Security group that protects EC2 instances behind Application Load Balancer.

ec2_instances.tf

...
resource "aws_security_group" "behind_alb_sg" {
  name        = "${var.project_name}_ec2_behind_alb"
  description = "Protect EC2 instances from public traffic and set them behind Application Load Balancer."
  vpc_id      = "${var.vpc_id}"

  ingress {
    from_port = 0
    to_port     = 0
    protocol    = "-1"
    security_groups = ["${aws_security_group.public_alb.id}"] // only from alb
  }

  # allow all traffic
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
...