Tiered Security Groups

1. 1

   Add the app port variable

   The ShopLite container listens on 8080. It's a variable because the ALB target group, the security groups, and the ECS task definition must all agree on it. One source of truth avoids mismatches.

   variable "app_port" {
     description = "Port the ShopLite container listens on."
     type        = number
     default     = 8080
   }

2. 2

   Create the three groups

   Groups first, with no rules. name_prefix plus create_before_destroy means that if a group ever has to be replaced, the new one is created (with a new generated name) and attached before the old one is deleted. Mission 2.4 shows why that matters.

   resource "aws_security_group" "alb" {
     name_prefix = "${local.name_prefix}-alb-"
     description = "ShopLite load balancer"
     vpc_id      = aws_vpc.main.id
     tags        = { Name = "${local.name_prefix}-alb" }
   
     lifecycle {
       create_before_destroy = true
     }
   }
   
   resource "aws_security_group" "app" {
     name_prefix = "${local.name_prefix}-app-"
     description = "ShopLite API tasks"
     vpc_id      = aws_vpc.main.id
     tags        = { Name = "${local.name_prefix}-app" }
   
     lifecycle {
       create_before_destroy = true
     }
   }
   
   resource "aws_security_group" "db" {
     name_prefix = "${local.name_prefix}-db-"
     description = "ShopLite Postgres"
     vpc_id      = aws_vpc.main.id
     tags        = { Name = "${local.name_prefix}-db" }
   
     lifecycle {
       create_before_destroy = true
     }
   }

3. 3

   Add the rules as separate resources

   Public HTTP/HTTPS into the ALB; the ALB may only send to the app port on app tasks; app tasks accept only from the ALB and may send anywhere (through NAT); the database accepts 5432 only from app tasks. ip_protocol = "-1" means all protocols.

   # ── ALB ─────────────────────────────────────────────
   resource "aws_vpc_security_group_ingress_rule" "alb_http" {
     security_group_id = aws_security_group.alb.id
     cidr_ipv4         = "0.0.0.0/0"
     ip_protocol       = "tcp"
     from_port         = 80
     to_port           = 80
   }
   
   resource "aws_vpc_security_group_ingress_rule" "alb_https" {
     security_group_id = aws_security_group.alb.id
     cidr_ipv4         = "0.0.0.0/0"
     ip_protocol       = "tcp"
     from_port         = 443
     to_port           = 443
   }
   
   resource "aws_vpc_security_group_egress_rule" "alb_to_app" {
     security_group_id            = aws_security_group.alb.id
     referenced_security_group_id = aws_security_group.app.id
     ip_protocol                  = "tcp"
     from_port                    = var.app_port
     to_port                      = var.app_port
   }
   
   # ── App ─────────────────────────────────────────────
   resource "aws_vpc_security_group_ingress_rule" "app_from_alb" {
     security_group_id            = aws_security_group.app.id
     referenced_security_group_id = aws_security_group.alb.id
     ip_protocol                  = "tcp"
     from_port                    = var.app_port
     to_port                      = var.app_port
   }
   
   resource "aws_vpc_security_group_egress_rule" "app_all" {
     security_group_id = aws_security_group.app.id
     cidr_ipv4         = "0.0.0.0/0"
     ip_protocol       = "-1"
   }
   
   # ── Database ────────────────────────────────────────
   resource "aws_vpc_security_group_ingress_rule" "db_from_app" {
     security_group_id            = aws_security_group.db.id
     referenced_security_group_id = aws_security_group.app.id
     ip_protocol                  = "tcp"
     from_port                    = 5432
     to_port                      = 5432
   }

4. 4

   Output the group IDs, then apply

   Stage 3 attaches alb to the load balancer and app to the ECS service; Stage 4 attaches db to RDS.

   output "security_group_ids" {
     value = {
       alb = aws_security_group.alb.id
       app = aws_security_group.app.id
       db  = aws_security_group.db.id
     }
   }

   terminalcopy cmd

   $ terraform apply

   ── expected output ──

   ...

   Plan: 9 to add, 0 to change, 0 to destroy.

   ...

   Apply complete! Resources: 9 added, 0 changed, 0 destroyed.

    

   Outputs:

   ...

   security_group_ids = {

   "alb" = "sg-0a1b2c3d4e5f60718"

   "app" = "sg-0b2c3d4e5f6071829"

   "db" = "sg-0c3d4e5f607182930"

   }

5. 5

   Verify the database rule from the CLI

   The DB group's only inbound rule references the app group, not a CIDR. That's the property you want to be able to prove to an auditor.

   terminalcopy cmd

   $ aws ec2 describe-security-group-rules \

   --filters Name=group-id,Values=$(terraform output -json security_group_ids | jq -r .db) \

   --query 'SecurityGroupRules[].[IsEgress,IpProtocol,FromPort,ReferencedGroupInfo.GroupId,CidrIpv4]' --output table

   ── expected output ──

   ------------------------------------------------------------

   | DescribeSecurityGroupRules |

   +-------+-------+-------+-------------------------+--------+

   | False| tcp | 5432 | sg-0b2c3d4e5f6071829 | None |

   +-------+-------+-------+-------------------------+--------+

Make each change, run the command, and read the error before revealing the diagnosis. Recognising these messages on sight is what makes you fast on a real team. Undo the change afterwards.