Skip to content

Commit b23ca08

Browse files
kv5hkv5h
authored
feat: Add rules for Wazuh (#243)
1 parent cb5a846 commit b23ca08

File tree

9 files changed

+712
-2
lines changed

9 files changed

+712
-2
lines changed

‎README.md

+2-2
Large diffs are not rendered by default.

‎modules/README.md

+1
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ List of Security Groups implemented as Terraform modules
4949
* [squid](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/squid)
5050
* [ssh](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/ssh)
5151
* [storm](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/storm)
52+
* [wazuh](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/wazuh)
5253
* [web](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/web)
5354
* [winrm](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/winrm)
5455
* [zipkin](https://github.com/terraform-aws-modules/terraform-aws-security-group/tree/master/modules/zipkin)

‎modules/wazuh/README.md

+119
Large diffs are not rendered by default.

‎modules/wazuh/auto_values.tf

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
# This file was generated from values defined in rules.tf using update_groups.sh.
2+
###################################
3+
# DO NOT CHANGE THIS FILE MANUALLY
4+
###################################
5+
6+
variable "auto_ingress_rules" {
7+
description = "List of ingress rules to add automatically"
8+
type = list(string)
9+
default = ["wazuh-server-agent-connection-tcp", "wazuh-server-agent-connection-udp", "wazuh-server-agent-enrollment", "wazuh-server-agent-cluster-daemon", "wazuh-server-syslog-collector-tcp", "wazuh-server-syslog-collector-udp", "wazuh-server-restful-api", "wazuh-indexer-restful-api", "wazuh-dashboard"]
10+
}
11+
12+
variable "auto_ingress_with_self" {
13+
description = "List of maps defining ingress rules with self to add automatically"
14+
type = list(map(string))
15+
default = [{ "rule" = "all-all" }]
16+
}
17+
18+
variable "auto_egress_rules" {
19+
description = "List of egress rules to add automatically"
20+
type = list(string)
21+
default = ["all-all"]
22+
}
23+
24+
variable "auto_egress_with_self" {
25+
description = "List of maps defining egress rules with self to add automatically"
26+
type = list(map(string))
27+
default = []
28+
}
29+
30+
# Computed
31+
variable "auto_computed_ingress_rules" {
32+
description = "List of ingress rules to add automatically"
33+
type = list(string)
34+
default = []
35+
}
36+
37+
variable "auto_computed_ingress_with_self" {
38+
description = "List of maps defining computed ingress rules with self to add automatically"
39+
type = list(map(string))
40+
default = []
41+
}
42+
43+
variable "auto_computed_egress_rules" {
44+
description = "List of computed egress rules to add automatically"
45+
type = list(string)
46+
default = []
47+
}
48+
49+
variable "auto_computed_egress_with_self" {
50+
description = "List of maps defining computed egress rules with self to add automatically"
51+
type = list(map(string))
52+
default = []
53+
}
54+
55+
# Number of computed rules
56+
variable "auto_number_of_computed_ingress_rules" {
57+
description = "Number of computed ingress rules to create by name"
58+
type = number
59+
default = 0
60+
}
61+
62+
variable "auto_number_of_computed_ingress_with_self" {
63+
description = "Number of computed ingress rules to create where 'self' is defined"
64+
type = number
65+
default = 0
66+
}
67+
68+
variable "auto_number_of_computed_egress_rules" {
69+
description = "Number of computed egress rules to create by name"
70+
type = number
71+
default = 0
72+
}
73+
74+
variable "auto_number_of_computed_egress_with_self" {
75+
description = "Number of computed egress rules to create where 'self' is defined"
76+
type = number
77+
default = 0
78+
}

