Security

1# SGs as heroku-to-aws emits: EB instances in private subnets, ALB public on 80/443.
2
3resource "aws_security_group" "alb" {
4  name   = "${var.project_name}-alb"
5  vpc_id = aws_vpc.main.id
6
7  ingress {
8    from_port   = 443
9    to_port     = 443
10    protocol    = "tcp"
11    cidr_blocks = ["0.0.0.0/0"]
12  }
13  ingress {
14    from_port   = 80
15    to_port     = 80
16    protocol    = "tcp"
17    cidr_blocks = ["0.0.0.0/0"]
18  }
19  egress {
20    from_port   = 0
21    to_port     = 0
22    protocol    = "-1"
23    cidr_blocks = ["0.0.0.0/0"]
24  }
25}
26
27resource "aws_security_group" "eb_instances" {
28  name   = "${var.project_name}-eb"
29  vpc_id = aws_vpc.main.id
30
31  ingress {
32    from_port       = 80
33    to_port         = 80
34    protocol        = "tcp"
35    security_groups = [aws_security_group.alb.id]
36  }
37  egress {
38    from_port   = 0
39    to_port     = 0
40    protocol    = "-1"
41    cidr_blocks = ["0.0.0.0/0"]
42  }
43}