resource.
• Which ports are allowed.
• What type of traffic can enter or leave.

By default, servers in the cloud should not be openly accessible to everyone on the internet. This help protect resources by allowing only authorized traffic.

Step-1: Verify the existing files in /home/bob/terraform.

Let’s check out the existing files in the */home/bob/terraform*path.

# Execute these commands from the terminal of the IDE.
bob@iac-server ~/terraform via 💠 default ✖ ls
README.MD  provider.tf

There’s a README.MD file and a provider.tf file, that has all the values required to create the VPC in the AWS account such as the region details, resource providers, etc.

Step-2: Create the main.tf file in /home/bob/terraform.

bob@iac-server ~/terraform via 💠 default ➜ vi main.tf

# Content of the main.tf file.
resource "aws_security_group" "xfusion_sg" {
  name        = "xfusion-sg" # Name of the security group
  description = "Security group for Nautilus App Servers" # Description of the security group

  // Inbound rules
  ingress {
    from_port   = 80                     # Port range for the rule
    to_port     = 80                     # Port range for the rule
    protocol    = "tcp"                  # Protocol (tcp, udp, icmp)
    cidr_blocks = ["0.0.0.0/0"]          # Allowed IP address range (0.0.0.0/0 allows all)
  }

  ingress {
    from_port   = 22                     # Port range for the rule
    to_port     = 22                     # Port range for the rule
    protocol    = "tcp"                  # Protocol
    cidr_blocks = ["0.0.0.0/0"]     # Replace with your IP or CIDR range
  }
}

As per the problem statement, this is what the main.tf file should do:

• The name of the security group: *xfusion-sg*.
• The description of the security group: *Security group for Nautilus App Servers*.
• Since inbound rules are to be defined, we need to define them under ingress section as it’s where we define the rules for the traffic entering the system. There are two inbound rules, that we must define as given in the problem statement.

Step-3: Execute the terraform file and validate if the Security Group got created successfully.

# Run 'terraform init' to initalize the working directory with the Terraform configurations.

bob@iac-server ~/terraform via 💠 default ➜  terraform init
Initializing the backend...
Initializing provider plugins...
- Finding hashicorp/aws versions matching "5.91.0"...
- Installing hashicorp/aws v5.91.0...
- Installed hashicorp/aws v5.91.0 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

# Let's preview, what and all are getting created before actually creating the infra for validation by executing 'terraform plan'.

bob@iac-server ~/terraform via 💠 default ➜  terraform plan

Terraform used the selected providers to generate the following
execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # aws_security_group.xfusion_sg will be created
  + resource "aws_security_group" "xfusion_sg" {
      + arn                    = (known after apply)
      + description            = "Security group for Nautilus App Servers"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = [
                  + "0.0.0.0/0",
                ]
              + from_port        = 22
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 22
                # (1 unchanged attribute hidden)
            },
          + {
              + cidr_blocks      = [
                  + "0.0.0.0/0",
                ]
              + from_port        = 80
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 80
                # (1 unchanged attribute hidden)
            },
        ]
      + name                   = "xfusion-sg"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags_all               = (known after apply)
      + vpc_id                 = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

──────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform
can't guarantee to take exactly these actions if you run "terraform
apply" now.

# Let's actually create the resources by running 'terraform apply'.

bob@iac-server ~/terraform via 💠 default ➜  terraform apply

Terraform used the selected providers to generate the following
execution plan. Resource actions are indicated with the following
symbols:
  + create

Terraform will perform the following actions:

  # aws_security_group.xfusion_sg will be created
  + resource "aws_security_group" "xfusion_sg" {
      + arn                    = (known after apply)
      + description            = "Security group for Nautilus App Servers"
      + egress                 = (known after apply)
      + id                     = (known after apply)
      + ingress                = [
          + {
              + cidr_blocks      = [
                  + "0.0.0.0/0",
                ]
              + from_port        = 22
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 22
                # (1 unchanged attribute hidden)
            },
          + {
              + cidr_blocks      = [
                  + "0.0.0.0/0",
                ]
              + from_port        = 80
              + ipv6_cidr_blocks = []
              + prefix_list_ids  = []
              + protocol         = "tcp"
              + security_groups  = []
              + self             = false
              + to_port          = 80
                # (1 unchanged attribute hidden)
            },
        ]
      + name                   = "xfusion-sg"
      + name_prefix            = (known after apply)
      + owner_id               = (known after apply)
      + revoke_rules_on_delete = false
      + tags_all               = (known after apply)
      + vpc_id                 = (known after apply)
    }

Plan: 1 to add, 0 to change, 0 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

aws_security_group.xfusion_sg: Creating...
aws_security_group.xfusion_sg: Creation complete after 1s [id=sg-1deaaefcdeef1364e]

Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

Let’s now verify if the resources are created successfully.

# Run 'terraform state list' to track all the infrastructure created by terraform in the state file.

bob@iac-server ~/terraform via 💠 default ➜  terraform state list
aws_security_group.xfusion_sg

# Verify if the security group is created successfully with the name 'xfusion-sg' in the 'us-east-1' region.

bob@iac-server ~/terraform via 💠 default ➜  aws ec2 describe-security-groups \
--filters "Name=group-name,Values=xfusion-sg" \
--region us-east-1

{
    "SecurityGroups": [
        {
            "GroupId": "sg-1deaaefcdeef1364e",
            "IpPermissionsEgress": [],
            "Tags": [],
            "VpcId": "vpc-b0b1c4f80ec42e25b",
            "SecurityGroupArn": "arn:aws:ec2:us-east-1:000000000000:security-group/sg-1deaaefcdeef1364e",
            "OwnerId": "000000000000",
            "GroupName": "xfusion-sg",
            "Description": "Security group for Nautilus App Servers",
            "IpPermissions": [
                {
                    "IpProtocol": "tcp",
                    "FromPort": 80,
                    "ToPort": 80,
                    "UserIdGroupPairs": [],
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ],
                    "Ipv6Ranges": [],
                    "PrefixListIds": []
                },
                {
                    "IpProtocol": "tcp",
                    "FromPort": 22,
                    "ToPort": 22,
                    "UserIdGroupPairs": [],
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ],
                    "Ipv6Ranges": [],
                    "PrefixListIds": []
                }
            ]
        }
    ]
}

That’s it for Day #95. Let’s hop on to the next challenge! See you there! Toodaloo!