‎modules/wazuh/main.tf

+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
module "sg" {
2+
source = "../../"
3+
4+
create = var.create
5+
name = var.name
6+
use_name_prefix = var.use_name_prefix
7+
description = var.description
8+
vpc_id = var.vpc_id
9+
revoke_rules_on_delete = var.revoke_rules_on_delete
10+
tags = var.tags
11+
12+
##########
13+
# Ingress
14+
##########
15+
# Rules by names - open for default CIDR
16+
ingress_rules = sort(compact(distinct(concat(var.auto_ingress_rules, var.ingress_rules, [""]))))
17+
18+
# Open for self
19+
ingress_with_self = concat(var.auto_ingress_with_self, var.ingress_with_self)
20+
21+
# Open to IPv4 cidr blocks
22+
ingress_with_cidr_blocks = var.ingress_with_cidr_blocks
23+
24+
# Open to IPv6 cidr blocks
25+
ingress_with_ipv6_cidr_blocks = var.ingress_with_ipv6_cidr_blocks
26+
27+
# Open for security group id
28+
ingress_with_source_security_group_id = var.ingress_with_source_security_group_id
29+
30+
# Default ingress CIDR blocks
31+
ingress_cidr_blocks = var.ingress_cidr_blocks
32+
ingress_ipv6_cidr_blocks = var.ingress_ipv6_cidr_blocks
33+
34+
# Default prefix list ids
35+
ingress_prefix_list_ids = var.ingress_prefix_list_ids
36+
37+
###################
38+
# Computed Ingress
39+
###################
40+
# Rules by names - open for default CIDR
41+
computed_ingress_rules = sort(compact(distinct(concat(var.auto_computed_ingress_rules, var.computed_ingress_rules, [""]))))
42+
43+
# Open for self
44+
computed_ingress_with_self = concat(var.auto_computed_ingress_with_self, var.computed_ingress_with_self)
45+
46+
# Open to IPv4 cidr blocks
47+
computed_ingress_with_cidr_blocks = var.computed_ingress_with_cidr_blocks
48+
49+
# Open to IPv6 cidr blocks
50+
computed_ingress_with_ipv6_cidr_blocks = var.computed_ingress_with_ipv6_cidr_blocks
51+
52+
# Open for security group id
53+
computed_ingress_with_source_security_group_id = var.computed_ingress_with_source_security_group_id
54+
55+
#############################
56+
# Number of computed ingress
57+
#############################
58+
number_of_computed_ingress_rules = var.auto_number_of_computed_ingress_rules + var.number_of_computed_ingress_rules
59+
number_of_computed_ingress_with_self = var.auto_number_of_computed_ingress_with_self + var.number_of_computed_ingress_with_self
60+
number_of_computed_ingress_with_cidr_blocks = var.number_of_computed_ingress_with_cidr_blocks
61+
number_of_computed_ingress_with_ipv6_cidr_blocks = var.number_of_computed_ingress_with_ipv6_cidr_blocks
62+
number_of_computed_ingress_with_source_security_group_id = var.number_of_computed_ingress_with_source_security_group_id
63+
64+
#########
65+
# Egress
66+
#########
67+
# Rules by names - open for default CIDR
68+
egress_rules = sort(compact(distinct(concat(var.auto_egress_rules, var.egress_rules, [""]))))
69+
70+
# Open for self
71+
egress_with_self = concat(var.auto_egress_with_self, var.egress_with_self)
72+
73+
# Open to IPv4 cidr blocks
74+
egress_with_cidr_blocks = var.egress_with_cidr_blocks
75+
76+
# Open to IPv6 cidr blocks
77+
egress_with_ipv6_cidr_blocks = var.egress_with_ipv6_cidr_blocks
78+
79+
# Open for security group id
80+
egress_with_source_security_group_id = var.egress_with_source_security_group_id
81+
82+
# Default egress CIDR blocks
83+
egress_cidr_blocks = var.egress_cidr_blocks
84+
egress_ipv6_cidr_blocks = var.egress_ipv6_cidr_blocks
85+
86+
# Default prefix list ids
87+
egress_prefix_list_ids = var.egress_prefix_list_ids
88+
89+
##################
90+
# Computed Egress
91+
##################
92+
# Rules by names - open for default CIDR
93+
computed_egress_rules = sort(compact(distinct(concat(var.auto_computed_egress_rules, var.computed_egress_rules, [""]))))
94+
95+
# Open for self
96+
computed_egress_with_self = concat(var.auto_computed_egress_with_self, var.computed_egress_with_self)
97+
98+
# Open to IPv4 cidr blocks
99+
computed_egress_with_cidr_blocks = var.computed_egress_with_cidr_blocks
100+
101+
# Open to IPv6 cidr blocks
102+
computed_egress_with_ipv6_cidr_blocks = var.computed_egress_with_ipv6_cidr_blocks
103+
104+
# Open for security group id
105+
computed_egress_with_source_security_group_id = var.computed_egress_with_source_security_group_id
106+
107+
#############################
108+
# Number of computed egress
109+
#############################
110+
number_of_computed_egress_rules = var.auto_number_of_computed_egress_rules + var.number_of_computed_egress_rules
111+
number_of_computed_egress_with_self = var.auto_number_of_computed_egress_with_self + var.number_of_computed_egress_with_self
112+
number_of_computed_egress_with_cidr_blocks = var.number_of_computed_egress_with_cidr_blocks
113+
number_of_computed_egress_with_ipv6_cidr_blocks = var.number_of_computed_egress_with_ipv6_cidr_blocks
114+
number_of_computed_egress_with_source_security_group_id = var.number_of_computed_egress_with_source_security_group_id
115+
}

‎modules/wazuh/outputs.tf

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
output "security_group_id" {
2+
description = "The ID of the security group"
3+
value = module.sg.security_group_id
4+
}
5+
6+
output "security_group_vpc_id" {
7+
description = "The VPC ID"
8+
value = module.sg.security_group_vpc_id
9+
}
10+
11+
output "security_group_owner_id" {
12+
description = "The owner ID"
13+
value = module.sg.security_group_owner_id
14+
}
15+
16+
output "security_group_name" {
17+
description = "The name of the security group"
18+
value = module.sg.security_group_name
19+
}
20+
21+
output "security_group_description" {
22+
description = "The description of the security group"
23+
value = module.sg.security_group_description
24+
}

0 commit comments

Comments
 (0)