Build AWS Security Groups with Terraform and CSV

sg_csv.tf

# Decode the CSV file into a list of maps
locals {
  sg_rules = csvdecode(file("./sg_rules.csv"))
  sg_names = toset([for rule in local.sg_rules : rule.name])
}

# Create a security group for each unique name
resource "aws_security_group" "sample_sg" {
  for_each = { for name in local.sg_names : name => name }

  name = each.value
}

# Create security group rules based on the CSV file
resource "aws_security_group_rule" "cidr_block_rules" {
  for_each = { for rule in local.sg_rules : rule.id => rule if rule.cidr_block != "" }

  type              = each.value.type
  from_port         = each.value.from_port != "" ? tonumber(each.value.from_port) : 0
  to_port           = each.value.to_port != "" ? tonumber(each.value.to_port) : 65535
  protocol          = each.value.protocol_type
  cidr_blocks       = [each.value.cidr_block]
  security_group_id = aws_security_group.sample_sg[each.value.name].id
  description       = each.value.description
}

resource "aws_security_group_rule" "self_rules" {
  for_each = { for rule in local.sg_rules : rule.id => rule if rule.self != "" }

  type              = each.value.type
  from_port         = each.value.from_port != "" ? tonumber(each.value.from_port) : 0
  to_port           = each.value.to_port != "" ? tonumber(each.value.to_port) : 65535
  protocol          = each.value.protocol_type
  self              = each.value.self == "true" ? true : false
  security_group_id = aws_security_group.sample_sg[each.value.name].id
  description       = each.value.description
}

resource "aws_security_group_rule" "src_sg_rules" {
  for_each = { for rule in local.sg_rules : rule.id => rule if rule.src_sg_id != "" }

  type                     = each.value.type
  from_port                = each.value.from_port != "" ? tonumber(each.value.from_port) : 0
  to_port                  = each.value.to_port != "" ? tonumber(each.value.to_port) : 65535
  protocol                 = each.value.protocol_type
  source_security_group_id = each.value.src_sg_id != "" ? aws_security_group.sample_sg[each.value.src_sg_id].id : ""
  security_group_id        = aws_security_group.sample_sg[each.value.name].id
  description              = each.value.description
}

sg_rules.csv

versions.tf

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "5.16.1"
    }
  }
}

provider "aws" {
  # Configuration options
}