Feat: Use Security Group Module; Restrict MSK Ingress Based on Enabled Protocols

[korenyoni]

what

• Use standardized Cloud Posse Security Group convention (https://github.com/cloudposse/terraform-aws-security-group)
• Restrict Security Group Ingress based on enabled MSK protocols.
• Bump minimum Terraform version to support SG module.

why

• The new Security Group standards include an input var.associated_security_group_ids which allows additional security groups to be associated with the MSK brokers, removing the need for var.broker_node_security_groups, hence why Feat: Add Broker Node Security Groups #41 is superseded by this PR.
• The Security Groups needs to be restricted based on which protocols are enabled.
• Abstract unnecessary SG-related logic (especially present when dynamically enabling or disabling various protocols for both SG-based and CIDR-based SG rules) via SG module.

references

• co-authored by @nitrocode
• Supersedes and closes Feat: Add Broker Node Security Groups #41
• Closes input variable security_groups is not being utilized #5
• Closes Restrict security group to tls port 9094 #16
• https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/msk_cluster#security_groups
• https://docs.aws.amazon.com/msk/latest/developerguide/client-access.html#port-info
• Similar PR: Upgrade to new securty-group standards terraform-aws-elasticache-redis#133

[korenyoni]

/test all

[korenyoni]

/test all

[korenyoni]

/test all

[korenyoni]

/test all

[korenyoni]

/test all

[Nuru]

This should default to true. Only default to false if it would successfully allow a non-breaking upgrade. In this case, default to true and if needed (which it probably is), add an explicit instruction to set it to false in the migration document.

Suggested change

	default = false
	default = true

[korenyoni]

@Nuru I was basing this on the instructions here:

https://github.com/cloudposse/terraform-aws-security-group/blob/c6e4156696ee28cad0cd927c82377fbd73156199/exports/security_group_inputs.tf#L71-L72

If the resource has to be deleted to change its security group,
then set the default to false and highlight the option to change
it to true in the release notes and migration documents.

This Pull Request has been updated, so we're dismissing all reviews.

[korenyoni]

/test all

[korenyoni]

/test all