example.tf

# Allow access to the vault service from the public and private subnets
# Note that this doesn't allow access from the internet; it just allows
# traffic over the private network from hosts that reside in either of our
# two subnets.
resource "aws_security_group_rule" "vault" {
  security_group_id = "${aws_security_group.security_group.id}"
  type = "ingress"
  from_port = 8200
  to_port   = 8200
  protocol  = "tcp"

  cidr_blocks = [
    "${var.public_subnet_cidr_block}",
    "${var.private_subnet_cidr_block}",
  ]
}